chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates by dependabot[bot] · Pull Request #374 · vllnt/ui

dependabot · 2026-05-19T16:00:34Z

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package	From	To
postcss	`8.5.6`	`8.5.10`
@hono/node-server	`1.19.11`	`2.0.3`
axios	`1.13.6`	`1.16.1`
brace-expansion	`1.1.12`	`5.0.6`
express-rate-limit	`8.2.1`	`8.5.2`
fast-uri	`3.1.0`	`3.1.2`
flatted	`3.3.3`	`3.4.2`
hono	`4.12.5`	`4.12.21`
lodash	`4.17.23`	`4.18.1`
path-to-regexp	`6.3.0`	`8.4.2`
picomatch	`2.3.1`	`4.0.4`
vite	`6.4.1`	`7.3.3`
ws	`8.19.0`	`8.20.1`

Updates postcss from 8.5.6 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
fe88ac2 Release 8.5.9 version
c551632 Avoid RegExp when we can use simple JS
89a6b74 Move SECURITY.txt for docs folder to keep GitHub page cleaner
6ceb8a4 Create SECURITY.md
Additional commits viewable in compare view

Updates @hono/node-server from 1.19.11 to 2.0.3

Release notes

Sourced from @hono/node-server's releases.

v2.0.3

What's Changed

chore(ci): update GitHub Actions versions by @BlankParticle in honojs/node-server#352

docs: Align the ServeStaticOptions comment with the current spec by @kakkokari-gtyih in honojs/node-server#356

fix: preserve headers mutated after raw Response construction by @abdulmunimjemal in honojs/node-server#357

New Contributors

@kakkokari-gtyih made their first contribution in honojs/node-server#356

@abdulmunimjemal made their first contribution in honojs/node-server#357

Full Changelog: honojs/node-server@v2.0.2...v2.0.3

v2.0.2

What's Changed

fix(serve-static): stop using file birthtime for Date header by @usualoma in honojs/node-server#350

fix: handle serveStatic stream fallback backpressure by @usualoma in honojs/node-server#351

Full Changelog: honojs/node-server@v2.0.1...v2.0.2

v2.0.1

What's Changed

fix: forward Hono response headers during WebSocket upgrade by @gentamura in honojs/node-server#346

New Contributors

@gentamura made their first contribution in honojs/node-server#346

Full Changelog: honojs/node-server@v2.0.0...v2.0.1

v2.0.0

Now, we release the second major version of the Hono Node.js adapter 🎉 🎉 🎉

The Hono Node.js adapter is now up to 2.3x faster

v2 of the Hono Node.js adapter reaches up to 2.3x the throughput of v1 — that's the peak number, measured on the body-parsing scenario of bun-http-framework-benchmark. The other scenarios (Ping, Query) get a smaller but real boost too.

Install or upgrade with:
npm i @hono/node-server@latest
v2

The Node.js adapter is going through a major version bump to v2. That said, the public API stays the same — the headline of this release is the large performance improvement described above.

What does the Node.js adapter do?

A quick refresher on what the Node.js adapter actually does — it exists so that Hono applications can run on Node.js. Hono is built on the Web Standards APIs, but you cannot serve those directly from Node.js. The adapter bridges the Web Standards APIs and the Node.js APIs, which is what lets a Hono app — and more generally a Web-Standards-style app — run on top of Node.js.

... (truncated)

Commits

9d87987 2.0.3
9463250 fix: preserve headers mutated after raw Response construction (#357)
cee5e81 docs: Align the ServeStaticOption command with the current specification (#...
4aa0650 chore(ci): update GitHub Actions versions (#352)
808159c 2.0.2
1a9748e fix: handle serveStatic stream fallback backpressure (#351)
54d1bcd fix(serve-static): stop using file birthtime for Date header (#350)
9138a80 2.0.1
0ed7656 fix: forward Hono response headers during WebSocket upgrade (#346)
58c9355 2.0.0
Additional commits viewable in compare view

Updates axios from 1.13.6 to 1.16.1

Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)

Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)

CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)

Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)

XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)

Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)

Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)

URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)

composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)

AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)

Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)

Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)

Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@hpinmetaverse (#10836)

@tommyhgunz14 (#7413)

@abhu85 (#10829)

@divyanshuraj1095 (#10853)

@sagodi97 (#10856)

@rkdfx (#10868)

@Liuwei1125 (#10866)

Full Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)

Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)

Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)

parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)

Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)

transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)

ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)

Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)

HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)

Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)

XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)

Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)

Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)

UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)

Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)

Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)

Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)

Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)

Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)

Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@singhankit001 (#10588)

@cuiweixie (#7419)

@iruizsalinas (#10787)

... (truncated)

Commits

1337d6b chore(release): prepare release 1.16.1 (#10877)
858a790 fix: remove all caches (#10882)
34adfd9 revert: "fix: support URL object as config.url input (#10866)" (#10874)
847d89b fix: support URL object as config.url input (#10866)
4094886 fix(progress): guard malformed XHR upload events (#10868)
44f0c5b chore: change sponsorship link and add Twicsy advertisement (#10869)
64e1095 chore: update PR and issue template to use h2 (#10865)
3e6b4e1 fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...
c4453ba fix: add the ability to add additional sponsors to the process sponsors scrip...
caa00a9 fix: https data in cleartext to proxy (#10858)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates brace-expansion from 1.1.12 to 5.0.6

Release notes

Sourced from brace-expansion's releases.

v4.0.1

fmt 5a5cc17

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

feat: use string replaces instead of splits (#64) 278132b

fmt dd72a59

add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

pkg: publish on tag 3.x 3059c07

fmt 8229e6f

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8

added jsdoc (#55) 68c0e37

node 16 is EOL 9e781e9

add standard 3494c4d

use const and let (#57) dd5a4cb

docs 6dad209

remove test e3dd8ae

ci: update node versions d23ede9

docs: add @lanodan to contributors 1eb3fa4

docs 1e7c9cd

switch from tape to test module (#60) 2520537

Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1

Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf

docs: add back ci badge 8ee5626

Add github actions, remove travis. Closes #52 (#53) 5c8756a

CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.0.2

pkg: publish on tag 2.x 14f1d91

fmt ed7780a

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

... (truncated)

Commits

46317b5 5.0.6
c0b095b Merge commit from fork
ec56020 Bump picomatch from 4.0.3 to 4.0.4 (#93)
8793901 5.0.5
9a02af5 Merge commit from fork
daa71bc Bump tar from 7.5.10 to 7.5.11 (#92)
799e5f7 Bump tar from 7.5.9 to 7.5.10 (#90)
012c230 5.0.4
243c491 Fix handling of brackets. Closes #87
609f858 Correct incorrect brace-expansion import (#89)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates express-rate-limit from 8.2.1 to 8.5.2

Release notes

Sourced from express-rate-limit's releases.

v8.5.2

You can view the changelog here.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

v8.4.1

You can view the changelog here.

v8.4.0

You can view the changelog here.

v8.3.2

You can view the changelog here.

v8.3.1

You can view the changelog here.

v8.3.0

You can view the changelog here.

Commits

9774693 8.5.2
0e94cc0 v8.5.2 changelog
9a583c5 feat: simplify IPv6 key generation (#633)
4f4b3fb chore(deps-dev): bump lint-staged from 16.4.0 to 17.0.4 (#632)
3c1d6c5 chore(deps-dev): bump the development-dependencies group with 7 updates (#631)
18884b6 chore(deps): bump basic-ftp from 5.2.0 to 5.3.1 (#630)
dacc980 chore(deps): bump handlebars from 4.7.8 to 4.7.9 (#629)
486d0c6 chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#627)
50cc3f6 8.5.1
92c8e3e chore: bump ip-address library to latest (#626)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.

Updates fast-uri from 3.1.0 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

Fix for GHSA-q3j6-qgpj-74h6

What's Changed

build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in fastify/fast-uri#148

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in fastify/fast-uri#149

chore(.npmrc): ignore scripts by @Fdawgs in fastify/fast-uri#150

build(deps-dev): remove @fastify/pre-commit by @Fdawgs in fastify/fast-uri#151

build(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in fastify/fast-uri#152

ci(ci): add concurrency config by @Fdawgs in fastify/fast-uri#153

build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in fastify/fast-uri#154

build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in fastify/fast-uri#156

chore(license): standardise license notice by @Fdawgs in fastify/fast-uri#159

style: remove trailing whitespace by @Fdawgs in fastify/fast-uri#161

ci: remove unused github files by @Tony133 in fastify/fast-uri#162

chore: update readme by @Tony133 in fastify/fast-uri#164

build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#165

build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#166

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in fastify/fast-uri#167

ci: add lock-threads workflow by @Fdawgs in fastify/fast-uri#169

New Contributors

@Tony133 made their first contribution in fastify/fast-uri#162

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

Commits

919dd8e Bumped v3.1.2
c65ba57 fixup: linting
6c86c17 Merge commit from fork
a95158a Handle malformed fragment decoding without throwing (#171)
cea547c Bumped v3.1.1
876ce79 Merge commit from fork
dcdf690 ci: add lock-threads workflow (#169)
c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
9b4c6dc build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)
85d09a9 build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
Additional commits viewable in compare view

Updates flatted from 3.3.3 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
2a02dce 3.4.1
fba4e8f Merge pull request #89 from WebReflection/python-fix
5fe8648 added "when in Rome" also a test for PHP
53517ad some minor improvement
b3e2a0c Fixing recursion issue in Python too
c4b46db Add SECURITY.md for security policy and reporting
f86d071 Create dependabot.yml for version updates
Additional commits viewable in compare view

Updates follow-redirects from 1.15.11 to 1.16.0

Commits

0c23a22 Release version 1.16.0 of the npm package.
844c4d3 Add sensitiveHeaders option.
5e8b8d0 ci: add Node.js 24.x to the CI matrix
7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
86dc1f8 Sanitizing input.
See full diff in compare view

Updates hono from 4.12.5 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

fix(route): preserve the base path of the mounted route() app by @usualoma in honojs/hono#4942

fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in honojs/hono#4947

New Contributors

@ashunar0 made their first contribution in honojs/hono#4947

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

ci: pin GitHub Actions to SHAs by @yusukebe in honojs/hono#4932

fix(serveStatic): make options parameter optional in all adapters by @mixelburg in honojs/hono#4934

fix(cookie): return the first cookie when there are multiple cookies with the same name by @usualoma in honojs/hono#4922

feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by @justinnais in honojs/hono#4913

feat(cache): key cache entries by configured vary headers by @usualoma in honojs/hono#4915

feat(request): add bytes() by @yusukebe in honojs/hono#4921

fix(stream): upgrade @hono/node-server to v2 and fix abort handling by @yusukebe in honojs/hono#4940

New Contributors

@justinnais made their first contribution in honojs/hono#4913

Full Changelog: honojs/hono@v4.12.18...v4.12.19

... (truncated)

Commits

a83ddb8 4.12.21
6cbb025 Merge commit from fork
c831020 Merge commit from fork
905aedb Merge commit from fork
5463db2 Merge commit from fork
c657a39 4.12.20
eb2d0c2 fix(jsx): widen jsx and jsxFn children to Child[] (#4947)
dcabbec fix(route): preserve the base path of the mounted route() app (#4942)
7e62bcd 4.12.19
e2f252a fix(stream): upgrade @hono/node-server to v2 and fix abort handling (#4940)
Additional commits viewable in compare view

Updates ip-address from 10.0.1 to 10.2.0

Commits

See full diff in compare view

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)
Description has been truncated

…pdates Bumps the npm_and_yarn group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.10` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.11` | `2.0.3` | | [axios](https://github.com/axios/axios) | `1.13.6` | `1.16.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `5.0.6` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.2.1` | `8.5.2` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [hono](https://github.com/honojs/hono) | `4.12.5` | `4.12.21` | | [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `6.3.0` | `8.4.2` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `4.0.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `7.3.3` | | [ws](https://github.com/websockets/ws) | `8.19.0` | `8.20.1` | Updates `postcss` from 8.5.6 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.10) Updates `@hono/node-server` from 1.19.11 to 2.0.3 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.11...v2.0.3) Updates `axios` from 1.13.6 to 1.16.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.6...v1.16.1) Updates `brace-expansion` from 1.1.12 to 5.0.6 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v5.0.6) Updates `express-rate-limit` from 8.2.1 to 8.5.2 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.2.1...v8.5.2) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `hono` from 4.12.5 to 4.12.21 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.5...v4.12.21) Updates `ip-address` from 10.0.1 to 10.2.0 - [Commits](https://github.com/beaugunderson/ip-address/commits) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `path-to-regexp` from 6.3.0 to 8.4.2 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v6.3.0...v8.4.2) Updates `picomatch` from 2.3.1 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...4.0.4) Updates `vite` from 6.4.1 to 7.3.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.3/packages/vite) Updates `ws` from 8.19.0 to 8.20.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.19.0...8.20.1) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 2.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express-rate-limit dependency-version: 8.5.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 8.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.20.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

bntvllnt · 2026-05-19T16:41:44Z

Closing this aggregate Dependabot batch as superseded by the narrow, issue-linked remediation lanes already in flight: #360, #364, #365, and #367.

Rationale:

this aggregate overlaps those scoped security dependency PRs but does not replace their issue-linked remediation path;
this PR has no accepted repo issue reference, so it fails the PR issue-link gate;
the build/deploy jobs are blocked in the Dependabot context at docker login (Username and password required) rather than providing new source validation evidence.

Keeping the narrower PRs as the review/approval path avoids mixing unrelated dependency drift into the security remediation wave.

dependabot · 2026-05-19T16:41:48Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026

bntvllnt closed this May 19, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-53deabbcba branch May 19, 2026 16:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates#374

chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates#374
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-53deabbcba

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

bntvllnt commented May 19, 2026

Uh oh!

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 19, 2026

8.5.10

8.5.9

8.5.8

8.5.7

8.5.10

8.5.9

8.5.8

8.5.7

v2.0.3

What's Changed

New Contributors

v2.0.2

What's Changed

v2.0.1

What's Changed

New Contributors

v2.0.0

The Hono Node.js adapter is now up to 2.3x faster

v2

What does the Node.js adapter do?

v1.16.1 — May 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.16.0 — May 2, 2026

⚠️ Notable Changes

Changelog

v1.16.0 — May 2, 2026

⚠️ Notable Changes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v4.0.1

v4.0.0

v3.0.1

v3.0.0

v2.0.2

v8.5.2

v8.5.1

v8.5.0

v8.4.1

v8.4.0

v8.3.2

v8.3.1

v8.3.0

v3.1.2

⚠️ Security Release

What's Changed

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

v4.12.21

Security fixes

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

IP Restriction bypasses static deny rules for non-canonical IPv6

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

JWT middleware accepts any Authorization scheme, not only Bearer

v4.12.20

What's Changed

New Contributors

v4.12.19

What's Changed

New Contributors

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

Uh oh!

bntvllnt commented May 19, 2026

Uh oh!

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

Reviewers