[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@dotenvx/dotenvx	2.23.0 → 2.38.0
@grpc/grpc-js (source)	1.14.5 → 1.14.6
@opentelemetry/core (source)	2.11.0 → 2.12.0
csv-parse (source)	7.0.2 → 7.0.3
fast-xml-parser	5.11.1 → 5.11.2
joi	18.2.9 → 18.3.0
nanoid	6.0.1 → 6.0.2
postcss (source)	8.5.28 → 8.5.30
undici (source)	7.29.1 → 7.30.1
uuid	14.0.2 → 14.0.3
ws	8.21.3 → 8.22.0
yaml (source)	2.9.0 → 2.9.1

---

Release Notes

dotenvx/dotenvx (@​dotenvx/dotenvx)

v2.38.0

Compare Source

Added

• Add getSync convenience (#​1029)

Changed

• Default to file key storage in non-interactive mode (#​1028)

v2.37.0

Compare Source

Added

• New: Dotenvx Armor Enclaved Keys - software enclaved on the remote provider like Vercel, GitHub Actions, and more. (#​1026)

⛨ Choose key type …
  ⛨ Armored
❯ ◊ Enclaved

v2.36.0

Compare Source

Added

• Add dotenvx armor invite command (#​1025)

v2.35.0

Compare Source

Added

• Add encrypt --with to bring public key. Useful for Dotenvx Armor's new remote enclaved private keys. Encrypt locally but decrypt only on the remote software enclave. Private keys never leave. (#​1022)

Changed

• Use atomic file writes in protect (#​1019)

v2.34.2

Compare Source

Changed

• Patch: fix atomic edge case of writing .env and .env.keys file (#​1014)

v2.34.1

Compare Source

Changed

• Patch: don't write public key on ctrl+c or prompt failure (#​1009)

v2.34.0

Compare Source

Changed

• Swap internal provider logic for @​dotenvx/providers (#​1008)
• BREAKING: Remove lock commands and support for unlocking. Passwords are too difficult to manage securely. Convenience not worth it for the agentic future we are entering. (#​1008)
• Return provider information with dotenvx keypair command (#​1008)
• Swap armor provider logic to @​dotenvx/providers#armor (#​1009)

v2.33.0

Compare Source

Added

• Add Envfile profiles for selecting .env file combinations with --profile or DOTENV_ENV.
• Automatically redact stdout/stderr from config() when an Envfile is present.

Changed

• Move Envfile processing into @dotenvx/primitives.
• First file wins when combining Envfile rules. run and check validate final values; encryption rules apply to encrypt, set, and protect.

v2.32.4

Compare Source

Changed

• Make Envfile the filename. Final decision. (#​1003)

v2.32.3

Compare Source

Changed

• Make Dotenvspec the filename (#​1002)
• Improve startup time for cli (#​1001)

v2.32.2

Compare Source

Changed

• Improve bundle size (#​1000)

v2.32.1

Compare Source

Changed

• Simplify custody picker to 3 initial options (#​998)

? Choose private key custody …
❯ ⛉ Local
  ⛨ Dotenvx Armor
  ⛊ Password Managers

v2.32.0

Compare Source

Changed

• BREAKING: Envfile renamed to Envspec file (#​996)
• BREAKING: dotenvx init removed. renamed to dotenvx spec. (#​996)

Added

• Envspec rules now guide check, run, encrypt, and protect. (#​996)

v2.31.1

Compare Source

Changed

• armor up should read for os secret store, 1password, and bitwarden (#​992)

v2.31.0

Compare Source

Added

• Add dotenvx feedback command so you (and your coding agent) can give feedback on the cli (#​987)
• Add dotenvx init for generating your Envfile (#​990)

Changed

• Restore ESM named imports such as import { config } from '@dotenvx/dotenvx', broken in 2.30.0 by the withEvents export (#​989).
• BREAKING: dotenvx validate renamed to dotenvx check and works off Envfile only going forward. Support for .env.example dropped. Switch to using an Envfile.

Removed

• BREAKING: dotenvx define removed. Use dotenvx init.

v2.30.0

Compare Source

Added

• Add dotenvx feedback command so you (and your coding agent) can give feedback on the cli (#​987)
• Add dotenvx init for generating your Envfile (#​990)

Changed

• Restore ESM named imports such as import { config } from '@dotenvx/dotenvx', broken in 2.30.0 by the withEvents export (#​989).
• BREAKING: dotenvx validate renamed to dotenvx check and works off Envfile only going forward. Support for .env.example dropped. Switch to using an Envfile.

Removed

• BREAKING: dotenvx define removed. Use dotenvx init.

v2.29.0

Compare Source

Added

• Add dotenvx protect to prevent plaintext .env files from being committed to code on a machine (#​980)

Changed

• Deprecate dotenvx gitignore. Use dotenvx protect.
• Deprecate dotenvx precommit. Use dotenvx protect.
• Deprecate dotenvx prebuild. Use dotenvx protect --docker.

v2.28.2

Compare Source

Changed

• Only owner can write to and read from .env.keys file (#​979)

v2.28.1

Compare Source

Changed

• Send pk via stdin to keychain. was argv. thank you @​kta1kri for the security report. (#​978)
• Move some commands under a hidden menu (#​973)

v2.28.0

Compare Source

Added

• Choose where you custody your keys (#​972)

