v0.54.2

[0.54.2] - 2026-09-05

Security

• Cleared 12 of the 18 Dependabot alerts tracked under #150: fast-uri
  (6 alerts, #4/#13/#22/#23/#25/#26), hono (4 alerts,
  #14/#16/#17/#18), and @hono/node-server (2 alerts, #1/#19) — closes
  sub-issues #151, #152, #155-#164 — via package.json overrides,
  pinning fast-uri to 3.1.6, hono to 4.12.34, and
  @hono/node-server to 1.19.15. All three are nested under
  prisma's bundled @prisma/dev dev-server tooling (used only by the
  prisma dev CLI subcommand, which this project's scripts never invoke)
  — not runtime-reachable, and prisma itself has no newer 7.x release
  to bump to, so overrides forces the patched versions without waiting
  on upstream. Build and full test suite pass unchanged. The remaining
  6 alerts under #150 (mysql2, brace-expansion, deepmerge-ts,
  js-yaml, valibot), also dev-tooling-only transitive deps, are
  deferred as separate follow-ups.

tag: v0.54.2
v0.54.2 - Force fast-uri/hono/@hono-node-server to patched versions via overrides (#169)

Clears 12 of the 18 Dependabot alerts tracked under #150 (closes #151, #152,
#155, #156, #157, #158, #159, #160, #161, #162, #163, #164). All three
packages are nested under prisma's bundled @prisma/dev tooling, not
runtime-reachable, and prisma has no newer 7.x release to bump to — so
package.json overrides forces the patched versions directly. Build and
full test suite pass unchanged.