Skip to content

chore(deps-dev): bump the dependencies group across 1 directory with 9 updates - #197

Merged
mroderick merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a490f80e95
Sep 2, 2026
Merged

chore(deps-dev): bump the dependencies group across 1 directory with 9 updates#197
mroderick merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a490f80e95

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 9 updates in the / directory:

Package From To
@hono/node-server 2.0.12 2.1.1
eslint 10.8.0 10.9.1
fastify 5.11.0 5.12.1
globals 17.9.0 17.11.0
hono 4.12.34 4.13.5
mysql2 3.23.2 3.24.2
oxc-minify 0.142.0 0.147.0
pg 8.22.0 8.23.0
semantic-release 25.0.8 25.0.9

Updates @hono/node-server from 2.0.12 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

Commits

Updates eslint from 10.8.0 to 10.9.1

Release notes

Sourced from eslint's releases.

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

  • 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
  • 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
  • dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
  • f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
  • 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)

... (truncated)

Commits

Updates fastify from 5.11.0 to 5.12.1

Release notes

Sourced from fastify's releases.

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

... (truncated)

Commits

Updates globals from 17.9.0 to 17.11.0

Release notes

Sourced from globals's releases.

v17.11.0

  • Add react-native globals (#337) 61eafbf

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

  • Add GM_cookie to Greasemonkey globals (#349) f468407

sindresorhus/globals@v17.9.0...v17.10.0

Commits

Updates hono from 4.12.34 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc


Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
  • fix(client): skip undefined header and cookie values in honojs/hono#5244
  • fix(client): skip an undefined entry inside a query array in honojs/hono#5272
  • fix(client): skip an undefined entry inside a form array in honojs/hono#5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
  • fix(client): omit empty query delimiter in honojs/hono#5283
  • fix(request): drop stale content length for cloned FormData in honojs/hono#5282
  • fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
  • fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
  • fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits
  • 06880c4 4.13.5
  • 531e9c5 Merge commit from fork
  • 3a67f7f Merge commit from fork
  • 9c28d72 Merge commit from fork
  • 017000d 4.13.4
  • 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
  • 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
  • c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
  • 612b59c fix(request): drop stale content length for cloned FormData (#5282)
  • 73794bd fix(client): omit empty query delimiter (#5283)
  • Additional commits viewable in compare view

Updates mysql2 from 3.23.2 to 3.24.2

Release notes

Sourced from mysql2's releases.

v3.24.2

3.24.2 (2026-08-24)

Bug Fixes

  • correct length-coded number size for the 3-byte range (#4500) (de56272)
  • promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

v3.24.1

3.24.1 (2026-08-24)

Performance Improvements

  • single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

v3.24.0

3.24.0 (2026-08-23)

Features

  • typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

  • zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

  • remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
  • serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)

v3.23.4

3.23.4 (2026-08-19)

Bug Fixes

  • keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
  • typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

v3.23.3

3.23.3 (2026-08-10)

Bug Fixes

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.24.2 (2026-08-24)

Bug Fixes

  • correct length-coded number size for the 3-byte range (#4500) (de56272)
  • promise: honour trace: false on every promise-API method (#4502) (1dcd8ef), closes #4501

3.24.1 (2026-08-24)

Performance Improvements

  • single-pass utf8 string encoding for outgoing packets (#4495) (183e947)

3.24.0 (2026-08-23)

Features

  • typed parameters, and adopt integer types the server reports (#4488) (8ec20f1)

Bug Fixes

  • zero dates come back as "undefined 00:00:00" with dateStrings (#4491) (5bf7bda)

Performance Improvements

  • remove per-query and per-row allocation hotspots (#4486) (c86fe5a)
  • serialize COM_STMT_EXECUTE in a single exact-size pass (#4494) (f3a60bc)

3.23.4 (2026-08-19)

Bug Fixes

  • keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
  • typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

3.23.3 (2026-08-10)

Bug Fixes

  • honor query-level namedPlaceholders as false (#4460) (20f732b)
  • keep connectTimeout active until the handshake completes (#4458) (508a731)
  • pool: give each pooled connection its own config copy (#4473) (361d232)
  • pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)

... (truncated)

Commits
  • 649e129 chore(master): release 3.24.2 (#4504)
  • 87579e1 test: cover length-coded parameter sizes at the 0xFD boundary (#4503)
  • 1dcd8ef fix(promise): honour trace: false on every promise-API method (#4502)
  • de56272 fix: correct length-coded number size for the 3-byte range (#4500)
  • ca10232 chore(master): release 3.24.1 (#4496)
  • 183e947 perf: single-pass utf8 string encoding for outgoing packets (#4495)
  • fabc3bc chore(master): release 3.24.0 (#4492)
  • f3a60bc perf: serialize COM_STMT_EXECUTE in a single exact-size pass (#4494)
  • 493f9ec ci: pin EXPLAIN to FORMAT=TRADITIONAL for MySQL 9.5+ (#4493)
  • c86fe5a perf: remove per-query and per-row allocation hotspots (#4486)
  • Additional commits viewable in compare view

Updates oxc-minify from 0.142.0 to 0.147.0

Release notes

Sourced from oxc-minify's releases.

oxc crates_v0.147.0

🚀 Features

  • b6e9e5e minifier: Fold switch stmt whose parent is not block stmt (#25403) (Armano)

🐛 Bug Fixes

  • 8db1053 codegen: Require sourcemap for example (#26047) (camc314)
  • 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
  • 6f0c7cf minifier: Avoid merging if to for in sloppy mode when containing function declaration (#25638) (sapphi-red)
  • 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
  • 6c5ad1b codegen: Only add mapping names for PrivateIdentifiers which have changed (#25958) (overlookmotel)
  • 2dad1e0 parser: Track irregular line terminators in trivia (#25947) (camc314)
  • 58ba651 minifier: Avoid merging if to for when the body contains a function declaration (#25637) (sapphi-red)
  • a185ac3 codegen: Print # before private identifier in TS signature key (#25938) (overlookmotel)
  • af82a07 minifier: Keep unary + when the other operand has side effects (#25645) (Kotaro Chikuba)

⚡ Performance

  • 20711f4 packages/codegen: Remove node param from write and markMap functions in sourcemap builds (#25989) (overlookmotel)
  • 29a7749 packages/codegen: Pass start and end to write and mark functions (#25986) (overlookmotel)
  • 8ae741b packages/codegen: Replace write calls with writeIdent (#25984) (overlookmotel)
  • a78ed30 packages/codegen: Remove last param from writeWithMapNamed (#25983) (overlookmotel)
  • 53f6270 packages/codegen: Eagerly initialize mapNames (#25979) (overlookmotel)
  • 5b43c60 packages/codegen: Split recording mappings into multiple functions (#25978) (overlookmotel)
  • cc947b5 packages/codegen: Reduce property lookups (#25977) (overlookmotel)
  • c22a9cc packages/codegen: Combine condition checks (#25976) (overlookmotel)
  • 215a6a5 packages/codegen: Add functions for writing/marking unnamed mappings (#25975) (overlookmotel)
  • fe444cc codegen: Avoid allocations for single comment anchors (#25598) (camc314)
  • a0aee81 minifier: Do not rebuild expression when substituting void to null (#25964) (Armano)
  • 1004439 packages/codegen: Merge mark and write calls in printImportAttributes (#25972) (overlookmotel)
  • 94c8a34 packages/codegen: Remove node param from printString and printNonNegativeFloat (#25971) (overlookmotel)
  • 7e2b4b3 packages/codegen: printNonNegativeFloat write mapping directly (#25968) (overlookmotel)
  • f09c8ab minifier: Avoid creation of unnecessary conditional expressions (#25931) (Armano)
  • 53ff080 packages/codegen: Remove lastWasPostfixClose (#25888) (overlookmotel)

📚 Documentation

  • 07de646 packages/codegen: Fix JSDoc comments on write* methods (#25966) (overlookmotel)
  • 3b09c04 packages/codegen: Clarify comment (#25959) (overlookmotel)

oxc crates_v0.146.0

🚀 Features

  • 83cb516 minifier: Improve negation of expressions in boolean context (#25755) (Armano)

🐛 Bug Fixes

  • 82a790d codegen: Narrow printSync input type (#25871) (camc314)
  • 134fb22 isolated-declarations: Preserve unresolved parameter types (#25909) (Dunqing)

... (truncated)

Commits

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Commits

Updates semantic-release from 25.0.8 to 25.0.9

Release notes

Sourced from semantic-release's releases.

v25.0.9

25.0.9 (2026-08-05)

Bug Fixes

  • do not expose the authenticated repository URL in EGITNOPERMISSION errors (#4283) (8d905a5)
Commits
  • 8d905a5 fix: do not expose the authenticated repository URL in EGITNOPERMISSION error...
  • e176eb7 ci(action): update github/codeql-action action to v4.37.6 (#4282)
  • d27db1b chore(deps): update dependency js-yaml to v4.3.1 (#4279)
  • 55beeac ci(action): update github/codeql-action action to v4.37.5 (#4277)
  • 7bf348d chore(deps): update dependency nock to v14.0.17 (#4275)
  • 2ec3ba2 chore(deps): update dependency mockserver-client to v7.5.0 (#4274)
  • d3b7724 chore(deps): update npm to v12.0.2 (#4273)
  • 514dc5f chore(deps): update dependency npm-run-all2 to v9.0.3 (#4271)
  • f25b716 ci(action): update github/codeql-action action to v4.37.4 (#4270)
  • 1114416 chore: remove 'next version' badge from README (#4265)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 24, 2026

Copy link
Copy Markdown

Deploying idempot-js with  Cloudflare Pages  Cloudflare Pages

Latest commit: 7e95e75
Status: ✅  Deploy successful!
Preview URL: https://249a0888.idempot-js.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-depe-eq2a.idempot-js.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026
…9 updates

Bumps the dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.12` | `2.1.1` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.9.1` |
| [fastify](https://github.com/fastify/fastify) | `5.11.0` | `5.12.1` |
| [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` |
| [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.5` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.2` | `3.24.2` |
| [oxc-minify](https://github.com/oxc-project/oxc/tree/HEAD/napi/minify) | `0.142.0` | `0.147.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [semantic-release](https://github.com/semantic-release/semantic-release) | `25.0.8` | `25.0.9` |



Updates `@hono/node-server` from 2.0.12 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.12...v2.1.1)

Updates `eslint` from 10.8.0 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.9.1)

Updates `fastify` from 5.11.0 to 5.12.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.11.0...v5.12.1)

Updates `globals` from 17.9.0 to 17.11.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.9.0...v17.11.0)

Updates `hono` from 4.12.34 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.34...v4.13.5)

Updates `mysql2` from 3.23.2 to 3.24.2
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.23.2...v3.24.2)

Updates `oxc-minify` from 0.142.0 to 0.147.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/napi/minify/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/crates_v0.147.0/napi/minify)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `semantic-release` from 25.0.8 to 25.0.9
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](semantic-release/semantic-release@v25.0.8...v25.0.9)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: fastify
  dependency-version: 5.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: globals
  dependency-version: 17.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: hono
  dependency-version: 4.13.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mysql2
  dependency-version: 3.23.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: oxc-minify
  dependency-version: 0.144.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: semantic-release
  dependency-version: 25.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-a490f80e95 branch from 20532d2 to 7e95e75 Compare September 2, 2026 06:21
@mroderick

Copy link
Copy Markdown
Contributor

Dependency Upgrade Review: dependencies group (9 updates)

PR Scope

Dependency-onlypackage.json + pnpm-lock.yaml. All 9 packages are devDependencies; no runtime impact on library consumers.

Package From To Assessment
@hono/node-server 2.0.12 2.1.1 Minor; used by test adapters
eslint 10.8.0 10.8.1 Patch; lint tooling
fastify 5.11.0 5.12.0 Minor; exercised by test suite
globals 17.9.0 17.11.0 Minor; lint config
hono 4.12.34 4.13.2 Minor; exercised by test suite
mysql2 3.23.2 3.23.3 Patch; exercised by test suite
oxc-minify 0.142.0 0.144.0 Minor; build tooling
pg 8.22.0 8.23.0 Minor; exercised by test suite
semantic-release 25.0.8 25.0.9 Patch; release tooling

Verification

Confidence Rating

High — devDependency-only, no breaking changes to used APIs, full suite verified locally.

@mroderick mroderick left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. See analysis comment above.

@mroderick
mroderick merged commit 53deeb5 into main Sep 2, 2026
12 of 13 checks passed
@mroderick
mroderick deleted the dependabot/npm_and_yarn/dependencies-a490f80e95 branch September 2, 2026 06:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant