chore(deps): bump the production-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates in the / directory: express-session, moment-timezone, mysql2 and nodemailer.

Updates express-session from 1.18.2 to 1.19.0

Release notes

Sourced from express-session's releases.

v1.19.0

What's Changed

Main Changes

• Add dynamic cookie options support Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request. This feature enables programmatic modification of cookie attributes like secure, httpOnly, sameSite, maxAge, domain, and path based on session or request conditions.

  var app = express()
  app.use(session({
    secret: 'keyboard cat',
    resave: false,
    saveUninitialized: true,
    cookie: function (req) {
      var match = req.url.match(/^\/([^/]+)/);
      return {
        path: match ? '/' + match[1] : '/',
        httpOnly: true,
        secure: req.secure || false,
        maxAge: 60000
      }
    }
  }))

• Add sameSite 'auto' support for automatic SameSite attribute configuration Added sameSite: 'auto' option for cookie configuration that automatically sets SameSite=None for HTTPS and SameSite=Lax for HTTP connections, simplifying cookie handling across different environments.

• deps: use tilde notation for dependencies

PRs

• chore: add funding to package.json by @​bjohansebas in expressjs/session#1071
• build(deps): bump actions/download-artifact from 4.3.0 to 6.0.0 by @​dependabot[bot] in expressjs/session#1086
• build(deps): bump github/codeql-action from 3.28.18 to 4.31.2 by @​dependabot[bot] in expressjs/session#1085
• build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @​dependabot[bot] in expressjs/session#1091
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @​dependabot[bot] in expressjs/session#1090
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 by @​dependabot[bot] in expressjs/session#1089
• build(deps): bump actions/checkout from 4.2.2 to 6.0.0 by @​dependabot[bot] in expressjs/session#1088
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 by @​dependabot[bot] in expressjs/session#1082
• refactor: remove unused sess parameter from generateSessionId fun… by @​Ayoub-Mabrouk in expressjs/session#1001
• chore: remove history.md from being packaged on publish by @​bjohansebas in expressjs/session#1097
• deps: use tilde notation for dependencies by @​bjohansebas in expressjs/session#1096
• Add sameSite 'auto' support to match secure 'auto' pattern by @​djunehor in expressjs/session#1087
• feat: add support to dynamic cookie options by @​lincond in expressjs/session#1027
• Release: 1.19.0 by @​UlisesGascon in expressjs/session#1107

New Contributors

• @​Ayoub-Mabrouk made their first contribution in expressjs/session#1001
• @​djunehor made their first contribution in expressjs/session#1087
• @​lincond made their first contribution in expressjs/session#1027

... (truncated)

Changelog

Sourced from express-session's changelog.

1.19.0 / 2026-01-22

• Add dynamic cookie options support
• Add sameSite 'auto' support for automatic SameSite attribute configuration
• deps: use tilde notation for dependencies

Commits

• c10b2a3 1.19.0 (#1107)
• 2673736 feat: add support to dynamic cookie options (#1027)
• 73e0193 Add sameSite 'auto' support to match secure 'auto' pattern (#1087)
• 264b6a0 deps: use tilde notation for dependencies (#1096)
• 6d69f09 chore: remove history.md from being packaged on publish (#1097)
• 00b8a5f refactor: remove unused sess parameter from generateSessionId function (#...
• 2cd6561 build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#1082)
• 1307f30 build(deps): bump actions/checkout from 4.2.2 to 6.0.0 (#1088)
• 0e7a438 build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#1089)
• a095a9a build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#1090)
• Additional commits viewable in compare view

Updates moment-timezone from 0.5.48 to 0.6.0

Release notes

Sourced from moment-timezone's releases.

Release 0.6.0

• Fixed and updated TypeScript definitions. #1132
  • Updated types to more accurately match the code implementation.
  • Added definitions for pre-built files (e.g. moment-timezone-with-data.js).

This release is a potential breaking change for TypeScript projects only. The types are now more accurate, but consumers might hit errors if they were relying on the more relaxed types.

No implementation code has changed in this release.

Changelog

Sourced from moment-timezone's changelog.

0.6.0 2025-05-25

• Fixed and updated TypeScript definitions. #1132
  • Updated types to more accurately match the code implementation.
  • Added definitions for pre-built files (e.g. moment-timezone-with-data.js).

This release is a potential breaking change for TypeScript projects only. The types are now more accurate, but consumers might hit errors if they were relying on the more relaxed types.

No implementation code has changed in this release.

Commits

• 92c6a36 Build moment-timezone 0.6.0
• d2618cf Bump version to 0.6.0
• d084bec changelog: Add missing PR links for data updates
• 83784ed Merge pull request #1132 from moment/typescript-fixes
• f159a57 Remove any type from input params definition
• c6d84e9 Add type definitions for built files
• c1215d4 Update type definitions to match the code implementation
• a2ea5b6 Update typing tests to include missing use cases
• See full diff in compare view

Updates mysql2 from 3.15.3 to 3.16.2

Release notes

Sourced from mysql2's releases.

v3.16.2

3.16.2 (2026-01-26)

Bug Fixes

• types: add missing ConnectionState type to Promise Connection interface (#4034) (2927949)

v3.16.1

3.16.1 (2026-01-15)

Bug Fixes

• named-placeholders: improve handling of mixed/nested quotes in query parsing (#4011) (3e00cd7)

v3.16.0

3.16.0 (2025-12-16)

Features

• BaseConnection: add state getter to track connection lifecycle (#3958) (a394487)

Changelog

Sourced from mysql2's changelog.

3.16.2 (2026-01-26)

Bug Fixes

• types: add missing ConnectionState type to Promise Connection interface (#4034) (2927949)

3.16.1 (2026-01-15)

Bug Fixes

• named-placeholders: improve handling of mixed/nested quotes in query parsing (#4011) (3e00cd7)

3.16.0 (2025-12-16)

Features

• BaseConnection: add state getter to track connection lifecycle (#3958) (a394487)

Commits

• c541c83 chore(master): release 3.16.2 (#4036)
• 2927949 fix(types): add missing ConnectionState type to Promise Connection interfac...
• 06db470 build(deps): bump lucide-react from 0.562.0 to 0.563.0 in /website (#4032)
• 30433e2 build(deps-dev): bump globals from 17.0.0 to 17.1.0 (#4031)
• 77f9877 build(deps-dev): bump @​types/node from 25.0.9 to 25.0.10 in /website (#4029)
• 3aaae0c build(deps): bump sass from 1.97.2 to 1.97.3 in /website (#4028)
• 8b9225d build(deps-dev): bump prettier from 3.8.0 to 3.8.1 in /website (#4027)
• 5d6dd6d build(deps-dev): bump prettier from 3.8.0 to 3.8.1 (#4026)
• a730cf8 build(deps-dev): bump @​types/node from 25.0.9 to 25.0.10 (#4025)
• e3bf525 ci: resolve database name hard-coded when it should be configurable (#4030)
• Additional commits viewable in compare view

Updates nodemailer from 7.0.11 to 7.0.13

Release notes

Sourced from nodemailer's releases.

v7.0.13

7.0.13 (2026-01-27)

Bug Fixes

• downgrade transient connection error logs to warn level (4c041db)

v7.0.12

7.0.12 (2025-12-22)

Bug Fixes

• added support for REQUIRETLS (#1793) (053ce6a)
• use 8bit encoding for message/rfc822 attachments (adf8611)

Changelog

Sourced from nodemailer's changelog.

7.0.13 (2026-01-27)

Bug Fixes

• downgrade transient connection error logs to warn level (4c041db)

7.0.12 (2025-12-22)

Bug Fixes

• added support for REQUIRETLS (#1793) (053ce6a)
• use 8bit encoding for message/rfc822 attachments (adf8611)

Commits

• 8931195 chore(master): release 7.0.13 (#1798)
• 9398d63 Bumped deps
• 4c041db fix: downgrade transient connection error logs to warn level
• a208a0b chore(master): release 7.0.12 (#1785)
• 053ce6a fix: added support for REQUIRETLS (#1793)
• adf8611 fix: use 8bit encoding for message/rfc822 attachments
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.