build(deps): bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #28 · Stakely/consolideth

dependabot · 2026-06-23T09:56:17Z

Bumps the npm_and_yarn group with 5 updates in the /api directory:

Package	From	To
joi	`17.13.3`	`17.13.4`
typeorm	`0.3.27`	`0.3.30`
form-data	`4.0.5`	`4.0.6`
qs	`6.15.0`	`6.15.2`
ws	`8.18.2`	`8.21.0`

Updates joi from 17.13.3 to 17.13.4

Commits

3d3ab76 17.13.4
4bcdf36 Merge pull request #3123 from hapijs/chore/backport-3113
97bd51d chore: backport #3113 to v17
See full diff in compare view

Updates typeorm from 0.3.27 to 0.3.30

Release notes

Sourced from typeorm's releases.

0.3.30

What's Changed

fix: scope invalidWhereValuesBehavior to high-level abstractions only by @naorpeled in typeorm/typeorm#11878

fix: scope computed-columns join to correct table in MSSQL schema query by @PreAgile in typeorm/typeorm#12288

fix: preserve user-defined shared join columns in change set by @PreAgile in typeorm/typeorm#12354

revert: fix up limit with joins by @alumni

fix(find-options): allow array values in JsonContains by @kyungseopk1m in typeorm/typeorm#12420

fix(cockroachdb): adjust join in loadTables to load correct table columns by @Cprakhar in typeorm/typeorm#12413

ci: use the v0.3 branch as base for detect-changes by @alumni

chore(release): release 0.3.30 by @alumni in typeorm/typeorm#12511

Full Changelog: typeorm/typeorm@0.3.29...0.3.30

0.3.29

What's Changed

fix: fix up aggregate methods ambiguous column by @Cprakhar in typeorm/typeorm#11822

fix: prevent eager-loaded entities from overwriting manual relations by @LeviHeber in typeorm/typeorm#11267

fix: release query runner when there is no migration to revert by @mjr128 in typeorm/typeorm#11232

fix: add async to the method using setFindOptions() by @bindon in typeorm/typeorm#10787

chore: disable eslint errors for chai assertions by @alumni in typeorm/typeorm#11833

ci(tests): Remove limitation of branches to run on by @OSA413 in typeorm/typeorm#11794

ci: upgrade actions to v6 by @pkuczynski in typeorm/typeorm#11844

docs(v0.3): add version dropdown (stable/dev) by @naorpeled in typeorm/typeorm#11863

fix(sap): QueryBuilder parameter of type JS Date not escaped correctly by @alumni in typeorm/typeorm#11867

feat(sap): add pool timeout by @alumni in typeorm/typeorm#11868

feat(qodo): enable new review experience in v0.3 by @naorpeled in typeorm/typeorm#11910

feat: add returning option to update/upsert operations by @naorpeled in typeorm/typeorm#11782

test: enable repository-returning test by @gioboa in typeorm/typeorm#11913

chore(qodo): disable in progress notification in v0.3 by @naorpeled in typeorm/typeorm#11928

ci(docs): add deploy Github Action to v0.3 branch by @naorpeled in typeorm/typeorm#11929

chore(qodo): disable persistent comments and inline code suggestions in v0.3 by @naorpeled in typeorm/typeorm#11989

chore(deps): update all dependencies to the latest minor version by @alumni in typeorm/typeorm#12015

fix(redis): redis cache version detection by @mguida22 in typeorm/typeorm#11936

ci: remove summary comments location policy by @naorpeled in typeorm/typeorm#12117

ci(qodo): remove /improve from pr and push commands by @naorpeled in typeorm/typeorm#12129

ci: migrate from npm to pnpm by @pkuczynski in typeorm/typeorm#12193

ci(qodo): sync qodo pr agent config from master by @naorpeled in typeorm/typeorm#12265

ci: remove docs indexing by @alumni in typeorm/typeorm#12435

fix(security): validate limit() in Update/SoftDelete query builders by @smith-xyz in typeorm/typeorm#12437

chore(deps): update all minor by @alumni in typeorm/typeorm#12443

chore(release): release 0.3.29 by @michaelbromley in typeorm/typeorm#12442

New Contributors

@LeviHeber made their first contribution in typeorm/typeorm#11267

@mjr128 made their first contribution in typeorm/typeorm#11232

@bindon made their first contribution in typeorm/typeorm#10787

Full Changelog: typeorm/typeorm@0.3.28...0.3.29

... (truncated)

Changelog

Sourced from typeorm's changelog.

0.3.30 (2026-05-18)

Bug Fixes

cockroachdb: adjust join in loadTables to load correct table columns (#12413) (d93402e)

find-options: allow array values in JsonContains (#12420) (90f169d)

preserve user-defined shared join columns in change set (#12354) (0aba011)

scope computed-columns join to correct table in MSSQL schema query (#12288) (6170be6)

scope invalidWhereValuesBehavior to high-level abstractions only (#11878) (1e10fb8)

Reverts

fix up limit with joins (#11987) (66f1ff8)

0.3.29 (2026-05-08)

Bug Fixes

add async to the method using setFindOptions() (#10787) (cc07c90)

change import for process dependency (#11248) (1c67c3b)

cli: init command loading non-existing package.json (#11947) (4d9d1a6)

fix up aggregate methods ambiguous column (#11822) (6e34756)

fix up limit with joins (#11987) (3657db8)

getPendingMigrations unnecessarily creating migrations table (#11672) (1dbc224)

postgres: execute queries sequentially to avoid pg 8.19.0 deprecation warning (#12105) (79829a0)

prevent columns with select false from being returned (#11944) (6b20831)

prevent eager-loaded entities from overwriting manual relations (#11267) (2d8c515)

propagate schema and database to closure junction table (#12110) (58b403f)

redis: redis cache version detection (#11936) (f22c7a2)

release query runner when there is no migration to revert (#11232) (a46eb0a)

sap: QueryBuilder parameter of type JS Date not escaped correctly (#11867) (5153436)

security: validate limit() in Update/SoftDelete query builders (#12437) (0d7991a)

virtual property handling in schema builder (#11000) (5bd3255)

Features

add returning option to update/upsert operations (#11782) (11d9767)

sap: add pool timeout (#11868) (b4e2ad2)

sap: support locking in select (#11996) (86a9e3e)

0.3.28 (2025-12-02)

Bug Fixes

add multiSubnetFailover option for mssql (#10804) (83e3a8a)

circular import in SapDriver.ts (#11750) (bed7913)

cli: init command reading package.json from two folders up (#11789) (dd55218)

deps: upgrade glob to fix CVE-2025-64756 (#11784) (dc74f53)

mongodb: add missing findBy method to MongoEntityManager (#11814) (38715bb)

redis: version detection logic (#11815) (6f486e5)

... (truncated)

Commits

4c91616 chore(release): release 0.3.30 (#12511)
7792d00 ci: use the v0.3 branch as base for detect-changes
d93402e fix(cockroachdb): adjust join in loadTables to load correct table columns (#1...
90f169d fix(find-options): allow array values in JsonContains (#12420)
66f1ff8 revert: fix up limit with joins (#11987)
0aba011 fix: preserve user-defined shared join columns in change set (#12354)
6170be6 fix: scope computed-columns join to correct table in MSSQL schema query (#12288)
1e10fb8 fix: scope invalidWhereValuesBehavior to high-level abstractions only (#11878)
0ed009a ci: add npm environment to publish job for trusted publishing
6ede38b chore: enable trusted publishing in publish workflow
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typeorm since your current version.

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates qs from 6.15.0 to 6.15.2

Changelog

Sourced from qs's changelog.

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

[Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters

[Deps] update @ljharb/eslint-config

[Dev Deps] update @ljharb/eslint-config, iconv-lite

[Tests] increase coverage

Commits

9aca407 v6.15.2
5e33d33 [Dev Deps] update @ljharb/eslint-config
21f80b3 [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + `e...
a0a81ea [Fix] stringify: use configured delimiter after charsetSentinel
e3062f7 [Fix] stringify: apply formatter to encoded key under strictNullHandling
0c180a4 [Fix] stringify: skip null/undefined filter-array entries instead of crashi...
3a8b94a [Tests] add regression tests for keys containing percent-encoded bracket text
96755ab [readme] fix grammar
a419ce5 [Fix] parse: handle nested bracket groups and add regression tests
3f5e1c5 v6.15.1
Additional commits viewable in compare view

Updates ws from 8.18.2 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});
The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

bca91ad [dist] 8.21.0
2b2abd4 [security] Limit retained message parts
78eabe2 [security] Add latest vulnerability to SECURITY.md
5d9b316 [dist] 8.20.1
c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
ce2a3d6 [ci] Test on node 26
58e45b8 [ci] Do not test on node 25
5f26c24 [ci] Run the lint step on node 24
8439255 [dist] 8.20.0
d3503c1 [minor] Export the PerMessageDeflate class and header utils
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 5 updates in the /api directory: | Package | From | To | | --- | --- | --- | | [joi](https://github.com/hapijs/joi) | `17.13.3` | `17.13.4` | | [typeorm](https://github.com/typeorm/typeorm) | `0.3.27` | `0.3.30` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [qs](https://github.com/ljharb/qs) | `6.15.0` | `6.15.2` | | [ws](https://github.com/websockets/ws) | `8.18.2` | `8.21.0` | Updates `joi` from 17.13.3 to 17.13.4 - [Commits](hapijs/joi@v17.13.3...v17.13.4) Updates `typeorm` from 0.3.27 to 0.3.30 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.3.27...0.3.30) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `qs` from 6.15.0 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.0...v6.15.2) Updates `ws` from 8.18.2 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.2...8.21.0) --- updated-dependencies: - dependency-name: joi dependency-version: 17.13.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: typeorm dependency-version: 0.3.30 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

kilo-code-bot · 2026-06-23T09:58:28Z

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Change Summary

Updates dependency metadata in api/package.json and api/package-lock.json.
Bumps joi to 17.13.4 and refreshes transitive packages including form-data, qs, ws, mysql2, and related lockfile entries.
Attempts to bump TypeORM, but resolves it to the 1.0.0 major line instead of the PR-described 0.3.30 patch/minor target.

Issue Details (click to expand)

CRITICAL

File	Line	Issue
`api/package.json`	97	TypeORM is upgraded to `^1.0.0` / resolved `1.0.0` instead of the PR-described `0.3.30`, introducing an unintended major-version and Node engine compatibility break.

Files Reviewed (2 files)

api/package.json - 1 issue
api/package-lock.json - 0 issues

Fix these issues in Kilo Cloud

_{Reviewed by gpt-5.5-2026-04-23 · Input: 68K · Output: 5.4K · Cached: 580.6K}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 23, 2026

dependabot Bot mentioned this pull request Jun 23, 2026

build(deps): bump the npm_and_yarn group across 1 directory with 4 updates #27

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates#28

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates#28
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/api/npm_and_yarn-510305a7d9

dependabot Bot commented on behalf of github Jun 23, 2026

Uh oh!

kilo-code-bot Bot commented Jun 23, 2026 •

edited

Loading

CRITICAL

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 23, 2026

0.3.30

What's Changed

0.3.29

What's Changed

New Contributors

0.3.30 (2026-05-18)

Bug Fixes

Reverts

0.3.29 (2026-05-08)

Bug Fixes

Features

0.3.28 (2025-12-02)

Bug Fixes

v4.0.6 - 2026-06-12

Commits

6.15.2

6.15.1

8.21.0

Features

Bug fixes

8.20.1

Uh oh!

kilo-code-bot Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Overview

Change Summary

CRITICAL

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

kilo-code-bot Bot commented Jun 23, 2026 •

edited

Loading