chore(deps): bump the npm-minor-patch group in /server/content with 5 updates

[dependabot]

Bumps the npm-minor-patch group in /server/content with 5 updates:

Package	From	To
@hono/node-server	2.0.12	2.1.0
@slidev/cli	52.18.0	52.19.0
dompurify	3.4.12	3.4.13
hono	4.12.32	4.13.0
playwright-chromium	1.62.0	1.62.1

Updates @hono/node-server from 2.0.12 to 2.1.0

Release notes

Sourced from @​hono/node-server's releases.

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

Commits

• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• See full diff in compare view

Updates @slidev/cli from 52.18.0 to 52.19.0

Release notes

Sourced from @​slidev/cli's releases.

v52.19.0

   🐞 Bug Fixes

• Wrong import  -  by @​e-kucheriavyi in slidevjs/slidev#2692 (5b352)
• client:
  • Hide goto dialog fully when closed  -  by @​limeburst in slidevjs/slidev#2695 (e0422)
  • Guard useNav against a missing injection context  -  by @​renechoi in slidevjs/slidev#2694 (edb23)
  • Support per-slide codeCopy and magicMoveCopy frontmatter overrides  -  by @​amir-rezaei, ferkans-amir and @​antfubot in slidevjs/slidev#2686 (f7e77)

    View changes on GitHub

v52.18.1

   🚀 Features

• vscode: Sort projects tree by entry path  -  by @​lzblack in slidevjs/slidev#2678 (36063)

   🐞 Bug Fixes

• Add .trycloudflare.com to allowedHosts when tunnel enabled  -  by @​Copilot and kermanx in slidevjs/slidev#2346 (fcef0)
• Resolve CI regressions from deps update  -  by @​antfubot in slidevjs/slidev#2688 (ec6b0)
• Normalize null sourcesContent entries for magic-string v1  -  by @​antfubot in slidevjs/slidev#2689 (e2ea9)
• ci: Resolve monaco-editor exports and duplicate docs frontmatter key  -  by @​antfubot in slidevjs/slidev#2690 (27a8a)
• client: Use slide-local nav during export  -  by @​NgoQuocViet2001 and viet.ngo in slidevjs/slidev#2681 (d2db9)
• monaco: Respect lineNumbers config and lines option  -  by @​lazerg in slidevjs/slidev#2682 (8a366)
• vscode: Prevent preview sync feedback loop  -  by @​fredcallaway and @​kermanx in slidevjs/slidev#2680 (94ea0)

    View changes on GitHub

Commits

• 6b540d3 chore: release v52.19.0
• a29489c deps: upgrade to latest majors and migrate MCP SDK to v2 (#2696)
• f7e77f1 fix(client): support per-slide codeCopy and magicMoveCopy frontmatter overrid...
• 5b352a5 fix: wrong import (#2692)
• edb2399 fix(client): guard useNav against a missing injection context (#2694)
• e0422d6 fix(client): hide goto dialog fully when closed (#2695)
• f970a44 chore: release v52.18.1
• 27a8ad5 fix(ci): resolve monaco-editor exports and duplicate docs frontmatter key (#2...
• 94ea037 fix(vscode): prevent preview sync feedback loop (#2680)
• 0ae15fa docs: add Sandpack addon to gallery (#2677)
• Additional commits viewable in compare view

Updates dompurify from 3.4.12 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

Commits

• 3067f77 release: 3.4.13 (#1562)
• See full diff in compare view

Updates hono from 4.12.32 to 4.13.0

Release notes

Sourced from hono's releases.

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in honojs/hono#5118
• perf(url): replace regex tests with indexOf honojs/hono#5121
• perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122
• perf(urls): refactor tryDecodeURIComponent honojs/hono#5158
• perf(request): allocate #validatedData lazily honojs/hono#5175
• perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

... (truncated)

Commits

• 192768f 4.13.0
• b0c2d90 Merge pull request #5154 from honojs/next
• 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
• 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
• 3feb355 fix(jsx): allow a function component to return an array (#5179)
• 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
• 30277ae feat(jwt,jwk): add a configurable WWW-Authenticate realm (#5141)
• 1f707c5 feat(middleware): add method-not-allowed middleware (#5132)
• 2df0b47 feat(jsx): add React-compatible overloads to useRef (#5063)
• 3bc96ba feat(cache): add first-class support for QUERY requests (#5119)
• Additional commits viewable in compare view

Updates playwright-chromium from 1.62.0 to 1.62.1

Release notes

Sourced from playwright-chromium's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[xiaolai]

Closing — this PR could not have merged, and the cause is a Dependabot config defect rather than anything wrong with the bumps themselves.

server/content is a pnpm workspace member (pnpm-workspace.yaml), so it has no lockfile of its own; the root pnpm-lock.yaml is the only one that resolves it. The /server/content entry in .github/dependabot.yml could only rewrite server/content/package.json, never the root lockfile — so every job here failed at install with ERR_PNPM_OUTDATED_LOCKFILE.

Four earlier PRs from the same two entries were closed for the same reason: #1259, #1237, #1189, #1167, #1166.

The bumps are not lost, and the replacement is newer. #1261 — opened by the root / entry, which resolves the whole workspace — updates server/content/package.json together with the root lockfile, and is green. It is a superset of this PR:

Package	This PR	#1261
@hono/node-server	^2.1.0	^2.1.0
@slidev/cli	^52.19.0	^52.19.0
dompurify	^3.4.13	^3.4.13
hono	^4.13.0	^4.13.1
playwright-chromium	^1.62.1	^1.62.1
katex	—	^0.18.3

It is merging as part of #1262, which also deletes the /server/mcp and /server/content entries so this class of PR stops being generated.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml