[security](deps): bump the npm_and_yarn group across 1 directory with 7 updates - #175
Conversation
… 7 updates Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.12.16` | `4.12.18` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.11` | `2.0.3` | | [axios](https://github.com/axios/axios) | `1.13.6` | `1.16.1` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.14` | | [protocol-buffers-schema](https://github.com/mafintosh/protocol-buffers-schema) | `3.6.0` | `3.6.1` | Updates `hono` from 4.12.16 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.16...v4.12.18) Updates `@hono/node-server` from 1.19.11 to 2.0.3 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.11...v2.0.3) Updates `axios` from 1.13.6 to 1.16.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.6...v1.16.1) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `postcss` from 8.5.6 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.14) Updates `protocol-buffers-schema` from 3.6.0 to 3.6.1 - [Commits](mafintosh/protocol-buffers-schema@v3.6.0...v3.6.1) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 2.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protocol-buffers-schema dependency-version: 3.6.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 81c698fa8a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| resolution: {integrity: sha512-n3GfHwwCvHCkGmOwKfxUPOlbfzuO64Sbc5XC4NGPIXxkuOnJrdgExdRKmHfF924r914WRJPT397GdqLvdYTeyQ==} | ||
| '@hono/node-server@2.0.3': | ||
| resolution: {integrity: sha512-a0jV+/HRe3G5zjFID3zObAQFdkl6zpxTuqktdDDXS3MJKcrZIkB8OkLpNBlY/WXFqv2HF4a0takPej+aNFczWA==} | ||
| engines: {node: '>=20'} |
There was a problem hiding this comment.
This lockfile now resolves @hono/node-server to a package that declares engines: {node: '>=20'}, but the repo and affected MCP/Cloudflare docs still advertise Node.js 18+ as the runtime baseline (README.md, platforms/mcp/README.md, and packages/cloudflare-template/README.md). In documented Node 18 environments, installs that enforce engines will reject this dependency, and even non-enforcing installs are now outside the supported runtime; pin/override @hono/node-server to the 1.x line or raise and document the Node baseline in the same change.
Useful? React with 👍 / 👎.
| "concurrently": "^9.2.1", | ||
| "fast-check": "^4.7.0", | ||
| "hono": "^4.12.16", | ||
| "hono": "^4.12.18", |
There was a problem hiding this comment.
The root AGENTS.md hard rule says any commit that changes behavior, config, or tooling must update FORJAMIE.md in the same change-set. This dependency/security bump changes package manifests and the lockfile, including transitive runtime requirements, but the diff only touches package.json, platforms/mcp/package.json, and pnpm-lock.yaml, so the project map is left stale and violates the repo’s documented definition of done.
Useful? React with 👍 / 👎.
1 participant
Bumps the npm_and_yarn group with 6 updates in the / directory:
4.12.164.12.181.19.112.0.31.13.61.16.13.1.03.1.28.5.68.5.143.6.03.6.1Updates
honofrom 4.12.16 to 4.12.18Release notes
Sourced from hono's releases.
Commits
f10dee84.12.18a5bd9ebMerge commit from fork58d3d3aMerge commit from fork568c2ecMerge commit from forkff2b3d34.12.1752aaaf9fix(types): propagate middleware response types to app.on overloads (#4906)76d5589fix(cors): make origin optional in CORSOptions (#4905)8f027e5fix(ssg): addatom+xmlandrss+xmltodefaultExtensionMap(#4899)bfba97cfix(jsx): normalize SVG attributes on the <svg> root element (#4893)Updates
@hono/node-serverfrom 1.19.11 to 2.0.3Release notes
Sourced from @hono/node-server's releases.
... (truncated)
Commits
9d879872.0.39463250fix: preserve headers mutated after raw Response construction (#357)cee5e81docs: Align theServeStaticOptioncommand with the current specification (#...4aa0650chore(ci): update GitHub Actions versions (#352)808159c2.0.21a9748efix: handle serveStatic stream fallback backpressure (#351)54d1bcdfix(serve-static): stop using file birthtime for Date header (#350)9138a802.0.10ed7656fix: forward Hono response headers during WebSocket upgrade (#346)58c93552.0.0Updates
axiosfrom 1.13.6 to 1.16.1Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
1337d6bchore(release): prepare release 1.16.1 (#10877)858a790fix: remove all caches (#10882)34adfd9revert: "fix: support URL object as config.url input (#10866)" (#10874)847d89bfix: support URL object as config.url input (#10866)4094886fix(progress): guard malformed XHR upload events (#10868)44f0c5bchore: change sponsorship link and add Twicsy advertisement (#10869)64e1095chore: update PR and issue template to use h2 (#10865)3e6b4e1fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...c4453bafix: add the ability to add additional sponsors to the process sponsors scrip...caa00a9fix: https data in cleartext to proxy (#10858)Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
fast-urifrom 3.1.0 to 3.1.2Release notes
Sourced from fast-uri's releases.
Commits
919dd8eBumped v3.1.2c65ba57fixup: linting6c86c17Merge commit from forka95158aHandle malformed fragment decoding without throwing (#171)cea547cBumped v3.1.1876ce79Merge commit from forkdcdf690ci: add lock-threads workflow (#169)c860e65build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)9b4c6dcbuild(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)85d09a9build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...Updates
follow-redirectsfrom 1.15.11 to 1.16.0Commits
0c23a22Release version 1.16.0 of the npm package.844c4d3Add sensitiveHeaders option.5e8b8d0ci: add Node.js 24.x to the CI matrix7953e22ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v686dc1f8Sanitizing input.Updates
postcssfrom 8.5.6 to 8.5.14Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
3ec1394Release 8.5.14 versionf2bb827Update dependenciesd75953dMerge pull request #2084 from 43081j/raw-raws-rawing68bd213fix: always callrawto retrieve raw valuesaf58cf1Release 8.5.13 versionf227dbdTemporary ignore pnpm 11 configd3abd40Update dependenciesdd06c3eRevert stringifier changes because of the conflict with postcss-scssae889c8Try to fix CIe0093e4Move to pnpm 11Updates
protocol-buffers-schemafrom 3.6.0 to 3.6.1Commits
46c34bd3.6.12351031Fixed parse.js to prevent Prototype Pollution (#70)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.