Your private key
├── ⛉ Local Custody
│   ├── OS (macOS Keychain / Windows Credential Manager / Linux Secret Service)
│   ├── 1Password
│   ├── Bitwarden
│   └── File (.env.keys)
└── ⛊ Managed Custody
    └── ⛨ Armor

v2.27.0

Compare Source

Removed

• BREAKING: Removed run --validate flag and validate command against .env.example file. To be replaced soon with a modern validation scheme.

v2.26.1

Compare Source

Changed

• Add dotenvx 1password up|down|push|pull and dotenvx bitwarden up|down|push|pull (#​969)

v2.26.0

Compare Source

Added

• Add support for storing private key to bitwarden or 1password (#​968)

v2.25.0

Compare Source

Changed

• Store private key to os secret store rather than .env.keys by default (#​967)

v2.24.1

Compare Source

Changed

• Upgraded to latest @​dotenvx/primitives

v2.24.0

Compare Source

Changed

• Do not expand nested commands (#​965)

Removed

• BREAKING: Remove the -p shorthand for --plain; use --plain instead

grpc/grpc-node (@​grpc/grpc-js)

v1.14.6: @​grpc/grpc-js 1.14.6

Compare Source

• Address remaining instances of advisory GHSA-f596-whhp-79r4 (#​3105)
• Avoid Date allocations on request and channelz tracking paths (#​3090 contributed by @​olavloite)
• Avoid throwaway timer allocation in ResolvingCall (#​3092 contributed by @​olavloite)
• Avoid building metadata map when parsing trailers (#​3093 contributed by @​olavloite)
• Lazily allocate Metadata opaqueData map (#​3095 contributed by @​olavloite)
• Cache precomputed serviceUrl in InternalChannel (#​3097 contributed by @​olavloite)
• Memoize method config lookup in default config selector (#​3098 contributed by @​olavloite)
• Avoid array allocation for single-value metadata headers (#​3099 contributed by @​olavloite)
• Avoid allocations for empty CallCredentials on the RPC hot path (#​3100 contributed by @​olavloite)
• Avoid redundant metadata clone in RetryingCall on initial attempt (#​3101 contributed by @​olavloite)

open-telemetry/opentelemetry-js (@​opentelemetry/core)

v2.12.0

Compare Source

2.12.0

🚀 Features

• chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #​7086

🏠 Internal

• feat(ci): support releasing from maintenance branches #​6767 @​pichlermarc
  • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

adaltas/node-csv (csv-parse)

v7.0.3

Compare Source

Bug Fixes

• csv-parse: preserve typed column keys (#​500) (745f045)
• csv-parse: type the delimiter_auto score callback arguments (#​499) (4aa04da)

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.11.2

Compare Source

What's Changed

• fix: decode Uint8Array XML input as UTF-8 by @​emme1t in #​875
• fix: type EntityDecoderOptions.setXmlVersion's version as a number by @​YevheniiKotyrlo in #​880

New Contributors

• @​emme1t made their first contribution in #​875
• @​YevheniiKotyrlo made their first contribution in #​880

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

hapijs/joi (joi)

v18.3.0

Compare Source

ai/nanoid (nanoid)

v6.0.2

Compare Source

• Reduced JS bundle size (by @​bayandin).
• Fixed floats in size of customRandom (by @​lost-signals).
• Fixed performance of customRandom on changes size (by @​00200200).
• Fixed docs (by @​Likio3000 & @​lenamonj).

postcss/postcss (postcss)

v8.5.30

Compare Source

• Fix broken map on </style> escaping (by @​Rufflet).

v8.5.29

Compare Source

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

nodejs/undici (undici)

v7.30.1

Compare Source

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

What's Changed

• test: disable timeouts in h2 high concurrency regression by @​mcollina in #​5893
• test: reduce retry-after invalid date timing flake by @​mcollina in #​5892
• [v7.x] fix(session cache): fix bug in tls session caching (#​5882) by @​mrityunjay-pandey in #​6017
• [Backport v7.x] fix: avoid unbounded recursion in Set-Cookie attribute parser by @​janneh in #​5997
• [v7.x] fix(cookies): backport #​5663, #​5808 and #​5832 by @​mrityunjay-pandey in #​6019

New Contributors

• @​janneh made their first contribution in #​5997

Full Changelog: nodejs/undici@v7.30.0...v7.30.1

v7.30.0

Compare Source

What's Changed

• [Backport v7.x] fix: selectively re-enable SIMD for ppc64 by @​github-actions[bot] in #​5794
• Backport upgrade diagnostics lifecycle fixes to v7.x by @​BridgeAR in #​5783
• [Backport v7.x] fix: honor backpressure in decompression interceptor by @​mcollina in #​5837
• fix: close rejected HTTP/2 WebSocket streams on v7.x by @​mcollina in #​5876
• test(fetch): make pull-dont-push exceed any socket buffer by @​mcollina in #​5889

Full Changelog: nodejs/undici@v7.29.1...v7.30.0

uuidjs/uuid (uuid)

v14.0.3

Compare Source

Bug Fixes

• fix CITGM #​1154 (#​981) (b44f159)

websockets/ws (ws)

v8.22.0

Compare Source

Features

• Introduced the protocols option (8b918b0).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the
  state to WebSocket.CLOSING (#​2337).

eemeli/yaml (yaml)

v2.9.1

Compare Source

• Limit recursive merge aliases (#​685, #​713)
• Simplify line unfolding during quoted string parsing (#​714)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
drydock-website	Ready	Preview	Oct 20, 2026 3:21pm UTC
drydockdemo-website	Ready	Preview	Oct 20, 2026 3:21pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: CodesWhat/drydock/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0fcd25a9-1807-4e5a-9cdd-046f545af9f0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.