[dependabot]

Bumps the production-minor-patch group with 4 updates: discord.js, ws, @aws-sdk/client-s3 and next.

Updates discord.js from 14.27.0 to 14.28.1

Release notes

Sourced from discord.js's releases.

14.28.1

Bug Fixes

• BaseChannel: Scope resolved permissions to the interaction (#11680) (cfb23d2)

14.28.0

Features

• invites: Backport invite target users and role (#11590) (e779c1c)
• file types for discord.js (#11580) (cffb0b5)
• BaseChannel: Add permissions and appPermissions (#11577) (75a5eaa)

Changelog

Sourced from discord.js's changelog.

14.28.1 - (2026-11-03)

Bug Fixes

• BaseChannel: Scope resolved permissions to the interaction (#11680) (cfb23d2)

14.28.0 - (2026-10-30)

Features

• invites: Backport invite target users and role (#11590) (e779c1c)
• file types for discord.js (#11580) (cffb0b5)
• BaseChannel: Add permissions and appPermissions (#11577) (75a5eaa)

Commits

• e19a9bd chore(discord.js): release discord.js@14.28.1
• cfb23d2 fix(BaseChannel): scope resolved permissions to the interaction (#11680)
• 88ff1bd chore(discord.js): release discord.js@14.28.0
• e779c1c feat(invites): backport invite target users and role (#11590)
• cffb0b5 feat: file types for discord.js (#11580)
• 75a5eaa feat(BaseChannel): add permissions and appPermissions (#11577)
• a643305 build: upgrade discord-api-types
• See full diff in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

• The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

• http.websocketMask() and http.websocketUnmask() are now used instead of the bufferutil variants when available (2ab3d3e5).
• Sender.frame() no longer returns empty chunks (85319a72).

Commits

• c18a80a [dist] 8.22.1
• 2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
• c9efa88 [ci] Test on node 27
• aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
• b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
• 85319a7 [minor] Prevent Sender.frame() from returning empty chunks
• See full diff in compare view

Updates @aws-sdk/client-s3 from 3.1160.0 to 3.1163.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1163.0

3.1163.0(2026-11-05)

New Features

• clients: update client endpoints as of 2026-11-05 (57e9f143)
• client-bedrock-agentcore-control: Adds support for OAuth2 Authorization Server Metadata (RFC 8414) discovery URLs in custom JWT authorizer and OAuth2 credential provider configurations. (950c852a)
• client-sagemaker: Fixed the ImageDeleted and ImageVersionDeleted waiters to succeed on the ResourceNotFound error returned by DescribeImage and DescribeImageVersion (6cc77117)
• client-wafv2: AWS WAF customers who monetize AI traffic on Web ACLs can now configure payments through connected accounts (Stripe). (9e7dd06f)
• client-appintegrations: This release adds a LastModifiedRegion field to GetApplication and ListApplications so customers can see which Region an application was last modified in. (878faafe)
• client-quicksight: Amazon QuickSight adds APIs to view account service role settings and switch to or replace a customer-managed IAM role. (98371e60)
• client-lambda-microvms: AWS Lambda MicroVMs now support the x86-64 CPU architecture, which you can select in addition to ARM64 (Graviton) when launching a MicroVM. (928e07cc)
• client-bedrock-agent-runtime: Amazon Bedrock Managed Knowledge Base now supports an optional mediaId parameter in GetDocumentContent that you can use to retrieve images embedded in source documents. (0740a76b)
• client-securityagent: Adds support for IAM Identity Center groups as Agent Space members. CreateMembership, DeleteMembership, and ListMemberships now accept the GROUP member type. ListMemberships can filter by USER, GROUP, or ALL, and returns group display name and description. (a8e028e7)
• client-cloudwatch-logs: Adds account-level retention policies with dry run preview and the Essentials log group class to Amazon CloudWatch Logs (da8a2a29)
• client-datasync: Adds support for federated identity on Azure Blob Storage and object storage locations, enabling DataSync to authenticate to Azure and Google Cloud Storage using Workload Identity Federation (WIF) over OpenID Connect (OIDC) instead of stored long-lived credentials. (9a8be11b)
• client-route-53-domains: Route 53 Domains now supports restoring domains. This release adds the RestoreDomain API to self-serve domain restoration. (ce3d5a2c)
• client-glue: AWS Glue Spark ETL jobs can now auto-upgrade to the latest version. Set GlueVersion to Auto, then track progress with the AutoVersionStatus field in GetJob. Use StartJobUpgradeAnalysis to approve or decline an upgrade, GetJobUpgradeAnalysis to view details, and StopJobUpgradeAnalysis to stop it. (b04dd0b0)
• client-account-access-runtime: Adds SDK support for Account Access user portal operations, enabling users to list out and get credentials for role assignments configured in AWS IAM Account Access Manager. (0372bae5)
• client-qconnect: Adds support for real-time agent assistance and self-service with Amazon Connect Global Resiliency, including cross-Region replication of supported AI agent resources and configurations. (d3305fbd)
• client-agent-registry-control: Adds support for OAuth2 Authorization Server Metadata (RFC 8414) discovery URLs in custom JWT authorizer. (0b9b8f4d)

Bug Fixes

• snapshot-testing: add camelCase checksumAlgorithm to customFields (#8403) (0bde7a79)

---

For list of updated packages, view updated-packages.md in assets-3.1163.0.zip

v3.1162.0

3.1162.0(2026-11-04)

Documentation Changes

• fix typos in credential-providers and xhr-http-handler READMEs (#8400) (13b91575)

New Features

• clients: update client endpoints as of 2026-11-04 (7b30cd35)
• client-lookoutequipment: Amazon Lookout for Equipment reached end of support on October 7, 2026. All Lookout for Equipment APIs are now marked as deprecated. (9a4a6882)
• client-rolesanywhere: Adds the crlDpRevocationEnabled field to enable automatic revocation checking using CRL distribution points in X.509 certificates. (5c3071ce)
• client-marketplace-discovery: GetListing and SearchListings APIs now return G2 and PeerSpot review sources in review summaries. (cb49279d)
• client-ec2: Add the Unsupported SupportabilityScore to GetCapacityManagerSupportabilityScores. (e8a84dc8)
• client-elastic-beanstalk: Adds DefaultAmiList to DescribePlatformVersion to return the default AMI for each processor architecture that a platform version supports. (a7dfafce)
• client-iotsitewise: Adds support for an optional jobName on CreateDatasetExportJob. The jobName is returned by DescribeDatasetExportJob and ListDatasetExportJobs, making dataset export jobs easier to identify and track. If jobName is omitted, a default name is generated automatically. (33a8bf05)
• client-connect-contact-lens: Rules TBAC GA (Contact Lens V1) - Adds an optional ListFilter (CategoriesAttributeFilter with OrConditions, AndCondition and TagCondition) to ListRealtimeContactAnalysisSegments. This filters matched categories by rule tags. It also adds an optional RuleId to CategoryDetails in the response. (c09702f1)
• client-taxsettings: Adds Colombia additional information (responsibility codes, taxpayer type code, and RUT issue date) and a rejection reason (statusReason) to tax registration responses, and adds Argentina and Uruguay tax registration types. (582f0ce2)
• client-s3tables: Amazon S3 Tables now supports migrating AWS Glue Data Catalog tables into S3 Table buckets. This release adds the StartTableMigration, SyncTableMigration, UpdateTableMigration, CompleteTableMigration, GetTableMigration, and ListTableMigrations APIs. (235b2d68)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1163.0 (2026-11-05)

Note: Version bump only for package @​aws-sdk/client-s3

3.1162.0 (2026-11-04)

Bug Fixes

• codegen: drop redundant alias from node:stream Readable type import (#8402) (4e5ce5a)

3.1161.0 (2026-10-30)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

• 9163d15 Publish v3.1163.0
• 80cb789 Publish v3.1162.0
• 4e5ce5a fix(codegen): drop redundant alias from node:stream Readable type import (#8402)
• 258c144 Publish v3.1161.0
• f393101 chore(codegen): sync to new smithy handler changes (#8390)
• See full diff in compare view

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

Commits

• 4e5335a v16.4.5
• 809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
• 2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
• 6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
• 18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
• e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
• d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
• 80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
• b175f52 v16.4.4
• ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[graphify-labs]

Graphify reviews are paused for this workspace because nobody has used it in 7 days. A workspace owner can resume reviews from the Repositories page: https://app.graphify.com/msk-scripts/repositories