Skip to content

Bump the non-major-updates group across 1 directory with 7 updates - #18

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/non-major-updates-a34b40f189
Closed

Bump the non-major-updates group across 1 directory with 7 updates#18
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/non-major-updates-a34b40f189

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the non-major-updates group with 7 updates in the / directory:

Package From To
hono 4.13.1 4.13.5
simple-icons 16.28.0 16.29.0
@hono/node-server 2.1.0 2.1.1
@types/node 26.2.0 26.4.1
oxlint 1.78.0 1.81.0
tsx 4.23.12 4.23.13
vitest 4.1.10 4.1.11

Updates hono from 4.13.1 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
  • fix(client): skip undefined header and cookie values in honojs/hono#5244
  • fix(client): skip an undefined entry inside a query array in honojs/hono#5272
  • fix(client): skip an undefined entry inside a form array in honojs/hono#5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
  • fix(client): omit empty query delimiter in honojs/hono#5283
  • fix(request): drop stale content length for cloned FormData in honojs/hono#5282
  • fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
  • fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
  • fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits
  • 06880c4 4.13.5
  • 531e9c5 Merge commit from fork
  • 3a67f7f Merge commit from fork
  • 9c28d72 Merge commit from fork
  • 017000d 4.13.4
  • 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
  • 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
  • c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
  • 612b59c fix(request): drop stale content length for cloned FormData (#5282)
  • 73794bd fix(client): omit empty query delimiter (#5283)
  • Additional commits viewable in compare view

Updates simple-icons from 16.28.0 to 16.29.0

Release notes

Sourced from simple-icons's releases.

Release 16.29.0

4 new icons

2 updated icons

Commits

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

Updates @types/node from 26.2.0 to 26.4.1

Commits

Updates oxlint from 1.78.0 to 1.81.0

Release notes

Sourced from oxlint's releases.

oxlint v1.81.0 & oxfmt v0.66.0

Table of Contents

Oxlint v1.81.0

🚀 Features

  • 60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

  • 33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)
  • baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)
  • 77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)
  • fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)
  • e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
  • d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)
  • 73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)
  • 03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)
  • bd15905 linter/react/no-unstable-nested-components: Check nested component object property names (#26101) (camc314)
  • 3910e2b linter/eslint/no-unassigned-vars: Skip Svelte and Vue files (#26042) (Hamody We)
  • 047f7ca linter/plugins: Fix interaction between JS plugins and Vue rules (#26080) (overlookmotel)
  • 8531b9b linter/plugins: Alter method for obtaining mutable Program when sending AST to JS plugins (#26077) (overlookmotel)
  • dc464ff linter/unicorn/prefer-math-min-max: Avoid unsafe autofix (#26060) (camc314)

📚 Documentation

  • 464ddd1 linter: Support a shared short description for jest/vitest rules (#26186) (connorshea)
  • 9db5ad3 linter: Add short description to vue/no-dupe-keys (#26183) (connorshea)
  • db66f58 linter: Correct export/import mismatch in bar and foo example (#25927) (billychannnnnn)
  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Oxfmt v0.66.0

🚀 Features

  • 1fb37b6 formatter/css: Format declaration-shaped raw-prelude rules (postcss nested config blocks) (#26194) (leaysgur)

🐛 Bug Fixes

  • 9f81002 formatter: Re-add suppressed statement terminators per options.semi (#26220) (leaysgur)
  • 769ffd5 formatter: Print suppressed typecast parens (#26218) (leaysgur)
  • 5ff57f8 formatter/sort-imports: Handle custom side effect groups (#26217) (leaysgur)
  • 2f4d759 formatter: Do not skip cast comment lookup (#26216) (leaysgur)
  • 1213e12 formatter: Preserve comment for statement terminators and binary casts (#26213) (leaysgur)
  • 57e8e22 formatter_css: Space a folded sign after a call in Less operations (#26134) (leaysgur)
  • e4298fb formatter/jsdoc: Follow CommonMark for interrupting lists and guard wrapping from creating them (#26098) (leaysgur)
  • a1e21c2 formatter: Apply head body policy everywhere (#26074) (leaysgur)
  • 676b7e1 formatter: Keep comments in their for-head slot, before an empty-statement body and do-while (#26073) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.81.0] - 2026-08-31

📚 Documentation

  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

  • 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

  • 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
  • aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
  • 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
  • beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
  • 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
  • 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
  • 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)
Commits
  • 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
  • d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
  • 63bc313 chore(npm): update funding URL (#26066)
  • 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
  • 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
  • 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
  • aa49d86 fix(linter): allow spread rule options in config types (#25675)
  • 8922381 refactor(linter): remove inactive react config rule (#25740)
  • 8c4552d feat(linter)!: split react/react-compiler into per-category rules (#25500)
  • 36f8451 fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)
  • Additional commits viewable in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

Commits

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the non-major-updates group across 1 directory with 7 updates
c838159 
Bumps the non-major-updates group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.5` |
| [simple-icons](https://github.com/simple-icons/simple-icons) | `16.28.0` | `16.29.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` | `2.1.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.4.1` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.81.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |



Updates `hono` from 4.13.1 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.5)

Updates `simple-icons` from 16.28.0 to 16.29.0
- [Release notes](https://github.com/simple-icons/simple-icons/releases)
- [Commits](simple-icons/simple-icons@16.28.0...16.29.0)

Updates `@hono/node-server` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.0...v2.1.1)

Updates `@types/node` from 26.2.0 to 26.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `oxlint` from 1.78.0 to 1.81.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.81.0/npm/oxlint)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-major-updates
- dependency-name: simple-icons
  dependency-version: 16.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-major-updates
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: non-major-updates
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: non-major-updates
- dependency-name: oxlint
  dependency-version: 1.81.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: non-major-updates
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: non-major-updates
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: non-major-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates needs-triage Needs maintainer triage labels Sep 4, 2026
@dependabot
dependabot Bot requested a review from laigit-dot as a code owner September 4, 2026 20:24
@dependabot dependabot Bot added needs-triage Needs maintainer triage dependencies Dependency updates labels Sep 4, 2026
@vercel

vercel Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
profile-card-shop Ready Ready Preview Sep 4, 2026 8:25pm UTC

@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 11, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/non-major-updates-a34b40f189 branch September 11, 2026 20:25

This branch was successfully deployed

1 active deployment
Preview — c838159e Deployed Sep 4, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@laigit-dot laigit-dot Awaiting requested review from laigit-dot laigit-dot is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates needs-triage Needs maintainer triage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants