chore(deps): update all non-major dependencies - #139
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 3, 2026 13:45
76511c6 to
23e46b5
Compare
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 3, 2026
## [0.16.34](v0.16.33...v0.16.34) (2026-08-03) ### Dependency Updates * **deps:** update all non-major dependencies ([#139](#139)) ([caba046](caba046))
|
🎉 This PR is included in version 0.16.34 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.0.101→3.0.1043.0.100→3.0.1033.0.88→3.0.901.11.0→1.11.11.12.019.2.17→19.2.186.0.235→6.0.2386.0.240(+1)5.1.23→5.1.265.2.04.12.32→4.12.334.12.3424.18.0→24.18.1v24.19.01.75.0→1.76.01.77.025.3.0→25.4.0Release Notes
vercel/ai (@ai-sdk/anthropic)
v3.0.104Compare Source
Patch Changes
9ecdefe]v3.0.103Compare Source
Patch Changes
7865a71: fix(anthropic): report thinking tokens as reasoning token usagev3.0.102Compare Source
Patch Changes
b4c4426: feat (provider/anthropic): support fallbacks 'default' mode, which routes safety classifier refusals to Anthropic's recommended fallback model (adds the server-side-fallback-2026-07-01 beta automatically)b4c4426: feat (provider/anthropic): support mid-conversation tool changes via the toolChanges system message provider option, emitting tool_addition/tool_removal content blocks and the mid-conversation-tool-changes-2026-07-01 betab4c4426: feat (provider/anthropic): add claude-opus-5 model id with frontier-tier capabilities (128k output tokens, structured output, adaptive thinking, xhigh effort, sampling parameter rejection, thinking-disabled only at effort high or below)HarperFast/skills (@harperfast/skills)
v1.11.1Compare Source
Bug Fixes
harperfast/harper (harper)
v5.1.26Compare Source
MQTT over TLS behind a fronting proxy
The MQTT secure-port UDS metadata published an empty certificate list when a plain TCP port was also registered (#2011). The metadata write read certificates off the wrong server, so a fronting SNI proxy had nothing to select on and fell back to serving the node certificate on 8883. Clients connecting to MQTT over TLS were presented the wrong certificate.
WebSocket upgrades on Unix domain socket listeners
WebSocket upgrades were silently dropped on the per-worker UDS mirror listeners (#2019). With
tls.unixDomainSocketsenabled, the per-worker UDS mirror is a separatehttp.Serverthat never received the'upgrade'listeneronWebSocket()attaches to the port-keyed server. Node destroys an upgrade socket that has no'upgrade'listener — with no response and no log entry — so every WebSocket handshake arriving on the mirror failed silently, with nothing on either side to diagnose it.getHTTPServer()now exposes the mirror andonWebSocket()attaches the same upgrade dispatch to it.The same change stops
enableProxyProtocol()'s data interception from outliving the PROXY header decision. The wrapper kept forwarding post-upgrade frames to the HTTP parser it captured at connection time; once the connection upgraded, that parser was freed and could be reissued by the parser pool to an unrelated connection, which then received another connection's WebSocket frames. This was reproduced as cross-connection corruption. The wrapper now removes itself and restores the original'data'listeners as soon as the header decision resolves.Also in this release
Regression coverage for the UDS certificate-metadata and WebSocket-over-UDS paths.
v5.1.25Compare Source
TLS
A raw-socket TLS listener could permanently export an empty certificate list to a fronting proxy (#1998, #1999).
The certificate selector behind MQTT's
network.securePortbuilds its SNI contexts from thehdb_certificatetable and subscribes to that table for live updates. Two paths could leave it stranded with no certificates:system.hdb_certificatewas loaded on its thread. A component creates its listener — and this selector — without controlling database load order, so the pass completed against an absent table and nothing re-triggered it.resetDatabases()—copy_db, ITC restart handling — installs a brand-new table object, orphaning the selector's subscription. Certificate changes after that point never triggered a rebuild.In either case the listener published an empty
certificates:list in its exported per-socket metadata and kept it, unchanged, until restart. A proxy that terminates TLS and routes by SNI from that metadata — Harper Fabric's Symphony — then had nothing to match on and served the instance's own node certificate for every connection to that port. This was confirmed on two of three nodes of an affected cluster, where every worker's exported MQTT metadata had been empty since container boot while HTTP listeners on the same workers were fully populated.The selector now:
hdb_certificatetable has not loaded yet, instead of resolving as though no TLS were configured.Both wait paths emit a one-time warning, so a listener stuck in this state is diagnosable from the log rather than only from a live node.
Full Changelog: HarperFast/harper@v5.1.24...v5.1.25
v5.1.24Compare Source
Storage engine
Fixes silent missing or wrong rows on multi-table requests. Bumps
@harperfast/rocksdb-jsto 2.4.1, which carries the cross-column-family transactional read fix (rocksdb-js #717, backported to the 2.4 line in #732).TransactionHandle::gethonored the caller's column-family override on its synchronous block-cache-tier attempt but dropped it in the async worker, falling back to the transaction's own column family. Because all tables in a Harper database share one read transaction, every table after the first in a given request was read through a foreign column family. Reads that hit the block cache were correct; reads that missed it silently returned not-found — so the failure was intermittent and scaled with cache residency. A warm key set read correctly, a cold one lost most or all of its records, and the symptom was worst immediately after a restart and healed as traffic warmed the cache. Where two tables share a key format, a read could also hit in the foreign column family and return another table's row.This is the defect behind #1881 (secondary-index reads returning partial or empty results for the second table accessed in a request).
Any deployment on rocksdb-js 2.4.0 is affected regardless of whether it currently looks healthy — steady traffic keeps keys warm and masks it. The dependency floor is now pinned so the fix cannot be lost to dependency resolution at image-build time; previously the range permitted a fixed version but the lockfile did not require one, so what shipped depended on when the image was built.
Security
Table read permissions are now enforced for subscriptions (#1914). Tables using
loadAsInstance = falsedid not invokeallowReadbefore subscription setup, so a checked subscription could bypass table read permissions that the equivalentgetwould have enforced. Subscription setup now matches thegetauthorization contract.This preserves v5.1's table-level permission semantics rather than backporting main's row-level delivery behavior.
Also in this release
CI: synced the
claude-review.ymlcaller withmainon the release branch.Not in this release, despite appearing in the commit list: "fix(query): stop query planning from mutating the caller's conditions" (#1911) was cherry-picked onto the release branch and then reverted before the cut. Its commits and the revert both show up in the raw changelog below and cancel out — there is no query-planning behavior change in 5.1.24. That fix remains on
mainfor 5.2.Full Changelog: HarperFast/harper@v5.1.23...v5.1.24
honojs/hono (hono)
v4.12.33Compare Source
What's Changed
@hono/node-serverin #5167Full Changelog: honojs/hono@v4.12.32...v4.12.33
nodejs/node (node)
v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @juanarbolCompare Source
This is a security release.
Notable Changes
Commits
6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #647139d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#9298a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#92134ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #6375295ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#9119a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9266c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#89605f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931oxc-project/oxc (oxlint)
v1.76.0Compare Source
🚀 Features
8d31dfalinter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)7069621linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)016cf2alinter/oxc: Add bad-match-all-arg rule (#24900) (camc314)cdc941elinter/n: Implementexports-stylerule (#24087) (Mikhail Baev)1ad6f6clinter/eslint: Implementid-denylistrule (#24632) (Mikhail Baev)📚 Documentation
3ff2e0elinter: Clarify config extends types (#24936) (Boshen)puppeteer/puppeteer (puppeteer)
v25.4.0Compare Source
🎉 Features
using) (#15027) (a1ca86b)Dependencies
🛠️ Fixes
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.