Combined Dependabot PRs (#395)

github-actions[bot] · dependabot[bot] · masl2 · web-flow · commit 8d96779a7001 · 2026-02-10T12:09:10.000Z
* Bump peter-evans/create-pull-request from 7.0.8 to 8.1.0 Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 7.0.8 to 8.1.0. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@v7.0.8...v8.1.0) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Bump asdf-vm/actions from 4.0.0 to 4.0.1 Bumps [asdf-vm/actions](https://github.com/asdf-vm/actions) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/asdf-vm/actions/releases) - [Changelog](https://github.com/asdf-vm/actions/blob/master/CHANGELOG.md) - [Commits](asdf-vm/actions@1902764...b7bcd02) --- updated-dependencies: - dependency-name: asdf-vm/actions dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Bump github/codeql-action from 4.31.10 to 4.32.2 Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.10 to 4.32.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdefb33...45cbd0c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Bump @stylistic/eslint-plugin from 3.1.0 to 5.7.1 Bumps [@stylistic/eslint-plugin](https://github.com/eslint-stylistic/eslint-stylistic/tree/HEAD/packages/eslint-plugin) from 3.1.0 to 5.7.1. - [Release notes](https://github.com/eslint-stylistic/eslint-stylistic/releases) - [Changelog](https://github.com/eslint-stylistic/eslint-stylistic/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint-stylistic/eslint-stylistic/commits/v5.7.1/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@stylistic/eslint-plugin" dependency-version: 5.7.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Bump @types/node from 22.19.7 to 25.2.1 Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.19.7 to 25.2.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.2.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Bump @aws-sdk/client-lambda from 3.981.0 to 3.984.0 Bumps [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) from 3.981.0 to 3.984.0. - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.984.0/clients/client-lambda) --- updated-dependencies: - dependency-name: "@aws-sdk/client-lambda" dependency-version: 3.984.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * esbuild version * sdk versions * pino version * missed internal pino version * upload artifact v6 * event schema version bump * lock --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Mark Slowey <mark.slowey1@nhs.net>
diff --git a/.github/actions/build-libraries/action.yml b/.github/actions/build-libraries/action.yml
@@ -31,28 +31,28 @@ runs:
         make build VERSION="${{ inputs.version }}"
 
     - name: Upload abstractions artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "src/server/abstractions/bin/Release"
         name: libs-abstractions-${{ inputs.version }}
         include-hidden-files: true
 
     - name: Upload data artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "src/server/data/bin/Release"
         name: libs-data-${{ inputs.version }}
         include-hidden-files: true
 
     - name: Upload letter artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "src/server/letter/bin/Release"
         name: libs-letter-${{ inputs.version }}
         include-hidden-files: true
 
     - name: Upload host artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "src/server/host/bin/Release"
         name: libs-host-${{ inputs.version }}
@@ -75,7 +75,7 @@ runs:
         outputs: type=docker,dest=${{ runner.temp }}/myimage/myimage.tar
 
     - name: Upload artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: libs-host-docker-${{ inputs.version }}
         path: ${{ runner.temp }}/myimage
diff --git a/.github/actions/build-oas-spec/action.yml b/.github/actions/build-oas-spec/action.yml
@@ -68,7 +68,7 @@ runs:
         fi
 
     - name: Upload API OAS specification artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "build"
         name: api-oas-specification-${{ inputs.apimEnv }}${{ inputs.version != '' && format('-{0}', inputs.version) || '' }}
diff --git a/.github/actions/build-proxies/action.yml b/.github/actions/build-proxies/action.yml
@@ -96,7 +96,7 @@ runs:
         echo "APIM_ENV=$APIM_ENV" >> $GITHUB_ENV
 
     - name: Upload OAS Spec
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: ${{ env.APIM_ENV }}-build-output
         path: ./build
diff --git a/.github/actions/build-sdk/action.yml b/.github/actions/build-sdk/action.yml
@@ -56,31 +56,31 @@ runs:
         make build VERSION="${{ inputs.version }}"
 
     - name: Upload html artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "sdk/html"
         name: sdk-html-${{ inputs.version }}
 
     - name: Upload swagger artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "sdk/swagger"
         name: sdk-swagger-${{ inputs.version }}
 
     - name: Upload ts artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "sdk/typescript"
         name: sdk-ts-${{ inputs.version }}
 
     - name: Upload python artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "sdk/python"
         name: sdk-python-${{ inputs.version }}
 
     - name: Upload csharp artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "sdk/csharp"
         name: sdk-csharp-${{ inputs.version }}
diff --git a/.github/actions/build-server/action.yml b/.github/actions/build-server/action.yml
@@ -36,13 +36,13 @@ runs:
         make build VERSION="${{ inputs.version }}"
 
     - name: Upload csharp-server artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "server/csharp-server"
         name: server-csharp-${{ inputs.version }}
 
     - name: Upload csharp-server docker artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         path: "server/Dockerfile"
         name: server-csharp-docker-${{ inputs.version }}
diff --git a/.github/actions/create-lines-of-code-report/action.yaml b/.github/actions/create-lines-of-code-report/action.yaml
@@ -32,7 +32,7 @@ runs:
       run: zip lines-of-code-report.json.zip lines-of-code-report.json
     - name: "Upload CLOC report as an artefact"
       if: ${{ !env.ACT }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: lines-of-code-report.json.zip
         path: ./lines-of-code-report.json.zip
diff --git a/.github/actions/scan-dependencies/action.yaml b/.github/actions/scan-dependencies/action.yaml
@@ -32,7 +32,7 @@ runs:
       run: zip sbom-repository-report.json.zip sbom-repository-report.json
     - name: "Upload SBOM report as an artefact"
       if: ${{ !env.ACT }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: sbom-repository-report.json.zip
         path: ./sbom-repository-report.json.zip
@@ -47,7 +47,7 @@ runs:
       run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
     - name: "Upload vulnerabilities report as an artefact"
       if: ${{ !env.ACT }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: vulnerabilities-repository-report.json.zip
         path: ./vulnerabilities-repository-report.json.zip
diff --git a/.github/workflows/cicd-3-deploy.yaml b/.github/workflows/cicd-3-deploy.yaml
@@ -103,7 +103,7 @@ jobs:
         run: |
           gh release download ${{steps.get-asset-version.outputs.release_version}} -p jekyll-docs-*.tar --output artifact.tar
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v6
         with:
           name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}
           path: artifact.tar
diff --git a/.github/workflows/scheduled-repository-template-sync.yaml b/.github/workflows/scheduled-repository-template-sync.yaml
@@ -32,7 +32,7 @@ jobs:
 
     - name: Create Pull Request
       if: ${{ !env.ACT }}
-      uses: peter-evans/create-pull-request@v8.0.0
+      uses: peter-evans/create-pull-request@v8.1.0
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         commit-message: Drift from template
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: SARIF file
           path: results.sarif
@@ -68,6 +68,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
+        uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml
@@ -168,7 +168,7 @@ jobs:
       - name: "Checkout code"
         uses: actions/checkout@v4
       - name: "Setup ASDF"
-        uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
+        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
       - name: "Trivy IaC Scan"
         uses: ./.github/actions/trivy-iac
   trivy-package:
@@ -183,7 +183,7 @@ jobs:
       - name: "Checkout code"
         uses: actions/checkout@v4
       - name: "Setup ASDF"
-        uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
+        uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
       - name: "Trivy Package Scan"
         uses: ./.github/actions/trivy-package
   count-lines-of-code:
diff --git a/.github/workflows/stage-2-test.yaml b/.github/workflows/stage-2-test.yaml
@@ -105,14 +105,14 @@ jobs:
         run: |
           make test-unit
       - name: "Save the result of fast test suite"
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: unit-tests
           path: "**/.reports/unit"
           include-hidden-files: true
         if: always()
       - name: "Save the result of code coverage"
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: code-coverage-report
           path: ".reports/lcov.info"
diff --git a/Makefile b/Makefile
@@ -24,6 +24,7 @@ deploy: # Deploy the project artefact to the target environment @Pipeline
 
 clean:: # Clean-up project resources (main) @Operations
 	rm -f .version
+	find . -type d -name 'node_modules' -prune -exec rm -rf {} +
 	(cd sdk && make clean)
 # Take out for now - might add again in the future
 # (cd server && make clean)
diff --git a/internal/datastore/package.json b/internal/datastore/package.json
@@ -1,14 +1,14 @@
 {
   "dependencies": {
-    "@aws-sdk/client-dynamodb": "^3.981.0",
-    "@aws-sdk/lib-dynamodb": "^3.981.0",
+    "@aws-sdk/client-dynamodb": "^3.984.0",
+    "@aws-sdk/lib-dynamodb": "^3.984.0",
     "@internal/helpers": "*",
-    "pino": "^9.7.0",
+    "pino": "^10.3.0",
     "zod": "^4.1.11",
     "zod-mermaid": "^1.0.9"
   },
   "devDependencies": {
-    "@stylistic/eslint-plugin": "^3.1.0",
+    "@stylistic/eslint-plugin": "^5.8.0",
     "@tsconfig/node22": "^22.0.2",
     "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.46.2",
diff --git a/internal/events/package.json b/internal/events/package.json
@@ -6,7 +6,7 @@
   "description": "Schemas for NHS Notify Supplier API events",
   "devDependencies": {
     "@stoplight/spectral-cli": "^6.15.0",
-    "@stylistic/eslint-plugin": "^3.1.0",
+    "@stylistic/eslint-plugin": "^5.8.0",
     "@tsconfig/node22": "^22.0.2",
     "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.27.0",
@@ -50,5 +50,5 @@
     "typecheck": "tsc --noEmit"
   },
   "types": "dist/index.d.ts",
-  "version": "1.0.10"
+  "version": "1.0.11"
 }
diff --git a/internal/helpers/package.json b/internal/helpers/package.json
@@ -4,7 +4,7 @@
   },
   "description": "Common helper utilities for NHS Notify Supplier API",
   "devDependencies": {
-    "@stylistic/eslint-plugin": "^3.1.0",
+    "@stylistic/eslint-plugin": "^5.8.0",
     "@tsconfig/node22": "^22.0.2",
     "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.27.0",
diff --git a/lambdas/api-handler/package.json b/lambdas/api-handler/package.json
@@ -1,6 +1,6 @@
 {
   "dependencies": {
-    "@aws-sdk/client-dynamodb": "^3.981.0",
+    "@aws-sdk/client-dynamodb": "^3.984.0",
     "@aws-sdk/client-s3": "^3.925.0",
     "@aws-sdk/client-sqs": "^3.925.0",
     "@aws-sdk/lib-dynamodb": "^3.925.0",
@@ -10,7 +10,7 @@
     "aws-embedded-metrics": "^4.2.1",
     "aws-lambda": "^1.0.6",
     "esbuild": "0.27.2",
-    "pino": "^9.7.0",
+    "pino": "^10.3.0",
     "zod": "^4.1.11"
   },
   "devDependencies": {
diff --git a/lambdas/authorizer/package.json b/lambdas/authorizer/package.json
@@ -1,11 +1,11 @@
 {
   "dependencies": {
-    "@aws-sdk/client-dynamodb": "^3.981.0",
+    "@aws-sdk/client-dynamodb": "^3.984.0",
     "@aws-sdk/lib-dynamodb": "^3.858.0",
     "@internal/datastore": "*",
     "aws-lambda": "^1.0.6",
     "esbuild": "0.27.2",
-    "pino": "^9.7.0",
+    "pino": "^10.3.0",
     "zod": "^4.1.11"
   },
   "devDependencies": {
diff --git a/lambdas/letter-updates-transformer/package.json b/lambdas/letter-updates-transformer/package.json
@@ -8,7 +8,7 @@
     "aws-embedded-metrics": "^4.2.1",
     "aws-lambda": "^1.0.6",
     "esbuild": "0.27.2",
-    "pino": "^10.1.0",
+    "pino": "^10.3.0",
     "zod": "^4.1.13"
   },
   "devDependencies": {
diff --git a/lambdas/mi-updates-transformer/package.json b/lambdas/mi-updates-transformer/package.json
@@ -6,8 +6,8 @@
     "@nhsdigital/nhs-notify-event-schemas-supplier-api": "*",
     "aws-embedded-metrics": "^4.2.1",
     "aws-lambda": "^1.0.6",
-    "esbuild": "^0.24.2",
-    "pino": "^10.1.0",
+    "esbuild": "^0.27.3",
+    "pino": "^10.3.0",
     "zod": "^4.1.13"
   },
   "devDependencies": {
diff --git a/lambdas/upsert-letter/package.json b/lambdas/upsert-letter/package.json
@@ -1,6 +1,6 @@
 {
   "dependencies": {
-    "@aws-sdk/client-dynamodb": "^3.981.0",
+    "@aws-sdk/client-dynamodb": "^3.984.0",
     "@aws-sdk/lib-dynamodb": "^3.858.0",
     "@internal/datastore": "*",
     "@nhsdigital/nhs-notify-event-schemas-letter-rendering": "^2.0.1",
@@ -10,7 +10,7 @@
     "aws-embedded-metrics": "^4.2.1",
     "aws-lambda": "^1.0.6",
     "esbuild": "0.27.2",
-    "pino": "^9.7.0",
+    "pino": "^10.3.0",
     "zod": "^4.1.11"
   },
   "devDependencies": {
diff --git a/package-lock.json b/package-lock.json
diff --git a/scripts/utilities/letter-test-data/package.json b/scripts/utilities/letter-test-data/package.json
diff --git a/scripts/utilities/supplier-data/package.json b/scripts/utilities/supplier-data/package.json
diff --git a/tests/contracts/provider/package.json b/tests/contracts/provider/package.json
diff --git a/tests/package.json b/tests/package.json
