chore(deps): update npm (runtime)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
cors	2.8.5 → 2.8.6
date-fns	4.1.0 → 4.4.0
dotenv	17.2.3 → 17.4.2
express-validator (source)	7.3.1 → 7.3.2
ioredis	5.8.2 → 5.11.1
openai	6.10.0 → 6.49.0
pg (source)	8.16.3 → 8.22.0
pg-mem	3.0.5 → 3.0.14
swagger-jsdoc	6.2.8 → 6.3.0
tsx (source)	4.21.0 → 4.23.1

---

Release Notes

expressjs/cors (cors)

v2.8.6

Compare Source

==================

• Improve documentation (API, context, examples...)
• Remove additional markdown files from tarball

date-fns/date-fns (date-fns)

v4.4.0

Compare Source

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

• DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

• Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Compare Source

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

• Fixed missing modularized optimization fallback (for Next.js and others). See #​4193.

• Fixed pt locale first day of week to be Sunday. See #​4195 by @​ImRodry.

• Fixed zh-CN, zh-HK, and zh-TW locale month parsing for October, November, and December. See #​4194 by @​puneetdixit200.

v4.2.1

Compare Source

Fixed

• Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

Compare Source

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

• Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

motdotla/dotenv (dotenv)

v17.4.2

Compare Source

Changed

• Improved skill files - tightened up details (#​1009)

v17.4.1

Compare Source

Changed

• Change text injecting to injected (#​1005)

v17.4.0

Compare Source

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#​1003)

v17.3.1

Compare Source

Changed

• Fix as2 example command in README and update spanish README

v17.3.0

Compare Source

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

v17.2.4

Compare Source

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

express-validator/express-validator (express-validator)

v7.3.2

Compare Source

What's Changed

• bump lodash to 4.17.23 to fix CVE-2025-13465 by @​mahmoodhamdi in #​1355

Plus several docs changes.

New Contributors

• @​mahmoodhamdi made their first contribution in #​1357

Full Changelog: express-validator/express-validator@v7.3.1...v7.3.2

luin/ioredis (ioredis)

v5.11.1

Compare Source

Bug Fixes

• cluster: reconnect to nodes that restart without slot changes (#​2096) (c84b2ee)
• parse protocol-relative Redis URLs as TCP connections (#​2125) (131ee24)

v5.11.0

Compare Source

Bug Fixes

• prevent RangeError from string accumulation in pipeline (#​2088) (defc077)
• replace deprecated url.parse() with WHATWG URL API (#​2081) (0021a45), closes redis/ioredis#1747

Features

• add array commands, typings and tests (#​2114) (baf68d6)
• add increx command (#​2115) (37d0695)
• add Redis MSETEX support (#​2111) (04a4615)
• add typed GCRA command support and functional tests (#​2094) (468a802)
• add vector set command support (#​2116) (b7b3def)
• Add xnack command (#​2103) (187d29b)
• Add zinter zunion count (#​2104) (0d510bb)
• Implement TracingChannel support (#​2089) (4760e0a)

5.10.1 (2026-03-19)

Bug Fixes

• cluster: lazily start sharded subscribers (#​2090) (4f167bb)

v5.10.1

Compare Source

Bug Fixes

• prevent RangeError from string accumulation in pipeline (#​2088) (defc077)
• replace deprecated url.parse() with WHATWG URL API (#​2081) (0021a45), closes redis/ioredis#1747

Features

• add array commands, typings and tests (#​2114) (baf68d6)
• add increx command (#​2115) (37d0695)
• add Redis MSETEX support (#​2111) (04a4615)
• add typed GCRA command support and functional tests (#​2094) (468a802)
• add vector set command support (#​2116) (b7b3def)
• Add xnack command (#​2103) (187d29b)
• Add zinter zunion count (#​2104) (0d510bb)
• Implement TracingChannel support (#​2089) (4760e0a)

5.10.1 (2026-03-19)

Bug Fixes

• cluster: lazily start sharded subscribers (#​2090) (4f167bb)

v5.10.0

Compare Source

Bug Fixes

• prevent RangeError from string accumulation in pipeline (#​2088) (defc077)
• replace deprecated url.parse() with WHATWG URL API (#​2081) (0021a45), closes redis/ioredis#1747

Features

• add array commands, typings and tests (#​2114) (baf68d6)
• add increx command (#​2115) (37d0695)
• add Redis MSETEX support (#​2111) (04a4615)
• add typed GCRA command support and functional tests (#​2094) (468a802)
• add vector set command support (#​2116) (b7b3def)
• Add xnack command (#​2103) (187d29b)
• Add zinter zunion count (#​2104) (0d510bb)
• Implement TracingChannel support (#​2089) (4760e0a)

5.10.1 (2026-03-19)

Bug Fixes

• cluster: lazily start sharded subscribers (#​2090) (4f167bb)

v5.9.3

Compare Source

Features

• add hash field expiration commands and tests (5219f9f)
• add hexpireat & hexpiretime (#​2082) (b38124f)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.2 (2026-01-15)

Bug Fixes

• cluster: Cluster reconnect sharded subscribers (#​2060) (def9804)
• preserve replica slots on MOVED in pipelines (#​2059) (a1c3e9d)

Reverts

• Revert "fix: preserve replica slots on MOVED in pipelines (#​2059)" (#​2062) (517b932), closes #​2059 #​2062

5.9.1 (2026-01-08)

Bug Fixes

• make client-side blocking timeouts opt-in (#​2058) (07ed493)

v5.9.2

Compare Source

Features

• add hash field expiration commands and tests (5219f9f)
• add hexpireat & hexpiretime (#​2082) (b38124f)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.2 (2026-01-15)

Bug Fixes

• cluster: Cluster reconnect sharded subscribers (#​2060) (def9804)
• preserve replica slots on MOVED in pipelines (#​2059) (a1c3e9d)

Reverts

• Revert "fix: preserve replica slots on MOVED in pipelines (#​2059)" (#​2062) (517b932), closes #​2059 #​2062

5.9.1 (2026-01-08)

Bug Fixes

• make client-side blocking timeouts opt-in (#​2058) (07ed493)

v5.9.1

Compare Source

Features

• add hash field expiration commands and tests (5219f9f)
• add hexpireat & hexpiretime (#​2082) (b38124f)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.2 (2026-01-15)

Bug Fixes

• cluster: Cluster reconnect sharded subscribers (#​2060) (def9804)
• preserve replica slots on MOVED in pipelines (#​2059) (a1c3e9d)

Reverts

• Revert "fix: preserve replica slots on MOVED in pipelines (#​2059)" (#​2062) (517b932), closes #​2059 #​2062

5.9.1 (2026-01-08)

Bug Fixes

• make client-side blocking timeouts opt-in (#​2058) (07ed493)

v5.9.0

Compare Source

Features

• add hash field expiration commands and tests (5219f9f)
• add hexpireat & hexpiretime (#​2082) (b38124f)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.3 (2026-02-12)

Bug Fixes

• autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
• fix issue with moved command for replicas (#​2064) (de4eed4)
• types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.2 (2026-01-15)

Bug Fixes

• cluster: Cluster reconnect sharded subscribers (#​2060) (def9804)
• preserve replica slots on MOVED in pipelines (#​2059) (a1c3e9d)

Reverts

• Revert "fix: preserve replica slots on MOVED in pipelines (#​2059)" (#​2062) (517b932), closes #​2059 #​2062

5.9.1 (2026-01-08)

Bug Fixes

• make client-side blocking timeouts opt-in (#​2058) (07ed493)

openai/openai-node (openai)

v6.49.0

Compare Source

Full Changelog: v6.48.0...v6.49.0

Features

• api: accept None for prompt_cache_key/safety_identifier (c54a7f3)
• api: add support for spend_limit admin apis (e8238b0)
• helpers: add standard schema support (#​1997) (4ced1a8)
• helpers: add zod realtime function helper (#​1996) (ee59911)
• stlc: configurable CI runner and private-production-repo support in workflow templates (967a66b)
• zod: support schema definitions (#​1993) (eb04567)

Bug Fixes

• address code scanning findings (#​2007) (2706888)
• address remaining Dependabot alerts (#​2005) (6ab3428)
• azure: normalize endpoint trailing slashes (#​1995) (39a15b4)
• ci: restore explicit TypeScript SDK runner selection (fe79401)
• runTools: sanitize replayed messages (#​1990) (a60cc25)
• stream: handle audio completion markers (#​1991) (bd86817)
• zod: escape schema definition refs before strict validation (bff2b10)
• zod: infer parsed tool callback arguments (#​1992) (83cdb79)
• zod: preserve schema types while escaping refs (cb7e195)

Chores

• exclude Brewfile from language detection (#​2006) (9bec333)
• refresh more ecosystem test dependencies (#​2003) (3cafa55)

v6.48.0

Compare Source

Full Changelog: v6.47.0...v6.48.0

Features

• api: /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys" endpoint (9133b54)
• api: manual updates (34acd23)
• api: manual updates (3188968)

Bug Fixes

• normalize header names before appending (#​1941) (18e8c29)

Chores

• refresh ecosystem test dependencies (#​2002) (8009491)

v6.47.0

Compare Source

Full Changelog: v6.46.0...v6.47.0

Features

• add async event iterators (#​1977) (2ece8aa)
• add fromReadableStream to ResponseStream (#​1987) (5984f44)
• api: add owner_project_access to APIKeyListParams (7bfce97)
• pass context to runTools callbacks (#​1973) (a6f01e5)
• support streaming file uploads (#​1970) (a86f1fd)

Bug Fixes

• assistants: preserve readable stream deltas (#​1994) (1cdc019)
• avoid deep Deno Zod types (#​1980) (ae17127), closes #​984
• ci: bump @​arethetypeswrong/cli to ^0.18.0 and run CI workflows on Node 24 (baa0b2a)
• emit stream finalization errors (#​1972) (9555b71)
• handle Azure filter stream chunks (#​1982) (c1c5c28), closes #​1015
• zod: support zod v4 mini schemas (#​1985) (2df10fc)

Documentation

• clarify strict Zod function schemas (#​1988) (373b08a)

v6.46.0

Compare Source

Full Changelog: v6.45.0...v6.46.0

Features

• api: gpt-5.6-sol updates (6c397d5)

Bug Fixes

• assistants: place array delta entries by index instead of appending (#​1963) (0e18d30)
• runner: normalize missing tool call IDs (#​1958) (6371623)
• upgrade next to 15.5.16 in examples (#​1967) (95b54e5)

Documentation

• add Azure Assistants example (#​1975) (90a72e5), closes #​701
• document assistant stream failures (#​1979) (d93fbe5), closes #​959
• document file search result limits (#​1981) (e9dc283), closes #​1004

v6.45.0

Compare Source

Full Changelog: v6.44.0...v6.45.0

Features

• add afterCompletion hook to runTools (#​1064) (4976c22)
• realtime: support sideband call_id connections (#​1795) (4fd59e1)
• reject emitted promise on error in EventEmitter (#​1596) (e0b09da)
• responses: add response input items helper (#​1794) (7e5a86a)
• responses: add response stream accumulator helper (#​1793) (32e3e39)

Bug Fixes

• avoid serializing null optional bodies (e4ddff6)
• clean up stream abort listeners (#​1884) (be55b8f)
• Leading whitespace chunks break partial parser (structured outputs) (#​1213) (88d806e)
• responses: avoid parsing incomplete structured output (#​1852) (4c39681)
• responses: restore output_text on streamed final responses (#​1681) (bbde4d9)
• validate workload identity access tokens (#​1885) (80febe4)
• zod: fully resolve extracted wrapper definitions (#​1766) (5d46ed2)
• zod: sanitize extracted definition refs (#​1903) (6ef2111)

Chores

• internal: codegen related update (81fcf96)

Documentation

• add vision example using image URL (#​1571) (70966c9)
• azure: add Responses API example (#​1675) (46453b0)
• azure: use standard client for v1 chat (#​1692) (fba57e5)
• clarify abort-on-function-call example (#​1843) (f21f248)
• clarify assistant stream event names (#​1860) (95fc6cd)
• clarify supported zod schema features (#​1880) (ea93760)
• fix helper example links (#​1890) (9c58f39)
• fix typos in tool calls stream example (#​1817) (8915ef0)
• readme: fix two typos and remove duplicate section (#​1733) (e2f8051)
• runner: remove "the the" duplicate-word typo in JSDoc (#​1892) (52f075f)

Build System

• vendor tsc-multi build tool (#​1948) (7c35bcd)

v6.44.0

Compare Source

Full Changelog: v6.43.0...v6.44.0

Features

• api: update OpenAPI spec or Stainless config (d05bdbc)

v6.43.0

Compare Source

Full Changelog: v6.43.0...v6.44.0

Features

• api: update OpenAPI spec or Stainless config (d05bdbc)

v6.42.0

Compare Source

Full Changelog: v6.42.0...v6.43.0

Bug Fixes

• fix TS to use main (dc5078b)
• restore pnpm repo configuration on next (c2575d6)

Chores

• Convert repository to pnpm (#​1934) (fbf80f3)
• sync repo (34be1be)
• Update default branch references to main (#​1920) (5436f42)

Build System

• remove scheduled release (#​1936) (0c92f62)

v6.41.0

Compare Source

Full Changelog: v6.41.0...v6.42.0

Features

• api: responses.moderation and chat_completions.moderation (6d8f592)

v6.40.0

Compare Source

Full Changelog: v6.40.0...v6.41.0

Features

• api: Add Amazon Bedrock Responses support (#​1899) (535b045)

v6.39.1

Compare Source

Full Changelog: v6.39.1...v6.40.0

Features

• api: workload identity in audit logs, additional_tools item in responses, fix ActionSearch.query to be optional. (aee09f3)

Chores

• remove migrate CLI (673c618)

v6.39.0

Compare Source

Full Changelog: v6.39.0...v6.39.1

Bug Fixes

• Improve undici dispatcher mismatch guidance (#​1898) (b6e5fd6)
• treat text/plan with format: binary as raw upload (f9a632a)
• treat text/plan with format: binary as raw upload (323cb78)

Chores

• internal: codegen related update (d32deef)

v6.38.0

Compare Source

Full Changelog: v6.38.0...v6.39.0

Features

• api: api update (33ea11f)
• api: manual updates (c210b09)
• api: manual updates (92df9dc)
• api: update OpenAPI spec or Stainless config (c7c0f52)

Bug Fixes

• types: allow runtime fetch options (8f5003d)
• typescript: upgrade tsc-multi so that it works with Node 26 (068f9c6)

Chores

• api: docs updates (9d43adb)
• tests: remove redundant File import (5465bbe)

v6.37.0

Compare Source

Full Changelog: v6.37.0...v6.38.0

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Please retry analysis of this Pull-Request directly on SonarQube Cloud

[coveralls]

coverage: 91.547%. remained the same — renovate/npm-(runtime) into develop

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud