build(deps): bump the npm_and_yarn group across 5 directories with 12 updates by dependabot[bot] · Pull Request #1833 · modelcontextprotocol/inspector

dependabot · 2026-07-28T04:00:49Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
hono	`4.12.25`	`4.12.32`
brace-expansion	`1.1.16`	`5.0.8`
body-parser	`2.2.2`	`2.3.0`
fast-uri	`3.1.0`	`3.1.4`
ip-address	`10.1.0`	`10.3.1`

Bumps the npm_and_yarn group with 9 updates in the /clients/web directory:

Package	From	To
hono	`4.12.18`	`4.12.32`
vite	`8.0.0`	`8.0.16`
brace-expansion	`1.1.12`	`1.1.16`
body-parser	`2.2.2`	`2.3.0`
fast-uri	`3.1.0`	`3.1.4`
flatted	`3.4.1`	`3.4.3`
ip-address	`10.1.0`	`10.3.1`
js-yaml	`4.1.1`	`4.3.0`
ws	`8.19.0`	`8.21.1`

Bumps the npm_and_yarn group with 3 updates in the /clients/tui directory: brace-expansion, fast-uri and js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /clients/launcher directory: brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /clients/cli directory: brace-expansion, body-parser, fast-uri and js-yaml.

Updates hono from 4.12.25 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

test(context): assert case-insensitive header names in response helpers by @yusukebe in honojs/hono#5116

chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in honojs/hono#5117

refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in honojs/hono#5130

fix(utils/body): reuse cached formData in parseBody() by @yusukebe in honojs/hono#5131

fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in honojs/hono#5133

fix(sse): emit retry feild when retry is 0 by @yusukebe in honojs/hono#5135

test(validator): fix misspelled identifier in transform type test by @yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

chore(benchmark/routers): bump deps in honojs/hono#5107

chore(benchmark): remove not used benchmarks in honojs/hono#5108

chore: update to ts6 in prep for ts7 in honojs/hono#5104

fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025

fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020

fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096

fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in honojs/hono#5092

chore: fix no-op tsc in test script by @yusukebe in honojs/hono#5093

fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in honojs/hono#5094

docs(language): add JSDoc @example to languageDetector by @codebybilal18 in honojs/hono#5081

test(workerd): add compatibilityDate by @yusukebe in honojs/hono#5100

fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in honojs/hono#5099

fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in honojs/hono#5101

fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in honojs/hono#5103

fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in honojs/hono#5102

fix(etag): treat If-None-Match: * as a match by @yusukebe in honojs/hono#5084

New Contributors

@codebybilal18 made their first contribution in honojs/hono#5081

... (truncated)

Commits

26d8e42 4.12.32
402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
bf8608c ci: enable reports for type & bundle size check (#5148)
cadff88 4.12.31
64c613a test(validator): fix misspelled identifier in transform type test (#5136)
aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates brace-expansion from 1.1.16 to 5.0.8

Release notes

Sourced from brace-expansion's releases.

v4.0.1

fmt 5a5cc17

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

feat: use string replaces instead of splits (#64) 278132b

fmt dd72a59

add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

pkg: publish on tag 3.x 3059c07

fmt 8229e6f

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8

added jsdoc (#55) 68c0e37

node 16 is EOL 9e781e9

add standard 3494c4d

use const and let (#57) dd5a4cb

docs 6dad209

remove test e3dd8ae

ci: update node versions d23ede9

docs: add @lanodan to contributors 1eb3fa4

docs 1e7c9cd

switch from tape to test module (#60) 2520537

Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1

Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf

docs: add back ci badge 8ee5626

Add github actions, remove travis. Closes #52 (#53) 5c8756a

CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.1.1

Backport v5.0.6 change to v2 (#109) c3a817c

... (truncated)

Commits

96a63c0 5.0.8
a1bd339 Merge commit from fork
592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
5bf809e Remove Node.js 18 support (#110)
8cb5716 Bump markdown-it from 14.1.0 to 14.2.0 (#113)
43122df Bump sigstore from 4.1.0 to 4.1.1 (#119)
69bd65a Bump @sigstore/verify from 3.1.0 to 3.1.1 (#118)
b3bfbf0 Bump @sigstore/core from 3.1.0 to 3.2.1 (#117)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#681

build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in expressjs/body-parser#682

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/body-parser#683

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#685

build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @dependabot[bot] in expressjs/body-parser#684

perf(urlencoded): move empty-body guard to avoid extra function closure by @Phillip9587 in expressjs/body-parser#647

Improve ESM compatibility by @Phillip9587 in expressjs/body-parser#697

docs: add recommendations for configuring payload limits by @bjohansebas in expressjs/body-parser#699

build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in expressjs/body-parser#701

build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @dependabot[bot] in expressjs/body-parser#702

build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in expressjs/body-parser#700

chore: add explicit type commonjs to package.json by @Phillip9587 in expressjs/body-parser#711

deps: update dependencies to latest versions by @Phillip9587 in expressjs/body-parser#708

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in expressjs/body-parser#712

build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in expressjs/body-parser#713

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#714

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#698

build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in expressjs/body-parser#719

build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in expressjs/body-parser#718

build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in expressjs/body-parser#717

perf: eliminate conditional check in json strict mode hot path by @Phillip9587 in expressjs/body-parser#651

ci: add node.js 26 to text matrix by @Phillip9587 in expressjs/body-parser#726

build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in expressjs/body-parser#725

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/body-parser#724

build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in expressjs/body-parser#723

Upgrade "content-type" by @blakeembrey in expressjs/body-parser#728

refactor: switch to const/let and enable eslint no-var rule by @Phillip9587 in expressjs/body-parser#729

Update outdated reference to MDN docs by @krzysdz in expressjs/body-parser#730

build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @dependabot[bot] in expressjs/body-parser#731

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/body-parser#732

chore: updated deps to latest by @Phillip9587 in expressjs/body-parser#733

2.3.0 by @UlisesGascon in expressjs/body-parser#735

New Contributors

@krzysdz made their first contribution in expressjs/body-parser#730

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

Security fix for GHSA-v422-hmwv-36x6

fix: use static exports instead of lazy getters to improve ESM compatibility

feat: add subpath exports for individual parsers

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

deps:

content-type@^2.0.0

http-errors@^2.0.1

iconv-lite^0.7.2

qs@^6.15.2

raw-body@^3.0.2

type-is@^2.1.0

Commits

d0f2ace 2.3.0 (#735)
7d03f2f chore: updated deps to latest (#733)
8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
ff0f6b9 docs: update outdated reference to MDN docs (#730)
14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
37f36a2 deps: update content-type and type-is (#728)
e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
Additional commits viewable in compare view

Updates fast-uri from 3.1.0 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

Fix for GHSA-q3j6-qgpj-74h6

What's Changed

build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in fastify/fast-uri#148

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in fastify/fast-uri#149

chore(.npmrc): ignore scripts by @Fdawgs in fastify/fast-uri#150

build(deps-dev): remove @fastify/pre-commit by @Fdawgs in fastify/fast-uri#151

build(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in fastify/fast-uri#152

ci(ci): add concurrency config by @Fdawgs in fastify/fast-uri#153

build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in fastify/fast-uri#154

build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in fastify/fast-uri#156

chore(license): standardise license notice by @Fdawgs in fastify/fast-uri#159

style: remove trailing whitespace by @Fdawgs in fastify/fast-uri#161

ci: remove unused github files by @Tony133 in fastify/fast-uri#162

chore: update readme by @Tony133 in fastify/fast-uri#164

build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#165

build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#166

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in fastify/fast-uri#167

ci: add lock-threads workflow by @Fdawgs in fastify/fast-uri#169

New Contributors

@Tony133 made their first contribution in fastify/fast-uri#162

... (truncated)

Commits

6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
919dd8e Bumped v3.1.2
c65ba57 fixup: linting
6c86c17 Merge commit from fork
a95158a Handle malformed fragment decoding without throwing (#171)
cea547c Bumped v3.1.1
876ce79 Merge commit from fork
Additional commits viewable in compare view

Updates ip-address from 10.1.0 to 10.3.1

Release notes

Sourced from ip-address's releases.

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

be7e626 10.3.1
56368cb Reject octal-ambiguous IPv4 octets and stacked subnet suffixes (GHSA-mwp4-54f...
9ed7949 10.3.0
fd0687e fix: pad Address6#toByteArray to a full 16 bytes
c697eaa fix: Address6.fromURL squelches port 65536 as valid
d46eb43 Fix repository URL protocol
4da4295 Bump vulnerable transitive dev dependencies
f7314db 10.2.2
488fe9b Merge commit from fork
e86ab3e 10.2.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Updates postcss from 8.5.15 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates qs from 6.15.1 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

Commits

18d085e v6.15.3
c38af42 [Deps] update side-channel
adce539 [Dev Deps] update eslint, mock-property, tape
74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
Additional commits viewable in compare view

Updates hono from 4.12.18 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

test(context): assert case-insensitive header names in response helpers by @yusukebe in honojs/hono#5116

chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in honojs/hono#5117

refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in honojs/hono#5130

fix(utils/body): reuse cached formData in parseBody() by @yusukebe in honojs/hono#5131

fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in honojs/hono#5133

fix(sse): emit retry feild when retry is 0 by @yusukebe in honojs/hono#5135

test(validator): fix misspelled identifier in transform type test by @yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

chore(benchmark/routers): bump deps in honojs/hono#5107

chore(benchmark): remove not used benchmarks in honojs/hono#5108

chore: update to ts6 in prep for ts7 in honojs/hono#5104

fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025

fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020

fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096

fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in honojs/hono#5092

chore: fix no-op tsc in test script by @yusukebe in honojs/hono#5093

fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in honojs/hono#5094

docs(language): add JSDoc @example to languageDetector by @codebybilal18 in honojs/hono#5081

test(workerd): add compatibilityDate by @yusukebe in honojs/hono#5100

fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in honojs/hono#5099

fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in honojs/hono#5101

fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in honojs/hono#5103

fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in honojs/hono#5102

fix(etag): treat If-None-Match: * as a match by @yusukebe in honojs/hono#5084

New Contributors

@codebybilal18 made their first contribution in honojs/hono#5081

... (truncated)

Commits

26d8e42 4.12.32
402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
bf8608c ci: enable reports for type & bundle size check (#5148)
cadff88 4.12.31
64c613a test(validator): fix misspelled identifier in transform type test (#5136)
aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates vite from 8.0.0 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md ...
Description has been truncated

… updates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.12.25` | `4.12.32` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `5.0.8` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.4` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.3.1` | Bumps the npm_and_yarn group with 9 updates in the /clients/web directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.12.18` | `4.12.32` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.0` | `8.0.16` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.16` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.4` | | [flatted](https://github.com/WebReflection/flatted) | `3.4.1` | `3.4.3` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.3.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.0` | | [ws](https://github.com/websockets/ws) | `8.19.0` | `8.21.1` | Bumps the npm_and_yarn group with 3 updates in the /clients/tui directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [fast-uri](https://github.com/fastify/fast-uri) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /clients/launcher directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /clients/cli directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [body-parser](https://github.com/expressjs/body-parser), [fast-uri](https://github.com/fastify/fast-uri) and [js-yaml](https://github.com/nodeca/js-yaml). Updates `hono` from 4.12.25 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.12.32) Updates `brace-expansion` from 1.1.16 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v5.0.8) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `fast-uri` from 3.1.0 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.4) Updates `ip-address` from 10.1.0 to 10.3.1 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.1.0...v10.3.1) Updates `postcss` from 8.5.15 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.23) Updates `qs` from 6.15.1 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.15.3) Updates `hono` from 4.12.18 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.12.32) Updates `vite` from 8.0.0 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `brace-expansion` from 1.1.12 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v5.0.8) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `fast-uri` from 3.1.0 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.4) Updates `flatted` from 3.4.1 to 3.4.3 - [Commits](WebReflection/flatted@v3.4.1...v3.4.3) Updates `ip-address` from 10.1.0 to 10.3.1 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.1.0...v10.3.1) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `picomatch` from 4.0.3 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) Updates `postcss` from 8.5.8 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.23) Updates `qs` from 6.15.1 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.15.3) Updates `ws` from 8.19.0 to 8.21.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.19.0...8.21.1) Updates `brace-expansion` from 1.1.15 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v5.0.8) Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.4) Updates `js-yaml` from 4.2.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `postcss` from 8.5.15 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.23) Updates `brace-expansion` from 1.1.15 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v5.0.8) Updates `js-yaml` from 4.2.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `postcss` from 8.5.15 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.23) Updates `brace-expansion` from 1.1.15 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v5.0.8) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.4) Updates `js-yaml` from 4.2.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `postcss` from 8.5.15 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.23) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-28T06:05:13Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026

dependabot Bot closed this Jul 28, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-00021f30c0 branch July 28, 2026 06:05

Navigation Menu

Uh oh!

build(deps): bump the npm_and_yarn group across 5 directories with 12 updates - #1833

build(deps): bump the npm_and_yarn group across 5 directories with 12 updates#1833
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-00021f30c0

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.12.32

What's Changed

v4.12.31

What's Changed

v4.12.30

What's Changed

v4.12.29

What's Changed

New Contributors

v4.0.1

v4.0.0

v3.0.1

v3.0.0

v2.1.1

v2.3.0

Important: Security

What's Changed

New Contributors

2.3.0 / 2026-06-15

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v3.1.2

⚠️ Security Release

What's Changed

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

v10.3.1

v10.3.0

v10.2.2

v10.2.1

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

6.15.3

6.15.2

v4.12.32

What's Changed

v4.12.31

What's Changed

v4.12.30

What's Changed

v4.12.29

What's Changed

New Contributors

v8.0.16

v8.0.15

v8.0.14

v8.0.13

v8.0.12

v8.0.11

v8.0.10

v8.0.9

v8.0.8

v8.0.7

v8.0.6

v8.0.5

Uh oh!

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading