chore(deps): Bump the npm_and_yarn group across 1 directory with 9 updates by dependabot[bot] · Pull Request #61 · anchildress1/commit-chronicles

dependabot · 2026-10-25T03:46:11Z

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
hono	`4.13.7`	`4.13.13`
vite	`8.2.2`	`8.3.5`
@grpc/grpc-js	`1.14.4`	`1.14.6`
axios	`1.18.1`	`1.20.0`
brace-expansion	`5.0.9`	`5.0.12`
follow-redirects	`1.16.0`	`1.16.1`
shell-quote	`1.9.0`	`1.12.0`
source-map-js	`1.2.1`	`1.2.2`
toml	`3.0.0`	`5.0.1`

Updates hono from 4.13.7 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():
import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))
app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:
- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))
What's Changed

test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439

docs(request): fix jsdoc comments for some getters in honojs/hono#5445

fix(jsx): allow JSXNode function component results in honojs/hono#5476

feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485

test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486

fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475

fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487

fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391

chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits

08a023c 4.13.13
ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
f23b146 fix(jsx): allow JSXNode function component results (#5476)
6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
deff529 test(client): simulate network error for undefined route in parseResponse tes...
6abd35b 4.13.12
95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
Additional commits viewable in compare view

Updates vite from 8.2.2 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

build: handle missing chunk import maps (#23777) (8d7623d)

build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)

bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)

bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)

bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)

bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)

bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

bundled-dev: normalize served output files (#23684) (df4e02c)

bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)

css: don't fail on a literal % in url() (#23676) (50b382d)

deps: update all non-major dependencies (#23731) (cf80aa5)

deps: update all non-major dependencies (#23826) (77d8373)

deps: update rolldown-related dependencies (#23733) (43f0d05)

deps: update rolldown-related dependencies (#23827) (c2e0418)

optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)

optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)

optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)

optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)

resolve: support subpath imports with multiple # (#23631) (0d86b34)

resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)

server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)

server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

migrate to Oxlint (#23746) (5b73935)

Code Refactoring

deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)

dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)

dev: separate import resolution from URL conversion (#23791) (6116689)

dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)

dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

build: handle missing chunk import maps (#23777) (8d7623d)

build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)

bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)

bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)

bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)

bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)

bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

bundled-dev: normalize served output files (#23684) (df4e02c)

bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)

css: don't fail on a literal % in url() (#23676) (50b382d)

deps: update all non-major dependencies (#23731) (cf80aa5)

deps: update all non-major dependencies (#23826) (77d8373)

deps: update rolldown-related dependencies (#23733) (43f0d05)

deps: update rolldown-related dependencies (#23827) (c2e0418)

optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)

optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)

optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)

optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)

resolve: support subpath imports with multiple # (#23631) (0d86b34)

resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)

server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)

server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

migrate to Oxlint (#23746) (5b73935)

Code Refactoring

deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)

dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)

dev: separate import resolution from URL conversion (#23791) (6116689)

dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)

dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Commits

981f07f release: v8.3.5 (#23856)
0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
6116689 refactor(dev): separate import resolution from URL conversion (#23791)
446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.14.4 to 1.14.6

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.14.6

Address remaining instances of advisory GHSA-f596-whhp-79r4 (#3105)

Avoid Date allocations on request and channelz tracking paths (#3090 contributed by @olavloite)

Avoid throwaway timer allocation in ResolvingCall (#3092 contributed by @olavloite)

Avoid building metadata map when parsing trailers (#3093 contributed by @olavloite)

Lazily allocate Metadata opaqueData map (#3095 contributed by @olavloite)

Cache precomputed serviceUrl in InternalChannel (#3097 contributed by @olavloite)

Memoize method config lookup in default config selector (#3098 contributed by @olavloite)

Avoid array allocation for single-value metadata headers (#3099 contributed by @olavloite)

Avoid allocations for empty CallCredentials on the RPC hot path (#3100 contributed by @olavloite)

Avoid redundant metadata clone in RetryingCall on initial attempt (#3101 contributed by @olavloite)

@grpc/grpc-js 1.14.5

Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)

Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)

Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#3078)

Fix a bug that could cause call status to be reported with expected fields missing (#3079)

Avoid redundant end() calls on completed HTTP/2 streams (#3082 contributed by @olavloite)

Unify call numbers and avoid disabled trace allocations (#3084 contributed by @olavloite)

Commits

c63ed15 Merge pull request #3105 from murgatroid99/grpc-js_error_details_1.14
025cc24 Merge pull request #3107 from olavloite/backport-perf-to-1.14.x
9b50778 grpc-js: Increment version to 1.14.6
1126061 grpc-js: Don't transmit error details by default in server interceptors
40b61a0 perf(grpc-js): avoid allocations for empty CallCredentials on the RPC hot pat...
aed1745 test(grpc-js): stabilize weighted round robin tests on slow runners (#3104)
8db8a06 perf(grpc-js): avoid redundant metadata clone in RetryingCall on initial atte...
2aa8b88 perf(grpc-js): memoize method config lookup in default config selector (#3098)
e4ccd66 perf(grpc-js): cache precomputed serviceUrl in InternalChannel (#3097)
17c61a5 test(grpc-js): fix Windows CI test failures (#3094)
Additional commits viewable in compare view

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

... (truncated)

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Updates brace-expansion from 5.0.9 to 5.0.12

Commits

f341015 5.0.12
33a5ef1 Merge commit from fork
8247927 5.0.11
935d78f Merge commit from fork
df7682f 5.0.10
1ade9de npm run format
6735c94 Merge commit from fork
4e70465 chore: ensure prettier formatting (#154)
fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
1790143 Bump uuid and @tapjs/processinfo (#120)
See full diff in compare view

Updates follow-redirects from 1.16.0 to 1.16.1

Commits

4630125 Release version 1.16.1 of the npm package.
9865ca4 Support key/value header arrays.
080a76d Escape all RegExp modifiers.
See full diff in compare view

Updates shell-quote from 1.9.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

[New] parse: support here-documents (<<) [#31](https://github.com/ljharb/shell-quote/issues/31)

Commits

[New] parse: support tab-stripping here-documents (<<-) dbfac37

[New] parse: support output process substitution (>() 2053315

[New] parse: support the case test-next terminator (;;&) 7d688b9

[New] parse: support the case fall-through terminator (;&) f27010e

[New] parse: support redirecting output despite noclobber (>|) b78d19c

[New] parse: support opening a file for reading and writing (<>) 21cc333

[New] parse: support redirecting stdout and stderr (&>) 6ad6cd2

[New] parse: support appending stdout and stderr (&>>) 90cde9c

[Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

[Refactor] quote: drop a replace that can never match in the single-quote branch [#15](https://github.com/ljharb/shell-quote/issues/15)

[New] parse: support bash ANSI-C quoting ($'...') [#32](https://github.com/ljharb/shell-quote/issues/32)

Commits

[Fix] quote: reject line terminators in tokens after a comment 6002b2e

[Fix] parse: preserve text after special shell parameters 81b08a5

[Fix] parse: an escaped backslash does not escape the character after it d708019

[Fix] quote: preserve ! in arguments that also contain ' ad39927

[Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd

[Fix] quote: preserve empty glob patterns 35c9b97

[Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e

[meta] npmignore some files ebfc308

[actions] add permissions 3429b0d

[actions] set least-privilege cache-mode 36f2394

[Dev Deps] update eslint 6de9a41

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

... (truncated)

Commits

6ecb8aa v1.12.0
3a7b4ae [Dev Deps] update @ljharb/eslint-config
7d688b9 [New] parse: support the case test-next terminator (;;&)
f27010e [New] parse: support the case fall-through terminator (;&)
90cde9c [New] parse: support appending stdout and stderr (&>>)
6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
2053315 [New] parse: support output process substitution (>()
b78d19c [New] parse: support redirecting output despite noclobber (>|)
21cc333 [New] parse: support opening a file for reading and writing (\<>)
dbfac37 [New] parse: support tab-stripping here-documents (<<-)
Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when execut...
Description has been truncated

…dates Bumps the npm_and_yarn group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.13` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.5` | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.14.4` | `1.14.6` | | [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.9` | `5.0.12` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.1` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.9.0` | `1.12.0` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [toml](https://github.com/BinaryMuse/toml-node) | `3.0.0` | `5.0.1` | Updates `hono` from 4.13.7 to 4.13.13 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.7...v4.13.13) Updates `vite` from 8.2.2 to 8.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite) Updates `@grpc/grpc-js` from 1.14.4 to 1.14.6 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.4...@grpc/grpc-js@1.14.6) Updates `axios` from 1.18.1 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.20.0) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.9...v5.0.12) Updates `follow-redirects` from 1.16.0 to 1.16.1 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.1) Updates `shell-quote` from 1.9.0 to 1.12.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.9.0...v1.12.0) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `toml` from 3.0.0 to 5.0.1 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v3.0.0...v5.0.1) --- updated-dependencies: - dependency-name: hono dependency-version: 4.13.13 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.3.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.20.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.12.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: toml dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2026-10-25T03:47:14Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

sonarqubecloud · 2026-10-25T03:47:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot requested a review from anchildress1 as a code owner October 25, 2026 03:46

dependabot Bot added dependencies javascript labels Oct 25, 2026

Navigation Menu

Repository navigation

chore(deps): Bump the npm_and_yarn group across 1 directory with 9 updates - #61

chore(deps): Bump the npm_and_yarn group across 1 directory with 9 updates#61
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-76ed413ad5

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

codecov Bot commented Oct 25, 2026

Uh oh!

sonarqubecloud Bot commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 25, 2026

v4.13.13

Mount Middleware

What's Changed

v4.13.12

What's Changed

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

v8.3.5

Bug Fixes

Performance Improvements

Miscellaneous Chores

Code Refactoring

v8.3.4

Features

Bug Fixes

8.3.5 (2026-10-21)

Bug Fixes

Performance Improvements

Miscellaneous Chores

Code Refactoring

8.3.4 (2026-10-08)

Features

Bug Fixes

@​grpc/grpc-js 1.14.6

@​grpc/grpc-js 1.14.5

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 - July 22, 2026

🔒 Security Fixes

Changelog

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.12.0 - 2026-10-02

Fixed

Commits

v1.11.0 - 2026-09-29

Fixed

Commits

v1.10.0 - 2026-07-10

Merged

Commits

v1.2.2

1.2.2

Uh oh!

codecov Bot commented Oct 25, 2026

Codecov Report

Uh oh!

sonarqubecloud Bot commented Oct 25, 2026

Quality Gate passed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

`@grpc/grpc-js` 1.14.6

`@grpc/grpc-js` 1.14.5