Skip to content

Bump the non-major-updates group across 1 directory with 6 updates - #21

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/non-major-updates-85499c13a4
Open

Bump the non-major-updates group across 1 directory with 6 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/non-major-updates-85499c13a4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the non-major-updates group with 6 updates in the / directory:

Package From To
hono 4.13.1 4.13.7
simple-icons 16.28.0 16.30.0
@hono/node-server 2.1.0 2.1.1
@types/node 26.2.0 26.5.0
oxlint 1.78.0 1.82.0
tsx 4.23.12 4.23.13

Updates hono from 4.13.1 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

Updates simple-icons from 16.28.0 to 16.30.0

Release notes

Sourced from simple-icons's releases.

Release 16.30.0

2 new icons

Release 16.29.0

4 new icons

2 updated icons

Commits

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

Updates @types/node from 26.2.0 to 26.5.0

Commits

Updates oxlint from 1.78.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

Oxlint v1.82.0

💥 BREAKING CHANGES

  • 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

  • 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

  • aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)
  • 562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)
  • 253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)
  • 8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)
  • 5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)
  • 4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)
  • 07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)
  • 9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)
  • a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (#25925) (camc314)
  • 304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (#26166) (Hamody We)
  • b41bb35 linter: Qualify rules in rules output (#26250) (camc314)
  • 895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (#26231) (camc314)
  • 4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (#26225) (camc314)

🛡️ Security

  • 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Oxfmt v0.67.0

💥 BREAKING CHANGES

  • 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)
  • 2c9a947 parser: [BREAKING] Reduce MAX_LEN to 256 bytes below u32::MAX (#26352) (overlookmotel)

🚀 Features

  • 68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (#26337) (leaysgur)

🐛 Bug Fixes

  • f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (#26375) (leaysgur)
  • 104061b formatter: Keep JSDoc cast parens with a comment inside them (#26374) (leaysgur)
  • 3d00a76 formatter_css: Keep comment inside important and simple-vars colon (#26370) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.82.0] - 2026-09-07

🚀 Features

  • 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

  • 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

  • 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
  • aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
  • 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
  • beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
  • 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
  • 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
  • 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)
Commits
  • b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
  • aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
  • 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
  • 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
  • d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
  • 63bc313 chore(npm): update funding URL (#26066)
  • 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
  • 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
  • 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
  • aa49d86 fix(linter): allow spread rule options in config types (#25675)
  • Additional commits viewable in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the non-major-updates group across 1 directory with 6 updates
80f5e2d 
Bumps the non-major-updates group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.7` |
| [simple-icons](https://github.com/simple-icons/simple-icons) | `16.28.0` | `16.30.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` | `2.1.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.5.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.82.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |



Updates `hono` from 4.13.1 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.7)

Updates `simple-icons` from 16.28.0 to 16.30.0
- [Release notes](https://github.com/simple-icons/simple-icons/releases)
- [Commits](simple-icons/simple-icons@16.28.0...16.30.0)

Updates `@hono/node-server` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.0...v2.1.1)

Updates `@types/node` from 26.2.0 to 26.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `oxlint` from 1.78.0 to 1.82.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.82.0/npm/oxlint)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.12...v4.23.13)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-major-updates
- dependency-name: simple-icons
  dependency-version: 16.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-major-updates
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: non-major-updates
- dependency-name: "@types/node"
  dependency-version: 26.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: non-major-updates
- dependency-name: oxlint
  dependency-version: 1.82.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: non-major-updates
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: non-major-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates needs-triage Needs maintainer triage labels Sep 11, 2026
@dependabot
dependabot Bot requested a review from laigit-dot as a code owner September 11, 2026 20:25
@dependabot dependabot Bot added the needs-triage Needs maintainer triage label Sep 11, 2026
@vercel

vercel Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
profile-card-shop Ready Ready Preview Sep 11, 2026 8:25pm UTC

@dependabot dependabot Bot added the dependencies Dependency updates label Sep 11, 2026

This branch was successfully deployed

1 active deployment
Preview — 80f5e2d6 Deployed Sep 11, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@laigit-dot laigit-dot Awaiting requested review from laigit-dot laigit-dot is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates needs-triage Needs maintainer triage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants