Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/graasp/graasp-api).

## Deprecations / Replacements
> [!WARNING]
The following dependencies are either deprecated or have replacements available.

| Datasource | Package | Replacement PR? |
|------------|------|--------------|
| npm | `@types/mime` |  |
| npm | `@types/uuid` |  |

## Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

- [ ] fix(deps): update dependency @fastify/busboy to v3.2.2
- [ ] fix(deps): update dependency @fastify/forwarded to v3.0.2
- [ ] fix(deps): update dependency @sinclair/typebox to v0.34.52
- [ ] fix(deps): update dependency fs-extra to v11.3.6
- [ ] fix(deps): update dependency h5p-standalone to v3.8.2
- [ ] fix(deps): update dependency jsonwebtoken to v9.0.3
- [ ] fix(deps): update dependency lib0 to v0.2.117
- [ ] fix(deps): update dependency mimetics to v1.0.5
- [ ] fix(deps): update dependency nodemailer to v9.0.5
- [ ] fix(deps): update dependency papaparse to v5.5.5
- [ ] fix(deps): update dependency pino to v10.3.1
- [ ] fix(deps): update dependency sanitize-filename to v1.6.4
- [ ] fix(deps): update dependency url-http to v1.3.18
- [ ] fix(deps): update dependency ws to v8.21.3
- [ ] fix(deps): update dependency y-protocols to v1.0.7
- [ ] fix(deps): update dependency yjs to v13.6.32
- [ ] chore(deps): update dxflrs/garage docker tag to v2.3.0
- [ ] chore(deps): update ghcr.io/umami-software/umami docker tag to v3.3.1
- [ ] chore(deps): update node.js to v24.19.0
- [ ] chore(deps): update pnpm to v11.23.0
- [ ] chore(deps): update postgres docker tag to v15.19
- [ ] chore(deps): update postgres docker tag to v16.15
- [ ] fix(deps): update aws-sdk-js-v3 monorepo to v3.1116.0 (`@aws-sdk/client-s3`, `@aws-sdk/lib-storage`, `@aws-sdk/s3-request-presigner`)
- [ ] fix(deps): update bull-board monorepo to v6.21.3 (`@bull-board/api`, `@bull-board/fastify`, `@bull-board/ui`)
- [ ] fix(deps): update dependency @fastify/cors to v11.3.0
- [ ] fix(deps): update dependency @fastify/helmet to v13.1.1
- [ ] fix(deps): update dependency @fastify/swagger to v9.8.1
- [ ] fix(deps): update dependency @fastify/type-provider-typebox to v5.2.0
- [ ] fix(deps): update dependency @fastify/websocket to v11.3.0
- [ ] fix(deps): update dependency @rapideditor/country-coder to v5.6.1
- [ ] fix(deps): update dependency bullmq to v5.81.3
- [ ] fix(deps): update dependency date-fns to v4.4.0
- [ ] fix(deps): update dependency dotenv to v16.6.1
- [ ] fix(deps): update dependency fast-json-stringify to v6.4.0
- [ ] fix(deps): update dependency fastify to v5.12.1
- [ ] fix(deps): update dependency fs-extra to v11.4.0
- [ ] fix(deps): update dependency ioredis to v5.11.1
- [ ] fix(deps): update dependency meilisearch to v0.60.0
- [ ] fix(deps): update dependency openai to v6.49.0
- [ ] fix(deps): update dependency papaparse to v5.6.0
- [ ] fix(deps): update dependency passport-custom to v1.2.1
- [ ] fix(deps): update dependency pdf2pic to v3.2.0
- [ ] fix(deps): update dependency pg to v8.23.0
- [ ] fix(deps): update dependency tsyringe to v4.10.0
- [ ] chore(deps): update actions/cache action to v6
- [ ] chore(deps): update actions/checkout action to v7
- [ ] chore(deps): update actions/deploy-pages action to v5
- [ ] chore(deps): update actions/upload-pages-artifact action to v5
- [ ] chore(deps): update aws-actions/configure-aws-credentials action to v6
- [ ] chore(deps): update commitlint monorepo to v21 (`@commitlint/cli`, `@commitlint/config-conventional`)
- [ ] chore(deps): update dependency @faker-js/faker to v10
- [ ] chore(deps): update dependency @trivago/prettier-plugin-sort-imports to v6
- [ ] chore(deps): update dependency @types/nodemailer to v8
- [ ] chore(deps): update dependency @types/uuid to v11
- [ ] chore(deps): update dependency concurrently to v10
- [ ] chore(deps): update dependency eslint to v10
- [ ] chore(deps): update dependency eslint-config-prettier to v10
- [ ] chore(deps): update dependency eslint-import-resolver-typescript to v4
- [ ] chore(deps): update dependency nock to v14
- [ ] chore(deps): update dependency sodium-native to v5
- [ ] chore(deps): update dependency typescript to v7
- [ ] chore(deps): update dependency vitest to v4
- [ ] chore(deps): update dependency wait-for-expect to v4
- [ ] chore(deps): update etherpad/etherpad docker tag to v3
- [ ] chore(deps): update googleapis/release-please-action action to v5
- [ ] chore(deps): update jdx/mise-action action to v4
- [ ] chore(deps): update jest monorepo to v30 (`@jest/globals`, `@types/jest`, `jest`)
- [ ] chore(deps): update mcr.microsoft.com/vscode/devcontainers/javascript-node docker tag to v26
- [ ] chore(deps): update postgres docker tag to v18
- [ ] fix(deps): update bull-board monorepo to v9 (`@bull-board/api`, `@bull-board/fastify`, `@bull-board/ui`)
- [ ] fix(deps): update dependency @fastify/multipart to v10
- [ ] fix(deps): update dependency @fastify/passport to v4
- [ ] fix(deps): update dependency @fastify/swagger-ui to v6
- [ ] fix(deps): update dependency @fastify/type-provider-typebox to v6
- [ ] fix(deps): update dependency @graasp/etherpad-api to v3
- [ ] fix(deps): update dependency bcrypt to v6 (`bcrypt`, `@types/bcrypt`)
- [ ] fix(deps): update dependency bullmq to v6
- [ ] fix(deps): update dependency dotenv to v17
- [ ] fix(deps): update dependency fast-json-stringify to v7
- [ ] fix(deps): update dependency fastify-plugin to v6
- [ ] fix(deps): update dependency geoip-lite to v2
- [ ] fix(deps): update dependency i18next to v26
- [ ] fix(deps): update dependency ioredis to v6
- [ ] fix(deps): update dependency openai to v7
- [ ] fix(deps): update dependency secure-json-parse to v4
- [ ] fix(deps): update dependency uuid to v14
- [ ] 🔐 **Create all awaiting schedule PRs at once** 🔐

## PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

- [ ] [chore(deps): update getmeili/meilisearch docker tag to v1.53](../pull/1668)

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [fix(deps): update dependency sanitize-html to v2.17.5 [security]](../pull/2158)
- [ ] [fix(deps): update dependency sharp to v0.35.0 [security]](../pull/2159)
- [ ] [fix(deps): update dependency @fastify/static to v10 [security]](../pull/2160)
- [ ] [chore(deps): update devdependencies (non-major) (patch)](../pull/2144) (`@quobix/vacuum`, `@types/node`, `@types/nodemailer`, `@types/pg`, `@typescript-eslint/eslint-plugin`, `@typescript-eslint/parser`, `concurrently`, `prettier`, `ts-jest`, `vitest`)
- [ ] [chore(deps): update devdependencies (non-major) (minor)](../pull/2145) (`@quobix/vacuum`, `@types/node`, `@types/pg`, `@typescript-eslint/eslint-plugin`, `@typescript-eslint/parser`, `prettier`, `y-websocket`)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [chore(deps): update dependency sodium-native to v4.2.2](../pull/1659)
- [ ] [fix(deps): update dependency @sentry/tracing to v7.120.4](../pull/1963)
- [ ] [chore(deps): update dependency sodium-native to v4.3.3](../pull/1700)
- [ ] [chore(deps): update etherpad/etherpad docker tag to v1.9.7](../pull/732)
- [ ] [fix(deps): update dependency @sentry/node to v7.120.4](../pull/1854)
- [ ] [fix(deps): update dependency @sentry/node to v10](../pull/2031)
- [ ] [fix(deps): update dependency mime to v4](../pull/1215) (`mime`, `@types/mime`)
- [ ] [fix(deps): update dependency node-fetch to v3](../pull/1216)
- [ ] [fix(deps): update dependency pdf-text-reader to v5](../pull/1217)

## Detected Dependencies

docker-compose (2)

.devcontainer/docker-compose.yml (6)

- `postgres 16.11-alpine` → [Updates: `16.15-alpine`, `18.6-alpine`]
- `getmeili/meilisearch v1.8` → [Updates: `v1.53`]
- `ghcr.io/umami-software/umami 3.0.3` → [Updates: `3.3.1`]
- `dxflrs/garage v2.0.0` → [Updates: `v2.3.0`]
- `joseluisq/static-web-server 2`
- `caddy 2`

docker/compose.yml (3)

- `postgres 15.8-alpine` → [Updates: `15.19-alpine`, `18.6-alpine`]
- `getmeili/meilisearch v1.8` → [Updates: `v1.53`]
- `joseluisq/static-web-server 2`

dockerfile (5)

.devcontainer/Dockerfile (1)

- `mcr.microsoft.com/vscode/devcontainers/javascript-node 24` → [Updates: `26`]

docker/Dockerfile (2)

- `node 24.12-trixie` → [Updates: `24.19-trixie`]
- `node 24.12-bookworm-slim` → [Updates: `24.19-bookworm-slim`]

docker/migrate.Dockerfile (2)

- `node 24.12.0-bookworm` → [Updates: `24.19.0-bookworm`]
- `node 24.12.0-bookworm-slim` → [Updates: `24.19.0-bookworm-slim`]

docker/workers.Dockerfile (2)

- `node 24.12-trixie` → [Updates: `24.19-trixie`]
- `node 24.12-bookworm-slim` → [Updates: `24.19-bookworm-slim`]

src/services/item/plugins/etherpad/Dockerfile (1)

- `etherpad/etherpad 1.8.18` → [Updates: `1.9.7`, `3.3.3`]

github-actions (7)

.github/actions/build-images/action.yml (1)

- `aws-actions/configure-aws-credentials v4` → [Updates: `v6`]

.github/workflows/auto-tag.yml (1)

- `graasp/graasp-deploy v1`

.github/workflows/deploy-db-doc.yml (4)

- `actions/checkout v6` → [Updates: `v7`]
- `jdx/mise-action v4`
- `actions/upload-pages-artifact v3` → [Updates: `v5`]
- `actions/deploy-pages v4` → [Updates: `v5`]

.github/workflows/deploy-dev.yml (2)

- `actions/checkout v4` → [Updates: `v7`]
- `ubuntu 24.04-arm`

.github/workflows/nudenet.yml (4)

- `actions/checkout v5` → [Updates: `v7`]
- `actions/checkout v5` → [Updates: `v7`]
- `aws-actions/configure-aws-credentials v4` → [Updates: `v6`]
- `ubuntu 24.04-arm`

.github/workflows/release-please.yml (4)

- `googleapis/release-please-action v4` → [Updates: `v5`]
- `actions/checkout v4` → [Updates: `v7`]
- `graasp/graasp-deploy v1`
- `ubuntu 24.04-arm`

.github/workflows/test.yml (5)

- `actions/checkout v6` → [Updates: `v7`]
- `jdx/mise-action v3` → [Updates: `v4`]
- `actions/checkout v6` → [Updates: `v7`]
- `jdx/mise-action v3` → [Updates: `v4`]
- `actions/cache v4` → [Updates: `v6`]

mise (1)

mise.toml (1)

- `node 24`

npm (2)

package.json (133)

- `@aws-sdk/client-s3 3.787.0` → [Updates: `3.1116.0`]
- `@aws-sdk/lib-storage 3.787.0` → [Updates: `3.1116.0`]
- `@aws-sdk/s3-request-presigner 3.787.0` → [Updates: `3.1116.0`]
- `@bull-board/api 6.10.1` → [Updates: `6.21.3`, `9.4.0`]
- `@bull-board/fastify 6.10.1` → [Updates: `6.21.3`, `9.4.0`]
- `@bull-board/ui 6.10.1` → [Updates: `6.21.3`, `9.4.0`]
- `@fastify/busboy 3.2.0` → [Updates: `3.2.2`]
- `@fastify/cors 11.2.0` → [Updates: `11.3.0`]
- `@fastify/error 4.2.0`
- `@fastify/forwarded 3.0.1` → [Updates: `3.0.2`]
- `@fastify/helmet 13.0.2` → [Updates: `13.1.1`]
- `@fastify/multipart 9.4.0` → [Updates: `10.1.1`]
- `@fastify/passport 3.0.2` → [Updates: `4.0.2`]
- `@fastify/secure-session 8.3.0`
- `@fastify/static 9.1.3` → [Updates: `10.1.2`]
- `@fastify/swagger 9.7.0` → [Updates: `9.8.1`]
- `@fastify/swagger-ui 5.2.6` → [Updates: `6.1.1`]
- `@fastify/type-provider-typebox 5.1.0` → [Updates: `5.2.0`, `6.1.0`]
- `@fastify/websocket 11.2.0` → [Updates: `11.3.0`]
- `@graasp/etherpad-api 2.1.1` → [Updates: `3.0.0`]
- `@graasp/sdk 5.18.2`
- `@rapideditor/country-coder 5.4.0` → [Updates: `5.6.1`]
- `@sentry/node 7.119.2` → [Updates: `7.120.4`, `10.70.0`]
- `@sentry/tracing 7.120.3` → [Updates: `7.120.4`]
- `@sinclair/typebox 0.34.49` → [Updates: `0.34.52`]
- `ajv 8.20.0`
- `bcrypt 5.1.1` → [Updates: `6.0.0`]
- `bullmq 5.46.1` → [Updates: `5.81.3`, `6.2.0`]
- `date-fns 4.1.0` → [Updates: `4.4.0`]
- `dotenv 16.4.7` → [Updates: `16.6.1`, `17.4.2`]
- `drizzle-orm 0.45.2`
- `extract-zip 2.0.1`
- `fast-json-stringify 6.0.1` → [Updates: `6.4.0`, `7.0.1`]
- `fastify 5.8.5` → [Updates: `5.12.1`]
- `fastify-nodemailer 5.0.0`
- `fastify-plugin 5.1.0` → [Updates: `6.0.0`]
- `form-data 4.0.6`
- `fs-extra 11.3.0` → [Updates: `11.3.6`, `11.4.0`]
- `geoip-lite 1.4.10` → [Updates: `2.0.3`]
- `h5p-standalone 3.8.0` → [Updates: `3.8.2`]
- `http-status-codes 2.3.0`
- `i18next 24.2.3` → [Updates: `26.4.0`]
- `ioredis 5.6.1` → [Updates: `5.11.1`, `6.0.0`]
- `jsonwebtoken 9.0.2` → [Updates: `9.0.3`]
- `lib0 0.2.114` → [Updates: `0.2.117`]
- `lodash.groupby 4.6.0`
- `lodash.partition 4.6.0`
- `lodash.uniqby 4.7.0`
- `meilisearch 0.41.0` → [Updates: `0.60.0`]
- `mime 3.0.0` → [Updates: `4.1.0`]
- `mimetics 1.0.4` → [Updates: `1.0.5`]
- `node-fetch 2` → [Updates: `3`]
- `nodemailer 9.0.1` → [Updates: `9.0.5`]
- `openai 6.3.0` → [Updates: `6.49.0`, `7.5.0`]
- `papaparse 5.5.3` → [Updates: `5.5.5`, `5.6.0`]
- `passport-custom 1.1.1` → [Updates: `1.2.1`]
- `passport-jwt 4.0.1`
- `passport-local 1.0.0`
- `pdf-text-reader 3.0.2` → [Updates: `5.1.1`]
- `pdf2pic 3.1.4` → [Updates: `3.2.0`]
- `pg 8.14.1` → [Updates: `8.23.0`]
- `pino 10.3.0` → [Updates: `10.3.1`]
- `reflect-metadata 0.2.2`
- `sanitize-filename 1.6.3` → [Updates: `1.6.4`]
- `sanitize-html 2.17.4` → [Updates: `2.17.5`]
- `secure-json-parse 2.7.0` → [Updates: `4.1.0`]
- `sharp 0.33.5` → [Updates: `0.35.0`]
- `striptags 3.2.0`
- `tmp-promise 3.0.3`
- `tsyringe 4.9.1` → [Updates: `4.10.0`]
- `url-http 1.3.4` → [Updates: `1.3.18`]
- `uuid 11.1.1` → [Updates: `14.0.2`]
- `ws 8.21.0` → [Updates: `8.21.3`]
- `y-protocols 1.0.6` → [Updates: `1.0.7`]
- `yazl 3.3.1`
- `yjs 13.6.27` → [Updates: `13.6.32`]
- `@commitlint/cli 19.8.1` → [Updates: `21.2.2`]
- `@commitlint/config-conventional 19.8.1` → [Updates: `21.2.2`]
- `@faker-js/faker 9.9.0` → [Updates: `10.6.0`]
- `@jest/globals 29.7.0` → [Updates: `30.4.1`]
- `@liam-hq/cli 0.7.24`
- `@quobix/vacuum 0.26.4` → [Updates: `0.26.8`, `0.30.0`]
- `@trivago/prettier-plugin-sort-imports 5.2.2` → [Updates: `6.0.2`]
- `@types/bad-words 3.0.3`
- `@types/bcrypt 5.0.2` → [Updates: `6.0.0`]
- `@types/checksum 0.1.35`
- `@types/content-disposition 0.5.9`
- `@types/fs-extra ^11`
- `@types/geoip-lite 1.4.4`
- `@types/jest 29.5.14` → [Updates: `30.0.0`]
- `@types/jsonwebtoken 9.0.10`
- `@types/lodash.groupby 4.6.9`
- `@types/lodash.partition ^4`
- `@types/lodash.uniqby 4.7.9`
- `@types/mime 3.0.4` → [Updates: `4.0.0`]
- `@types/node 24.12.2` → [Updates: `24.12.4`, `24.13.3`]
- `@types/node-fetch 2`
- `@types/nodemailer 6.4.23` → [Updates: `6.4.24`, `8.0.1`]
- `@types/papaparse 5.5.2`
- `@types/passport-jwt 4.0.1`
- `@types/passport-local ^1`
- `@types/pg 8.20.0` → [Updates: `8.20.4`, `8.23.1`]
- `@types/sanitize-html 2.16.1`
- `@types/uuid 10.0.0` → [Updates: `11.0.0`]
- `@types/ws 8.18.1`
- `@types/yazl 3.3.1`
- `@typescript-eslint/eslint-plugin 8.59.1` → [Updates: `8.59.4`, `8.67.0`]
- `@typescript-eslint/parser 8.59.1` → [Updates: `8.59.4`, `8.67.0`]
- `checksum 1.0.0`
- `concurrently 9.2.1` → [Updates: `9.2.4`, `10.0.5`]
- `dir-compare 5.0.0`
- `drizzle-kit 0.31.10`
- `eslint 8.57.1` → [Updates: `10.9.0`]
- `eslint-config-prettier 8.10.2` → [Updates: `10.1.8`]
- `eslint-import-resolver-typescript 3.10.1` → [Updates: `4.4.5`]
- `eslint-plugin-import 2.32.0`
- `husky 9.1.7`
- `jest 29.7.0` → [Updates: `30.4.2`]
- `nock 13.5.6` → [Updates: `14.0.17`]
- `nodemon 3.1.14`
- `pino-pretty 13.1.3`
- `prettier 3.8.3` → [Updates: `3.8.5`, `3.9.6`]
- `ts-jest 29.4.9` → [Updates: `29.4.12`]
- `ts-node 10.9.2`
- `typescript 5.9.3` → [Updates: `7.0.2`]
- `vitest 3.2.6` → [Updates: `3.2.7`, `4.1.11`]
- `wait-for-expect 3.0.2` → [Updates: `4.0.0`]
- `y-websocket 3.0.0` → [Updates: `3.1.0`]
- `node >=24.12.0`
- `sodium-native 4.2.0` → [Updates: `4.2.2`, `4.3.3`, `5.1.0`]
- `fastify 5.8.5` → [Updates: `5.12.1`]
- `@sinclair/typebox 0.34.49` → [Updates: `0.34.52`]
- `pnpm 11.2.2` → [Updates: `11.23.0`]

pnpm-workspace.yaml

renovate-config (1)

renovate.json

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository