Skip to content

build(deps): Bump the all-deps group across 1 directory with 13 updates#17

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-deps-dded9ae0e0
Closed

build(deps): Bump the all-deps group across 1 directory with 13 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-deps-dded9ae0e0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 11, 2026

Bumps the all-deps group with 13 updates in the / directory:

Package From To
@types/node 22.19.15 22.19.18
turbo 2.9.6 2.9.12
@hono/node-server 1.19.11 1.19.14
@hono/zod-validator 0.7.6 0.8.0
bullmq 5.76.4 5.76.7
hono 4.12.15 4.12.18
tsc-alias 1.8.16 1.8.17
lucide-react 0.400.0 0.577.0
next 15.5.14 15.5.18
react 19.2.5 19.2.6
react-dom 19.2.5 19.2.6
eslint-config-next 15.5.15 15.5.18
postcss 8.5.12 8.5.14

Updates @types/node from 22.19.15 to 22.19.18

Commits

Updates turbo from 2.9.6 to 2.9.12

Release notes

Sourced from turbo's releases.

Turborepo v2.9.12

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.9.11...v2.9.12

Turborepo v2.9.11

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.9.10...v2.9.11

Turborepo v2.9.11-canary.7

What's Changed

Changelog

... (truncated)

Commits

Updates @hono/node-server from 1.19.11 to 1.19.14

Release notes

Sourced from @​hono/node-server's releases.

v1.19.14

What's Changed

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

Commits

Updates @hono/zod-validator from 0.7.6 to 0.8.0

Release notes

Sourced from @​hono/zod-validator's releases.

@​hono/zod-validator@​0.8.0

Minor Changes

  • #1881 e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67 Thanks @​T4ko0522! - fix(zod-validator): surface the default 400 failure response so it propagates to the RPC schema (refs honojs/hono#3746).
    • Widen the no-hook overload return type to MiddlewareHandler<E, P, V, TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>>, so the default c.json(result, 400) body reaches MergeMiddlewareResponse<M_k> on the Hono side and shows up in hc<typeof app> as a typed 400 branch.
    • Intersect the inferred middleware response with Response (Response & TypedResponse<...>) in both ZodValidatorFailureResponse<T> and ExtractValidationResponse<VF> so a zValidator(...) middleware remains assignable to a plain MiddlewareHandler (avoids a TS2322 regression caused by bare TypedResponse).
    • Collapse the no-hook overload to also accept undefined for the hook parameter together with the options.validationFunction, allowing zValidator(target, schema, undefined, { validationFunction }) to match the typed-failure path.
    • Bump peerDependencies.hono to >=4.10.0 because this PR now relies on the 4-argument MiddlewareHandler<E, P, I, R> signature introduced in Hono v4.10.0; on hono <4.10.0, MiddlewareHandler only accepts 3 type arguments and consumers would hit TS2707 even though peer ranges currently allow it.
Changelog

Sourced from @​hono/zod-validator's changelog.

0.8.0

Minor Changes

  • #1881 e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67 Thanks @​T4ko0522! - fix(zod-validator): surface the default 400 failure response so it propagates to the RPC schema (refs honojs/hono#3746).
    • Widen the no-hook overload return type to MiddlewareHandler<E, P, V, TypedResponse<ZodValidatorFailureBody<T>, 400, 'json'>>, so the default c.json(result, 400) body reaches MergeMiddlewareResponse<M_k> on the Hono side and shows up in hc<typeof app> as a typed 400 branch.
    • Intersect the inferred middleware response with Response (Response & TypedResponse<...>) in both ZodValidatorFailureResponse<T> and ExtractValidationResponse<VF> so a zValidator(...) middleware remains assignable to a plain MiddlewareHandler (avoids a TS2322 regression caused by bare TypedResponse).
    • Collapse the no-hook overload to also accept undefined for the hook parameter together with the options.validationFunction, allowing zValidator(target, schema, undefined, { validationFunction }) to match the typed-failure path.
    • Bump peerDependencies.hono to >=4.10.0 because this PR now relies on the 4-argument MiddlewareHandler<E, P, I, R> signature introduced in Hono v4.10.0; on hono <4.10.0, MiddlewareHandler only accepts 3 type arguments and consumers would hit TS2707 even though peer ranges currently allow it.
Commits
  • a08b023 Version Packages (#1887)
  • e90e4fb feat(zod-validator): surface the default 400 on the no-hook overload and keep...
  • e762ac0 feat(eslint): ignoring variables and parameters prefixed with _ (#1772)
  • 475cd12 chore: update typescript to 5.9.3 (#1741)
  • 96ae310 chore: update Zod/Valibot import examples to use namespace imports in docs an...
  • fbec266 chore(deps-dev): bump hono from 4.11.3 to 4.11.4 (#1710)
  • c7edf1e chore(deps-dev): upgrade @cloudflare/vitest-pool-workers and vitest (#1714)
  • 03a28c5 fix: less strict template expressions (#1681)
  • 1f8372e chore(typescript): add @tsconfig/strictest (#1679)
  • 49db969 chore(eslint): update suppressions (#1678)
  • Additional commits viewable in compare view

Updates bullmq from 5.76.4 to 5.76.7

Release notes

Sourced from bullmq's releases.

v5.76.7

5.76.7 (2026-05-11)

Bug Fixes

  • deps: update dependency semver to v7.8.0 [security] (#4160) (093743a)

v5.76.6

5.76.6 (2026-05-06)

Bug Fixes

  • connection: reconnect wedged blocking cluster clients (#4151) (e94e8cd)

v5.76.5

5.76.5 (2026-05-02)

Bug Fixes

  • deps: update dependency msgpackr to v1.11.12 (#3939) (b47f00b)
Commits
  • 093743a fix(deps): update dependency semver to v7.8.0 [security] (#4160)
  • 38b208e chore(deps): update devdependencies (non-major) [security] (#4158)
  • c2508be chore(release): vpy2.25.2 (#4156)
  • 51c935b fix(worker): [python] avoid tight error loop on Redis disconnect (#4102)
  • 16cb101 docs: fix several typos (#4130) (#4153)
  • f5a3fc8 chore(deps): bump the npm_and_yarn group across 4 directories with 1 update (...
  • 9503bfb docs: update bullmq-pro changelog for version v7.45.1 (#4154)
  • 9df4b7e chore(release): 5.76.6 (#4152)
  • e94e8cd fix(connection): reconnect wedged blocking cluster clients (#4151)
  • 9214391 chore(deps): bump the npm_and_yarn group across 4 directories with 1 update (...
  • Additional commits viewable in compare view

Updates hono from 4.12.15 to 4.12.18

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36


Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

Commits

Updates tsc-alias from 1.8.16 to 1.8.17

Release notes

Sourced from tsc-alias's releases.

v1.8.17 (2025-04-30)

What's Changed

New Contributors

Full Changelog: justkey007/tsc-alias@v1.8.16...v1.8.17

Commits
  • d51d3e6 1.8.17
  • 0b1a906 test: increase timeout for prepareSingleFileReplaceTscAliasPaths test
  • 318b473 Merge pull request #257 from justkey007/dependabot/npm_and_yarn/minimatch-10.2.5
  • 0f67a39 Merge pull request #258 from justkey007/_ci
  • 9aa5362 test: fix prepareSingleFileReplaceTscAliasPaths test to use JS API instead of...
  • f450e74 chore: update tsconfig.json files in project14 packages to include compiler o...
  • 14aa685 chore: add "skipLibCheck" option to tsconfig.json files in project14 and proj...
  • 57d8c33 chore: add "skipLibCheck" option to tsconfig.json files across multiple projects
  • b8984a4 chore: update Node.js and pnpm versions in CI workflow
  • a435cd4 chore(deps): bump minimatch from 10.0.1 to 10.2.5
  • Additional commits viewable in compare view

Updates lucide-react from 0.400.0 to 0.577.0

Release notes

Sourced from lucide-react's releases.

Version 0.577.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

Version 0.576.0

What's Changed

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

Version 0.575.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

Version 0.574.0

What's Changed

New Contributors

... (truncated)

Commits
  • f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
  • 67c0485 feat(scripts): added helper script to automatically update OpenCollective bac...
  • b6ed43d feat(packages): Added aria-hidden fallback for decorative icons to all packag...
  • 076e0bb chore(dependencies): Update dependencies (#3809)
  • 80d6f73 fix(icons): Rename fingerprint icon to fingerprint-pattern (#3767)
  • 1cfb3ff chore(deps-dev): bump vite from 6.3.5 to 6.3.6 (#3611)
  • e71198d chore: icon alias improvements (#2861)
  • 3e644fd chore(scripts): Refactor scripts to typescript (#3316)
  • 19fa01b build(deps-dev): bump vite from 6.3.2 to 6.3.4 (#3181)
  • 03eb862 use implicit return in react package (#2325)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.


Updates next from 15.5.14 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.16

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

Commits
  • 9ff92ce v15.5.18
  • 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
  • 62c97ab v15.5.17
  • 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
  • fa78739 Turbopack: Fix middleware matcher suffix (#93590)
  • 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
  • 36589b5 [backport][test] Pin package manager to patch versions (#93596)
  • ad6fd4e v15.5.16
  • 79d7dff Ignore malformed CSP nonce headers (#103)
  • c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Commits

Updates eslint-config-next from 15.5.15 to 15.5.18

Release notes

Sourced from eslint-config-next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.16

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-config-next since your current version.


Updates postcss from 8.5.12 to 8.5.14

Release notes

Sourced from postcss's releases.

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.
Changelog

Sourced from postcss's changelog.

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits ...

Description has been truncated


Summary by cubic

Upgrade dependencies across API, dashboard, and site for security fixes and stability. Key bumps include next@15.5.18, react@19.2.6, hono@4.12.18, @hono/node-server@1.19.14, and bullmq@5.76.7.

  • Dependencies

    • Frontend: next@15.5.18 (multiple security fixes), eslint-config-next@15.5.18, react/react-dom@19.2.6, lucide-react@0.577.0, postcss@8.5.14.
    • API: hono@4.12.18 and @hono/node-server@1.19.14 (security fixes), @hono/zod-validator@0.8.0 (typed 400 failures; peer hono >=4.10), bullmq@5.76.7.
    • Tooling: turbo@2.9.12, @types/node@22.19.18, tsc-alias@1.8.17.
  • Migration

    • Install deps and rebuild.
    • @hono/zod-validator: 400 error responses are now typed; update any affected types.
    • lucide-react: check for renamed icons if imports fail.

Written for commit d39ce90. Summary will update on new commits.

Bumps the all-deps group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.15` | `22.19.18` |
| [turbo](https://github.com/vercel/turborepo) | `2.9.6` | `2.9.12` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.11` | `1.19.14` |
| [@hono/zod-validator](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator) | `0.7.6` | `0.8.0` |
| [bullmq](https://github.com/taskforcesh/bullmq) | `5.76.4` | `5.76.7` |
| [hono](https://github.com/honojs/hono) | `4.12.15` | `4.12.18` |
| [tsc-alias](https://github.com/justkey007/tsc-alias) | `1.8.16` | `1.8.17` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.400.0` | `0.577.0` |
| [next](https://github.com/vercel/next.js) | `15.5.14` | `15.5.18` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.6` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `15.5.15` | `15.5.18` |
| [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.14` |



Updates `@types/node` from 22.19.15 to 22.19.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `turbo` from 2.9.6 to 2.9.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.9.6...v2.9.12)

Updates `@hono/node-server` from 1.19.11 to 1.19.14
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.11...v1.19.14)

Updates `@hono/zod-validator` from 0.7.6 to 0.8.0
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-validator/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/zod-validator@0.8.0/packages/zod-validator)

Updates `bullmq` from 5.76.4 to 5.76.7
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.76.4...v5.76.7)

Updates `hono` from 4.12.15 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.18)

Updates `tsc-alias` from 1.8.16 to 1.8.17
- [Release notes](https://github.com/justkey007/tsc-alias/releases)
- [Commits](justkey007/tsc-alias@v1.8.16...v1.8.17)

Updates `lucide-react` from 0.400.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `next` from 15.5.14 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.14...v15.5.18)

Updates `react` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react)

Updates `react-dom` from 19.2.5 to 19.2.6
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom)

Updates `eslint-config-next` from 15.5.15 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/commits/v15.5.18/packages/eslint-config-next)

Updates `postcss` from 8.5.12 to 8.5.14
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.12...8.5.14)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 22.19.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: turbo
  dependency-version: 2.9.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: "@hono/zod-validator"
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-deps
- dependency-name: bullmq
  dependency-version: 5.76.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: hono
  dependency-version: 4.12.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: tsc-alias
  dependency-version: 1.8.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-deps
- dependency-name: next
  dependency-version: 15.5.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: react
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: react-dom
  dependency-version: 19.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: eslint-config-next
  dependency-version: 15.5.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: postcss
  dependency-version: 8.5.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 11, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot requested a review from teocomyn as a code owner May 11, 2026 18:09
@vercel
Copy link
Copy Markdown

vercel Bot commented May 11, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
commerce-agent-protocol-site Ready Ready Preview, Comment May 11, 2026 6:10pm

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 5 files

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 18, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 18, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/all-deps-dded9ae0e0 branch May 18, 2026 20:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants