You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Bumps the npm_and_yarn group with 3 updates in the / directory: dompurify, esbuild and hono.
Bumps the npm_and_yarn group with 1 update in the /vscode-extension directory: tar.
This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
Avoid inlining using and await using declarations (#4482)
Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code{usingx=newResource()x.activate()}// Old output (with --minify)newResource().activate();// New output (with --minify){usinge=newResource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)
If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)
Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original codenew(foo()`bar`)()new(foo()?.bar)()// Old outputnewfoo()bar();new(foo())?.bar();
This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
Avoid inlining using and await using declarations (#4482)
Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code{usingx=newResource()x.activate()}// Old output (with --minify)newResource().activate();// New output (with --minify){usinge=newResource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)
If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)
Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original codenew(foo()`bar`)()new(foo()?.bar)()// Old outputnewfoo()bar();new(foo())?.bar();
This release includes fixes for the following security issues:
CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard
Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc
Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length
Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2
Path traversal in serve-static on Windows via encoded backslash (%5C)
Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44
AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice
Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf
Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
There is a significant mismatch between this PR's metadata and the code changes provided. The PR claims to update 'dompurify', 'esbuild', 'hono', and 'tar' to address security vulnerabilities, but the actual diff only shows an update for 'vite' (^7.2.7 to ^8.0.16). None of the dependencies listed in the PR description have been updated in the files.
Additionally, a security flaw was identified in 'js-yaml' (CVE-2026-53550) which should be addressed given that this PR is intended for dependency maintenance. Because the primary objective of the PR (updating the 4 specific dependencies) has not been met, this PR should not be merged in its current state.
About this PR
The PR description lists updates for dompurify, esbuild, hono, and tar, but these changes are missing from the code. Conversely, the update to 'vite' is not documented in the PR description.
1 comment outside of the diffpackage-lock.json
line 7313 🟡 MEDIUM RISK
The dependency js-yaml (v4.1.1) is vulnerable to a Denial of Service attack via quadratic complexity in merge key handling (CVE-2026-53550). To resolve this, ensure the lockfile is updated to use version 4.2.0 or higher. You can force this by adding an 'overrides' field to your package.json: 'overrides': { 'js-yaml': '^4.2.0' } and then running 'npm install'.
Test suggestions
Verify application builds and runs successfully with Vite 8.0.16
Missing recommended test scenario: Verify security vulnerability fixes in esbuild 0.28.1 (local dev server path traversal)
Missing recommended test scenario: Verify security vulnerability fixes in hono 4.12.25 (CORS and Body Limit)
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify application builds and runs successfully with Vite 8.0.16
2. Missing recommended test scenario: Verify security vulnerability fixes in esbuild 0.28.1 (local dev server path traversal)
3. Missing recommended test scenario: Verify security vulnerability fixes in hono 4.12.25 (CORS and Body Limit)
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
This update to 'vite' is not mentioned in the PR description. Additionally, the requested updates for 'dompurify', 'esbuild', and 'hono' are missing from this file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Bumps the npm_and_yarn group with 3 updates in the / directory: dompurify, esbuild and hono.
Bumps the npm_and_yarn group with 1 update in the /vscode-extension directory: tar.
Updates
dompurifyfrom 3.4.8 to 3.4.11Release notes
Sourced from dompurify's releases.
Commits
0cae518release: 3.4.11 (#1494)6ee5716release: 3.4.10 (#1478)5210247release: 3.4.9 (#1459)Updates
esbuildfrom 0.28.0 to 0.28.1Release notes
Sourced from esbuild's releases.
... (truncated)
Changelog
Sourced from esbuild's changelog.
... (truncated)
Commits
bb9db84publish 0.28.1 to npm9ff053esecurity: add integrity checks to the Deno API0a9bf21enforce non-negative size in gzip parsere2a1a71security: forbid\\in local dev server requests83a2cbffix #4482: don't inlineusingdeclarations308ad74fix #4471: renaming of nestedvardeclarationsf013f5ffix some typosaafd6e4chore: fix some minor issues in comments (#4462)15300c3follow up: cjs evaluation fixes1bda0c3fix #4461, fix #4467: esm evaluation fixesUpdates
honofrom 4.12.23 to 4.12.26Release notes
Sourced from hono's releases.
Commits
27b79924.12.26d29982cchore: replace arg and glob with Bun native APIs in build script16215d5chore: remove unused devcontainer and gitpod configs (#5029)c574cf1ci: publish to npm from CI with OIDC trusted publishing (#5028)e50df01fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (#5...fce483e4.12.25751ba41Merge commit from forkf0b094dMerge commit from forkfa5f9bfMerge commit from fork3892a6cMerge commit from forkMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.
Updates
tarfrom 7.5.13 to 7.5.16Commits
cf213387.5.1621a8220do not apply PAX header fields to meta entries52632cfupdate project deps302f51ffix inconsequential typo in PENDINGLINKS symbol name55dbb99remove some uses of mutate-fs87cc3097.5.157aef486fix: regression in pending links detection6244eb37.5.149704d8cstricter protection against hardlinks preempting their targets700734fupdate workflows and depsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.