[dependabot]

Bumps the npm-major group with 5 updates in the / directory:

Package	From	To
formidable	1.2.6	3.5.4
loopback-connector	4.8.0	8.0.3
strong-globalize	2.10.0	6.0.6
uuid	3.4.0	14.0.3
loopback-datasource-juggler	2.59.3	7.0.4

Updates formidable from 1.2.6 to 3.5.4

Release notes

Sourced from formidable's releases.

v3.5.4

What's Changed

• switch to pnpm, minimize deps & devDeps, fix deps through pnpm audit
• remove os.machine, fix #994 in #995

Full Changelog: node-formidable/formidable@v3.5.3...v3.5.4

v3.5.3

What's Changed

• Fix existing test failure by @​ryhmrt in node-formidable/formidable#990

• update Ryan Dahl x account link by @​moetezch in node-formidable/formidable#989

• update failing tests

• update CI/CD workflows and actions;

• update CodeQL github action for security analysis

• update readme, links and badges

• update to use cuid2 (battle-tested @paralleldrive/cuid2 package) for better random names - should not be breaking anything since it's still 25 characters long, but a lot safer and faster.

New Contributors

• @​ryhmrt made their first contribution in node-formidable/formidable#990
• @​moetezch made their first contribution in node-formidable/formidable#989

Full Changelog: node-formidable/formidable@v3.5.2...v3.5.3

v3.5.2

No release notes provided.

v3.2.5

No release notes provided.

3.2.4

No release notes provided.

3.1.4

https://github.com/node-formidable/formidable/blob/master/CHANGELOG.md

Changelog

Sourced from formidable's changelog.

3.5.4

• fix the os.machine breaking some dependents, fix #994
• add Node 16, 18, 20, 22 to CI/CD

3.5.3

• security report by ZAST.AI help for some vulnerabilities addressing (primarily the random names generation)
• update failing tests
• update CI/CD workflows and actions;
• update CodeQL github action for security analysis
• update readme, links and badges
• update to use cuid2 (battle-tested @paralleldrive/cuid2 package) for better random names - should not be breaking anything since it's still 25 characters long, but a lot safer and faster.

3.5.2

• fix: (#982) make it easier to import hexoid with webpack

3.5.1

• fix: (#945) multipart parser fix: flush or fail always (don't hang)

3.5.0

• feature: (#944) Dual package: Can be imported as ES module and required as commonjs module

3.4.0

• feature: (#940) form.parse returns a promise if no callback is provided
• it resolves with an array [fields, files]

3.3.2

• feature: (#855) add options.createDirsFromUploads, see README for usage
• form.parse is an async function (ignore the promise)
• benchmarks: add e2e becnhmark with as many request as possible per second
  • npm run to display all the commands
• mark as latest on npm

3.2.5

• fix: (#881) fail earlier when maxFiles is exceeded

3.2.4

• fix: (#857) improve keep extension
• The code from before 3.2.4 already removed some characters from the file extension. But not always. So it was inconsistent.

... (truncated)

Commits

• See full diff in compare view

Updates loopback-connector from 4.8.0 to 8.0.3

Changelog

Sourced from loopback-connector's changelog.

2026-09-15, Version 8.0.3

• chore: lock file maintenance (renovate[bot])

• chore: update dependency mocha to ^12.0.1 (renovate[bot])

• chore: update github/codeql-action action to v4.38.0 (renovate[bot])

• chore: update dependency mocha to v12 (renovate[bot])

• chore: update dependency @​eslint/eslintrc to ^3.3.7 (renovate[bot])

• chore: update github/codeql-action action to v4.37.9 (renovate[bot])

• chore: update github/codeql-action action to v4.37.8 (renovate[bot])

• chore: update dependency uuid to ^14.0.2 (renovate[bot])

• chore: update dependency loopback-datasource-juggler to ^7.0.2 (renovate[bot])

2026-08-17, Version 8.0.2

• chore: lock file maintenance (renovate[bot])

• chore: update github/codeql-action action to v4.37.7 (renovate[bot])

• chore: update commitlint monorepo to ^21.2.2 (renovate[bot])

• chore: update github/codeql-action action to v4.37.6 (renovate[bot])

• chore: update github/codeql-action action to v4.37.5 (renovate[bot])

• chore: update dependency mocha to ^11.8.0 (renovate[bot])

• chore: update github/codeql-action action to v4.37.4 (renovate[bot])

• chore: update dependency node to v22.23.2 (renovate[bot])

• chore: update github/codeql-action action to v4.37.3 (renovate[bot])

• chore: update github/codeql-action action to v4.37.2 (renovate[bot])

• chore: update actions/checkout action to v7.0.1 (renovate[bot])

• chore: update github/codeql-action action to v4.37.1 (renovate[bot])

... (truncated)

Commits

• 190fb21 8.0.3
• 9892cf1 chore: lock file maintenance
• 5f535e9 chore: update dependency mocha to ^12.0.1
• c1d53e8 chore: update github/codeql-action action to v4.38.0
• bf53856 chore: lock file maintenance
• 8cc551e chore: update dependency mocha to v12
• 4d71f06 chore: update dependency @​eslint/eslintrc to ^3.3.7
• bb557fd chore: lock file maintenance
• c0c8166 chore: update github/codeql-action action to v4.37.9
• a4587db chore: lock file maintenance
• Additional commits viewable in compare view

Updates strong-globalize from 2.10.0 to 6.0.6

Commits

• 8848a7b chore: publish release
• b94d1ac chore: update dependencies
• 2ac920a chore: add github actions for CI
• 12f4c0e chore: publish release
• dde8c19 feat: use @​babel/parser & allow @​strong-globalize comments
• 02b14e6 chore: publish release
• 9021be1 feat: clean up dependencies
• 92d7665 chore: update dependencies
• 33c00d7 chore: upgrade to espree parser
• 48e4faf chore: update g11n-pipeline
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by dhmlau, a new releaser for strong-globalize since your current version.

Updates uuid from 3.4.0 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

• expect crypto to be global everywhere (requires node@20+) (#935)
• drop node@18 support (#934)

Features

• drop node@18 support (#934) (dc4ddb8)

Bug Fixes

• expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
• Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

• Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

• crypto is now expected to be globally defined (requires node@20+) (#935)
• drop node@18 support (#934)
• upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

Bug Fixes

• make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

... (truncated)

Commits

• 993ff7b chore(main): release 14.0.3 (#982)
• f7d19b9 chore: update workflow actions (#983)
• b44f159 fix: fix CITGM #1154 (#981)
• dd8c173 chore: update deps (#975)
• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin publint version in CI (#966)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates loopback-datasource-juggler from 2.59.3 to 7.0.4

Release notes

Sourced from loopback-datasource-juggler's releases.

3.0 GA

No release notes provided.

3.0.0 Release Candidate

This is the first Release Candidate release of the upcoming major version 3.0.

List of notable changes made between 2.x and 3.0:

Always use bluebird as promise library

In version 3.0, we always use bluebird as our promise library instead of global.Promise. We consider Bluebird API a part of LoopBack API from now on, you are welcome to use any Bluebird-specific methods in your applications.

If you are using LoopBack with a custom promise implementation provided via global.Promise, you will have to check all places where you are using non-standard promise API and update them to use Bluebird API instead.

See related code change for more details.

DAO.find provides ctx.data in "loaded" hook

When implementing "loaded" hook for DAO.find method, we have mistakenly implemented a version that sets ctx.instance instead of ctx.data. This defeats the purpose of the "loaded" hook, which is to allow hooks to modify the raw data provided by the datasource before it's used to build a model instance.

This has been fixed in 3.0 and the "loaded" hook now consistently provides ctx.data for all operations. If you have a "loaded" hook handler that checks if (ctx.instance) then you can remove this condition together with the branch that follows.

See related code change for more details.

DAO.create no longer returns the instance(s) created

While implementing support for promises in DAO.create, we found that this method returns the instance object synchronously. This is inconsistent with the usual convention of accessing the result via callback/promise and it may not work correctly in cases where some fields like the id property are generated by the database.

We have changed the API to be consistent with other DAO methods: when invoked with a callback argument, the method does not return anything. When invoked without any callback, a promise is returned.

... (truncated)

Changelog

Sourced from loopback-datasource-juggler's changelog.

2026-10-13, Version 7.0.4

• chore: lock file maintenance (renovate[bot])

• chore: update dependency uuid to ^14.0.3 (renovate[bot])

• chore: update actions/setup-node action to v7.1.0 (renovate[bot])

• chore: update dependency nanoid to ^3.3.20 (renovate[bot])

• chore: update dependency mocha to ^12.0.3 (renovate[bot])

• chore: update dependency node to v22.23.3 (renovate[bot])

• chore: update commitlint monorepo to ^21.2.3 (renovate[bot])

• chore: update dependency mocha to ^12.0.2 (renovate[bot])

• chore: update dependency loopback-connector to ^8.0.3 (renovate[bot])

2026-09-15, Version 7.0.3

• chore: lock file maintenance (renovate[bot])

• chore: update dependency mocha to ^12.0.1 (renovate[bot])

• chore: update dependency nanoid to ^3.3.19 (renovate[bot])

• chore: update dependency mocha to v12 (renovate[bot])

• chore: update dependency qs to ^6.16.0 (renovate[bot])

• chore: update dependency uuid to ^14.0.2 (renovate[bot])

• chore: update dependency loopback-connector to ^8.0.2 (renovate[bot])

2026-08-17, Version 7.0.2

• chore: lock file maintenance (renovate[bot])

• chore: update commitlint monorepo to ^21.2.2 (renovate[bot])

• chore: update dependency nanoid to ^3.3.18 (renovate[bot])

• chore: update dependency nanoid to ^3.3.17 (renovate[bot])

... (truncated)

Commits

• See full diff in compare view

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}