Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Config Migration Needed

• Select this checkbox to let Renovate create an automated Config Migration PR.

Deprecations / Replacements

Warning

The following dependencies are either deprecated or have replacements available.

Datasource	Package	Replacement PR?
npm	@types/config
npm	@types/glob
npm	@types/uuid

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• Update dependency jest-junit to v17
• Update dependency stylelint to v17
• Update dependency stylelint-config-standard-scss to v17
• Update dependency test-exclude to v8
• Update dependency totp-generator to v2
• Update dependency undici to v8
• Update dependency webpack-cli to v7
• Update dependency webpack-dev-middleware to v8
• Update ESLint (major) (@typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint)
• Update stefanzweifel/git-auto-commit-action action to v7
• Update TypeScript (major) (@types/chai, @types/config, @types/glob, @types/jest, @types/multer, @types/node, @types/supertest, @types/uuid, typescript)
• 🔐 Create all rate-limited PRs at once 🔐

PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• Update Helm chart updates (nodejs, servicebus, wa)

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• Update dependency uuid to v14 [SECURITY]
• Update All non-major updates (@babel/preset-env, ajv, axios, azuread, azurerm, chai, class-validator, codeceptjs, dotenv, govuk-frontend, hashicorp/terraform, html-webpack-plugin, i18next-fs-backend, i18next-http-middleware, mochawesome, nanoid, node, qs, reflect-metadata, sass, shelljs, ts-jest, ts-loader, undici, validator, webpack, webpack-dev-middleware, yarn)
• Update TypeScript (@types/express-session, @types/node)
• Update crs-k/stale-branches action to v9
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• Update dependency tar to v7 [SECURITY]
• Update dependency @playwright/test to v1.59.1
• Update Allure reporting to v3.7.1 (allure-codeceptjs, allure-js-commons, allure-playwright)
• Update actions/checkout action to v6
• Update actions/setup-node action to v6
• Update actions/stale action to v10
• Update dependency @hmcts/properties-volume to v1
• Update dependency @launchdarkly/node-server-sdk to v9
• Update dependency @ministryofjustice/frontend to v9
• Update dependency @pact-foundation/pact to v16
• Update dependency applicationinsights to v3
• Update dependency babel-loader to v10
• Update dependency chai to v6
• Update dependency config to v4
• Update dependency connect-redis to v9
• Update dependency cookie to v1
• Update dependency copy-webpack-plugin to v14
• Update dependency css-loader to v7
• Update dependency diff to v9
• Update dependency flat to v6
• Update dependency formidable to v3
• Update dependency glob to v13
• Update dependency govuk-frontend to v6
• Update dependency helmet to v8
• Update dependency i18next to v26
• Update dependency import-in-the-middle to v3
• Update dependency jquery to v4
• Update dependency jsdom to v29
• Update dependency jwt-decode to v4
• Update dependency mocha to v11
• Update dependency nanoid to v5
• Update dependency nock to v14
• Update dependency node-fetch to v3
• Update dependency nodemon to v3
• Update dependency pa11y to v9
• Update dependency sass-loader to v16
• Update dependency style-loader to v4
• Update dependency supertest-session to v5
• Update dependency tough-cookie to v6
• Update dependency webdriverio to v9
• Update jest monorepo to v30 (major) (babel-jest, jest, jest-environment-jsdom)

Detected Dependencies

docker-compose (1)

docker-compose.yml

dockerfile (1)

Dockerfile (1)

• hmctsprod.azurecr.io/base/node 24-alpine

github-actions (5)

.github/workflows/ci.yml (3)

• actions/checkout v4 → [Updates: v6]
• actions/setup-node v4 → [Updates: v6]
• node 24

.github/workflows/stale-branches.yml (1)

• crs-k/stale-branches v2.0.21 → [Updates: v9.0.1]

.github/workflows/stale.yml (1)

• actions/stale v8 → [Updates: v10]

.github/workflows/update-readme-e2e-tables.yml (4)

• actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5 → [Updates: v6]
• actions/setup-node v4@49933ea5288caeca8642d1e84afbd3f7d6820020 → [Updates: v6]
• stefanzweifel/git-auto-commit-action v5@b863ae1933cb653a53c021fe36dbb774e1fb9403 → [Updates: v7]
• node 24

.github/workflows/update-readme-ftGroup-tables.yml (4)

• actions/checkout v4@34e114876b0b11c390a56381ad16ebd13914f8d5 → [Updates: v6]
• actions/setup-node v4@49933ea5288caeca8642d1e84afbd3f7d6820020 → [Updates: v6]
• stefanzweifel/git-auto-commit-action v5@b863ae1933cb653a53c021fe36dbb774e1fb9403 → [Updates: v7]
• node 24

helm-values (1)

charts/civil-citizen-ui/values.yaml

helmv3 (1)

charts/civil-citizen-ui/Chart.yaml (4)

• nodejs 3.2.0 → [Updates: 3.2.1]
• servicebus 1.1.0 → [Updates: 1.2.2]
• wa 1.0.6 → [Updates: 1.1.0]
• servicebus 1.2.2-beta

npm (1)

package.json (164)

• @dr.pogodin/csurf ^1.16.8
• @hmcts/cookie-manager ^1.0.0
• @hmcts/info-provider ^1.2.3
• @hmcts/nodejs-healthcheck ^1.8.6
• @hmcts/nodejs-logging ^4.0.4
• @hmcts/properties-volume ^0.0.14 → [Updates: ^1.0.0]
• @launchdarkly/node-server-sdk ^8.0.0 → [Updates: ^9.0.0]
• @ministryofjustice/frontend ^1.6.3 → [Updates: ^9.0.0]
• @types/config ^3.3.5 → [Updates: ^4.0.0]
• @types/cookie-parser ^1.4.3
• @types/csurf ^1.9.36
• @types/es6-promisify ^6.0.1
• @types/express 5.0.6
• @types/express-session ^1.17.5 → [Updates: ^1.17.5]
• @types/glob ^8.0.0 → [Updates: ^9.0.0]
• @types/lodash ^4.14.191
• @types/luxon ^3.2.0
• @types/multer ^1.4.7 → [Updates: ^2.0.0]
• @types/node ^22.0.0 → [Updates: ^22.0.0, ^24.0.0]
• @types/nunjucks ^3.2.1
• @types/require-directory ^2.1.1
• @types/serve-favicon ^2.5.1
• @types/uuid ^10.0.0 → [Updates: ^11.0.0]
• applicationinsights ^2.9.5 → [Updates: ^3.0.0]
• axios ^1.15.0 → [Updates: ^1.15.0]
• class-transformer ^0.5.1
• class-validator ^0.14.0 → [Updates: ^0.15.0]
• config ^3.3.12 → [Updates: ^4.0.0]
• connect-redis ^7.1.0 → [Updates: ^9.0.0]
• cookie-parser ^1.4.7
• crypto-js ^4.2.0
• dayjs ^1.11.7
• dotenv ^17.3.1 → [Updates: ^17.3.1]
• express 5.2.1
• express-session ^1.17.3
• follow-redirects ^1.16.0
• glob ^12.0.0 → [Updates: ^13.0.0]
• govuk-frontend 5.3.1 → [Updates: 5.14.0, 6.1.0]
• helmet ^7.0.0 → [Updates: ^8.0.0]
• i18next ^22.4.6 → [Updates: ^26.0.0]
• i18next-fs-backend ^2.6.4 → [Updates: ^2.6.4]
• i18next-http-middleware ^3.9.3 → [Updates: ^3.9.3]
• ioredis ^5.3.2
• ioredis-mock ^8.2.6
• jquery ^3.7.1 → [Updates: ^4.0.0]
• js-yaml ^4.1.1
• jsdom ^28.0.0 → [Updates: ^29.0.0]
• jwt-decode ^3.1.2 → [Updates: ^4.0.0]
• lodash ^4.18.1
• luxon ^3.2.1
• minimatch ^10.2.3
• multer ^2.1.1
• nunjucks ^3.2.4
• otplib ^13.0.0
• reflect-metadata ^0.1.13 → [Updates: ^0.2.0]
• require-directory ^2.1.1
• serve-favicon ^2.5.0
• stylelint ^16.9.0 → [Updates: ^17.0.0]
• stylelint-config-standard-scss ^13.1.0 → [Updates: ^17.0.0]
• ts-node ^10.9.1
• tsconfig-paths ^4.1.1
• typescript 5.9.3 → [Updates: 6.0.3]
• uuid ^9.0.0 → [Updates: ^14.0.0]
• validator 13.15.26 → [Updates: 13.15.35]
• @babel/core ^7.26.0
• @babel/eslint-parser ^7.26.5
• @babel/preset-env ^7.26.0 → [Updates: ^7.26.0]
• @pact-foundation/pact ^15.0.1 → [Updates: ^16.0.0]
• @pact-foundation/pact-node ^10.18.0
• @playwright/test ^1.47.2 → [Updates: ^1.47.2]
• @types/chai ^4 → [Updates: ^5.0.0]
• @types/git-rev-sync ^2.0.2
• @types/jest ^29.5.14 → [Updates: ^30.0.0]
• @types/js-yaml ^4
• @types/supertest ^2.0.12 → [Updates: ^7.0.0]
• @typescript-eslint/eslint-plugin ^5.50.0 → [Updates: ^8.0.0]
• @typescript-eslint/parser ^5.50.0 → [Updates: ^8.0.0]
• allure-codeceptjs ^3.4.2 → [Updates: ^3.4.2]
• allure-commandline ^2.29.0
• allure-js-commons ^3.4.2 → [Updates: ^3.4.2]
• allure-playwright ^3.6.0 → [Updates: ^3.6.0]
• babel-jest ^29.7.0 → [Updates: ^30.0.0]
• babel-loader ^9.1.0 → [Updates: ^10.0.0]
• chai 4.3.6 → [Updates: 4.5.0, 6.2.2]
• codeceptjs 3.4.1 → [Updates: 3.7.9]
• copy-webpack-plugin ^11.0.0 → [Updates: ^14.0.0]
• css-loader ^6.7.2 → [Updates: ^7.0.0]
• debug ^4.3.4
• deep-equal-in-any-order ^2.0.2
• eslint ^8.57.1 → [Updates: ^10.0.0]
• eslint-plugin-codeceptjs ^1.3.0
• git-rev-sync ^3.0.2
• html-webpack-plugin ^5.5.0 → [Updates: ^5.5.0]
• html_codesniffer ^2.5.1
• jest ^29.7.0 → [Updates: ^30.0.0]
• jest-environment-jsdom ^29.7.0 → [Updates: ^30.0.0]
• jest-junit ^15.0.0 → [Updates: ^17.0.0]
• jest-launchdarkly-mock ^2.0.3
• mini-css-extract-plugin ^2.7.2
• mocha ^10.2.0 → [Updates: ^11.0.0]
• mocha-junit-reporter ^2.2.1
• mocha-multi 1.1.7
• mochawesome 7.1.3 → [Updates: 7.1.4]
• nock ^13.2.9 → [Updates: ^14.0.0]
• node-cache ^5.1.2
• nodemon ^2.0.22 → [Updates: ^3.0.0]
• pa11y ^8.0.0 → [Updates: ^9.0.0]
• proper-lockfile ^4.1.2
• sass ^1.57.1 → [Updates: ^1.57.1]
• sass-loader ^13.2.0 → [Updates: ^16.0.0]
• sonar-scanner ^3.1.0
• style-loader ^3.3.1 → [Updates: ^4.0.0]
• supertest ^7.1.4
• supertest-session ^4.1.0 → [Updates: ^5.0.0]
• totp-generator ^0.0.14 → [Updates: ^2.0.0]
• ts-jest ^29.3.2 → [Updates: ^29.3.2]
• ts-loader ^9.4.2 → [Updates: ^9.4.2]
• webdriverio ^8.3.2 → [Updates: ^9.0.0]
• webpack ^5.102.1 → [Updates: ^5.102.1]
• webpack-cli ^5.1.4 → [Updates: ^7.0.0]
• webpack-dev-middleware 7.1.0 → [Updates: 7.4.5, 8.0.3]
• webpack-node-externals ^3.0.0
• wiremock-standalone ^3.2.1
• node >=20.0.0
• flatted 3.4.2
• undici 7.24.0 → [Updates: 7.25.0, 8.2.0]
• ajv ^8.18.0 → [Updates: ^8.18.0]
• @tootallnate/once ^3.0.1
• test-exclude ^7.0.1 → [Updates: ^8.0.0]
• csurf ^1.16.8
• otplib ^13.0.0
• glob ^12.0.0 → [Updates: ^13.0.0]
• @babel/runtime ^7.26.10
• brace-expansion ^5.0.2
• cookie ^0.7.2 → [Updates: ^1.0.0]
• node-fetch ^2.6.7 → [Updates: ^3.0.0]
• shelljs ^0.8.5 → [Updates: ^0.10.0]
• glob-parent ^6.0.1
• qs ^6.14.2 → [Updates: ^6.14.2]
• flat ^5.0.1 → [Updates: ^6.0.0]
• follow-redirects ^1.16.0
• debug ^4.3.4
• semver ^7.5.2
• minimist ^1.2.8
• tough-cookie ^4.1.3 → [Updates: ^6.0.0]
• ip >=2.0.1
• tar 6.2.1 → [Updates: 7.5.11]
• braces ^3.0.3
• ws ^8.17.1
• diff ^8.0.3 → [Updates: ^9.0.0]
• axios ^1.15.0 → [Updates: ^1.15.0]
• validator >=13.15.22 → [Updates: >=13.15.22]
• form-data ^4.0.4
• import-in-the-middle ^1.14.4 → [Updates: ^3.0.0]
• tmp ^0.2.4
• nanoid ^3.3.8 → [Updates: ^3.3.8, ^5.0.0]
• @babel/traverse ^7.26.5
• cross-spawn 7.0.6
• express 5.2.1
• formidable ^2.1.3 → [Updates: ^3.0.0]
• jsdom ^28.0.0 → [Updates: ^29.0.0]
• js-yaml 4.1.1
• lodash ^4.18.1
• yarn 4.10.3 → [Updates: 4.14.1]

nvm (1)

.nvmrc (1)

• node v24.13.1 → [Updates: 24.15.0]

renovate-config (1)

.github/renovate.json

terraform (4)

infrastructure/_state.tf (3)

• azuread 3.1.0 → [Updates: 3.8.0]
• azurerm ~> 4.16.0 → [Updates: ~> 4.71.0]
• hashicorp/terraform >= 0.15

infrastructure/app-insights.tf (1)

• github.com/hmcts/terraform-module-application-insights 4.x

infrastructure/key-vault.tf

infrastructure/redis.tf

terraform-version (1)

infrastructure/.terraform-version (1)

• hashicorp/terraform 1.10.5 → [Updates: 1.15.1]

---

• Check this box to trigger a request for Renovate to run again on this repository