Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 2 updates#22

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-b667548b74
Open

chore(deps): bump the production-dependencies group across 1 directory with 2 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-b667548b74

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-dependencies group with 2 updates in the / directory: electron-updater and hono.

Updates electron-updater from 6.8.3 to 6.8.9

Release notes

Sourced from electron-updater's releases.

electron-updater@6.8.9

Patch Changes

198c10c 22a7532

  • builder-util-runtime@9.7.0

electron-updater@6.8.8

Patch Changes

59efef1

  • builder-util-runtime@9.6.3

electron-updater@6.8.7

Patch Changes

d6a5aee 4866737

  • builder-util-runtime@9.6.2

... (truncated)

Changelog

Sourced from electron-updater's changelog.

6.8.9

Patch Changes

198c10c 22a7532

  • builder-util-runtime@9.7.0

6.8.8

Patch Changes

59efef1

  • builder-util-runtime@9.6.3

6.8.7

Patch Changes

d6a5aee 4866737

... (truncated)

Commits
  • bed3a9c chore(deploy): Release v26.15.0 (electron-updater@6.8.9) (#9825)
  • 22a7532 fix: holistic field detection for \<text> (sha256 hash) redaction (#9834)
  • ffd11c7 chore(deploy): Release v26.13.0 (electron-updater@6.8.8) (#9793)
  • ac45083 fix(updater): ensure full changelog includes only release notes up to the lat...
  • d664ed0 chore: expand test coverage for updater and Windows build targets (#9794)
  • 2dc409f fix: harden the auto-update flow from relative paths and env var intercepts (...
  • 2c8c71a chore(deploy): Release v26.12.1 (electron-updater@6.8.7) (#9782)
  • 9120507 chore(deploy): Release v26.11.0 (electron-updater@6.8.6) (#9726)
  • d846315 chore(docs): docusaurus migration (#9744)
  • bea19a5 chore(deps): update dependency electron to v39 [security] (#9693)
  • Additional commits viewable in compare view

Updates hono from 4.12.18 to 4.12.26

Release notes

Sourced from hono's releases.

v4.12.26

What's Changed

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

What's Changed

... (truncated)

Commits
  • 27b7992 4.12.26
  • d29982c chore: replace arg and glob with Bun native APIs in build script
  • 16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
  • c574cf1 ci: publish to npm from CI with OIDC trusted publishing (#5028)
  • e50df01 fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (#5...
  • fce483e 4.12.25
  • 751ba41 Merge commit from fork
  • f0b094d Merge commit from fork
  • fa5f9bf Merge commit from fork
  • 3892a6c Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 6, 2026
@github-actions

github-actions Bot commented Jun 6, 2026 •
edited
Loading

Copy link
Copy Markdown

E2E coverage (strict mode)

Metric This PR main Δ
Live coverage 78.24% (2949/3769) 78.24% (2949/3769) ±0.00pp (+0)
Scaffold-only 93 — —
Manual-residue 727 — —
Passing TC-IDs this run 0 — —

Live coverage unchanged.
Definitions: live = inline tc() / tcRange() in non-fixme test() calls. Scaffold-only = test.fixme() placeholders. Manual-residue = explicitly excluded from automation (see e2e/web/manual-residue.ts).
Full report in the e2e-coverage-${{ run_id }} artifact.

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-b667548b74 branch from 254408d to 9971d09 Compare June 8, 2026 09:32
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-b667548b74 branch 2 times, most recently from 14ada89 to 7a49118 Compare June 20, 2026 09:26
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
9606d38 
…y with 2 updates

Bumps the production-dependencies group with 2 updates in the / directory: [electron-updater](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater) and [hono](https://github.com/honojs/hono).


Updates `electron-updater` from 6.8.3 to 6.8.9
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/electron-updater/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-updater@6.8.9/packages/electron-updater)

Updates `hono` from 4.12.18 to 4.12.26
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.18...v4.12.26)

---
updated-dependencies:
- dependency-name: electron-updater
  dependency-version: 6.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-b667548b74 branch from 7a49118 to 9606d38 Compare June 22, 2026 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants