build(deps): bump the npm-minor-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #11 · diegoarff/MemosNotify

dependabot · 2026-09-03T20:16:21Z

Bumps the npm-minor-patch group with 9 updates in the / directory:

Package	From	To
@hono/node-server	`2.0.5`	`2.1.1`
@hono/zod-validator	`0.8.0`	`0.9.1`
grammy	`1.44.0`	`1.46.0`
hono	`4.12.26`	`4.13.5`
zod	`4.4.3`	`4.5.4`
oxfmt	`0.55.0`	`0.65.0`
oxlint	`1.70.0`	`1.80.0`
tsdown	`0.22.3`	`0.22.14`
vitest	`4.1.9`	`4.1.11`

Updates @hono/node-server from 2.0.5 to 2.1.1

Release notes

Sourced from @hono/node-server's releases.

v2.1.1

What's Changed

perf: lazily materialize request headers by @BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

feat: add Early Hints (HTTP 103) middleware by @bilal-azam in honojs/node-server#378

fix(listener): avoid uncaught error when force-closing a non-standard socket by @mohamedramadan14 in honojs/node-server#383

New Contributors

@bilal-azam made their first contribution in honojs/node-server#378

@mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

test: replace supertest by @BlankParticle in honojs/node-server#379

fix(response): copy headers when init is a foreign Response by @yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

test: use a custom helper for path traversal tests by @BlankParticle in honojs/node-server#377

perf(request): fast-path QUERY methods by @usualoma in honojs/node-server#376

perf(request): fast-path PATCH method by @yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

73c03ad 2.1.1
5515aa0 perf: lazily materialize request headers (#389)
82ba34e 2.1.0
1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
977a242 feat: add Early Hints (HTTP 103) middleware (#378)
a813b6c 2.0.12
caf48ba fix(response): copy headers when init is a foreign Response (#382)
3b1dd68 test: replace supertest (#379)
834e54f 2.0.11
ba72bcd perf(request): fast-path PATCH method (#380)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates @hono/zod-validator from 0.8.0 to 0.9.1

Release notes

Sourced from @hono/zod-validator's releases.

@hono/zod-validator@0.9.1

Patch Changes

#2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

@hono/zod-validator@0.9.0

Minor Changes

#2038 7bc11dffa7dd5b639c614b12c34bd76722d76354 Thanks @yusukebe! - Use InferInput from hono/validator instead of a local copy to avoid duplication (requires hono >=4.11.2)

Changelog

Sourced from @hono/zod-validator's changelog.

0.9.1

Patch Changes

#2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

0.9.0

Minor Changes

#2038 7bc11dffa7dd5b639c614b12c34bd76722d76354 Thanks @yusukebe! - Use InferInput from hono/validator instead of a local copy to avoid duplication (requires hono >=4.11.2)

Commits

8de0f1e Version Packages (#2114)
51b7f97 perf(zod-validator): Caching the key mapping table of the header scheme (#2112)
40f956e chore(dev-deps): partial upgrade to TypeScript 7 (#2048)
70623e3 Version Packages (#2037)
7bc11df fix(zod-validator): Use InferInput from hono/validator instead of a local...
5e32c00 chore: migrate to pnpm (#2006)
c5ba38b chore(deps-dev): bump tsdown from 0.22.2 to 0.22.3 (#1996)
f89ea30 chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 (#1866)
bf845ad chore: unblock TypeScript v6 (#1937)
2cbc5f0 chore(deps-dev): bump tsdown to 0.22.2 (#1908)
Additional commits viewable in compare view

Updates grammy from 1.44.0 to 1.46.0

Release notes

Sourced from grammy's releases.

v1.46.0

What's Changed

fix: prevent memory buildup by unregistering signals by @KnorpelSenf in grammyjs/grammY#934

fix: increase robustness for future error handling changes by @KnorpelSenf in grammyjs/grammY#963

feat: support Bot API 10.3 by @KnorpelSenf in grammyjs/grammY#964

Full Changelog: grammyjs/grammY@v1.45.1...v1.46.0

v1.45.1

What's Changed

fix: bad subscription narrowing by @KnorpelSenf in grammyjs/grammY#923

Full Changelog: grammyjs/grammY@v1.45.0...v1.45.1

v1.45.0

What's Changed

fix(platform): set default fetch duplex to "half" for all API requests by @KnightNiwrem in grammyjs/grammY#913

feat: support Bot API 10.2 by @KnorpelSenf in grammyjs/grammY#921

fix: narrow down ctx.subscription by @KnorpelSenf in grammyjs/grammY#922

Full Changelog: grammyjs/grammY@v1.44.0...v1.45.0

Commits

055a5a4 1.46.0
53cc4e3 feat: support Bot API 10.3 (#964)
10599f0 fix: increase robustness for future error handling changes (#963)
99c780f docs: add @roshda as a contributor for code, and test (#946)
843f820 docs: update contributor information (#936)
7b2cacd fix: prevent memory buildup by unregistering signals (#934)
9f70bb1 test: migrate seed-dependent payload fixtures to snapshot testing (#933)
1f3e064 docs: update contributor information (#932)
94808e8 fix: update-contributors workflow (#926)
08df850 test: update fixtures after V8 upgrade (#931)
Additional commits viewable in compare view

Updates hono from 4.12.26 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)

e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema

87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines

99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)

e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open

7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar

eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)

d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)

212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)

e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)

fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator

6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)

6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution

019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates

652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller

571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card

9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm

8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.
npm install zod@latest
At a glance:

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

... (truncated)

Commits

e8e206f 4.5.4
84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
1a16102 4.5.3
eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
e3a695b docs(v4): record the email regex and container output-shape findings under Open
99fce39 bench(v4): z.compile() against zod-compiler (#6499)
87d6464 fix(docs): drop the OG description when the title wraps past two lines
e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
9a193aa 4.5.2
Additional commits viewable in compare view

Updates oxfmt from 0.55.0 to 0.65.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[0.64.0] - 2026-08-18

🚀 Features

c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

Commits

97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
fed6681 docs(oxfmt): skip expanding overrides options (#25572)
c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
00f490d refactor(oxfmt,formatter): split sortImports validation and use type enum (...
9a423f2 release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (#25251)
e6e584b fix(oxfmt): type jsdoc. enum options (#25008)
65fe65d release(apps): oxlint v1.76.0 && oxfmt v0.61.0 (#24976)
83abe3b release(apps): oxlint v1.75.0 && oxfmt v0.60.0 (#24713)
Additional commits viewable in compare view

Updates oxlint from 1.70.0 to 1.80.0

Release notes

Sourced from oxlint's releases.

oxlint v1.80.0 & oxfmt v0.65.0

Table of Contents

Oxlint v1.80.0

Oxfmt v0.65.0

Oxlint v1.80.0

🚀 Features

70c3e35 linter/typescript/no-confusing-non-null-assertion: Implement suggestion (#26012) (Mikhail Baev)

🐛 Bug Fixes

17ae11c linter/oxc/double-comparisons: Handle grouped logical expressions (#26044) (camc314)

8a353a7 linter/eslint/no-control-regex: Refine help message text (#25996) (Rahul Mishra)

8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)

8d94cd1 linter/eslint/no-useless-rename: Preserve type modifiers (#26020) (Cameron)

2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)

51d36d7 linter/vue: Resolve vue imports via shared import helpers (#25903) (Connor Shea)

83a68d2 linter/react/no-react-children: Resolve react imports by symbol (#25901) (Connor Shea)

124e196 linter: Resolve globals by reference, not by name (#25905) (Connor Shea)

a701bcc linter: Remove invalid React compiler doc links (#25900) (Boshen)

📚 Documentation

9b7e153 linter: Set version to 1.79.0 for rules shipped in 1.79.0 (#25902) (connorshea)

Oxfmt v0.65.0

🐛 Bug Fixes

bf37dd5 formatter: Preserve class decorators before export when the statement is suppressed (#26034) (leaysgur)

oxlint v1.79.0 & oxfmt v0.64.0

Table of Contents

Oxlint v1.79.0

Oxfmt v0.64.0

Oxlint v1.79.0

💥 BREAKING CHANGES

8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

See React Compiler Support for details.

🚀 Features

9b7394e linter/typescript/no-empty-object-type: Implement suggestion (#25833) (Mikhail Baev)

🐛 Bug Fixes

... (truncated)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.81.0] - 2026-08-31

📚 Documentation

d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)

aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)

36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)

beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)

4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)

285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)

4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)

d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)

5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

... (truncated)

Commits

97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
aa49d86 fix(linter): allow spread rule options in config types (#25675)
8922381 refactor(linter): remove inactive react config rule (#25740)
8c4552d feat(linter)!: split react/react-compiler into per-category rules (#25500)
36f8451 fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)
beb724d fix(linter/eslint/no-unused-vars): report bare underscore parameters (#25663)
4004c10 fix(linter/eslint/no-irregular-whitespace): check comments by default (#25660)
285820e fix(linter/no-large-snapshots): precompile and document allowed snapshot matc...
Additional commits viewable in compare view

Updates tsdown from 0.22.3 to 0.22.14

Release notes

Sourced from tsdown's releases.

v0.22.14

   🚀 Features

Add CLI build concurrency option - by @sxzz and Jeroen Zwartepoorte (8a14c)

    View changes on GitHub

v0.22.13

   🚀 Features

deps: Support neverBundle: true to externalize all dependencies - by @sxzz (d30a7)

   🐞 Bug Fixes

Prevent tinyexec from modifying PATH - by @sxzz (d84c5)

    View changes on GitHub

v0.22.12

   🚨 Breaking Changes

exe: Standardize minimum Node.js version - by @sxzz (85f23)

    View changes on GitHub

v0.22.11

   🚀 Features

deps: Add resolveDepSubpath option - by @sxzz in rolldown/tsdown#1026 (346cb)

    View changes on GitHub

v0.22.10

   🚀 Features

exe: Support custom node index and download url - by @anytinz in rolldown/tsdown#1023 (0d24a)

   🐞 Bug Fixes

deps: External peerDependenciesMeta deps - by @sxzz (bad1b)

exe: Handle Windows node archives on Linux - by @sxzz (074e4)

    View changes on GitHub

v0.22.9

   🚀 Features

Upgrade rolldown to v1.2 - by @sxzz (91bb5)

   🐞 Bug Fixes

... (truncated)

Commits

ff3bdbd chore: release v0.22.14
8a14c35 feat: add CLI build concurrency option
0525465 docs: add note about cjsDefault only applying to explicit entry modules
a3a3551 refactor: fix lint
3dec506 refactor: use native Promise.withResolvers
e0266c1 docs: add tsdown users image

… updates Bumps the npm-minor-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.5` | `2.1.1` | | [@hono/zod-validator](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator) | `0.8.0` | `0.9.1` | | [grammy](https://github.com/grammyjs/grammY) | `1.44.0` | `1.46.0` | | [hono](https://github.com/honojs/hono) | `4.12.26` | `4.13.5` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.55.0` | `0.65.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.70.0` | `1.80.0` | | [tsdown](https://github.com/rolldown/tsdown) | `0.22.3` | `0.22.14` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.11` | Updates `@hono/node-server` from 2.0.5 to 2.1.1 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.5...v2.1.1) Updates `@hono/zod-validator` from 0.8.0 to 0.9.1 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-validator/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/zod-validator@0.9.1/packages/zod-validator) Updates `grammy` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/grammyjs/grammY/releases) - [Commits](grammyjs/grammY@v1.44.0...v1.46.0) Updates `hono` from 4.12.26 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.26...v4.13.5) Updates `zod` from 4.4.3 to 4.5.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.4) Updates `oxfmt` from 0.55.0 to 0.65.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.65.0/npm/oxfmt) Updates `oxlint` from 1.70.0 to 1.80.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.80.0/npm/oxlint) Updates `tsdown` from 0.22.3 to 0.22.14 - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.22.3...v0.22.14) Updates `vitest` from 4.1.9 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@hono/zod-validator" dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: grammy dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: zod dependency-version: 4.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: oxfmt dependency-version: 0.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: oxlint dependency-version: 1.80.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: tsdown dependency-version: 0.22.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-10T20:15:41Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Docker / Images label Sep 3, 2026

dependabot Bot closed this Sep 10, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-47e574b904 branch September 10, 2026 20:15

Navigation Menu

Repository navigation

build(deps): bump the npm-minor-patch group across 1 directory with 9 updates - #11

build(deps): bump the npm-minor-patch group across 1 directory with 9 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-47e574b904

dependabot Bot commented on behalf of github Sep 3, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.1.1

What's Changed

v2.1.0

What's Changed

New Contributors

v2.0.12

What's Changed

v2.0.11

What's Changed

v2.0.10

Security fixes

Unauthenticated memory-leak DoS via aborted WebSocket handshake

v2.0.9

What's Changed

@​hono/zod-validator@​0.9.1

Patch Changes

@​hono/zod-validator@​0.9.0

Minor Changes

0.9.1

Patch Changes

0.9.0

Minor Changes

v1.46.0

What's Changed

v1.45.1

What's Changed

v1.45.0

What's Changed

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.13.3

What's Changed

v4.5.4

Commits:

v4.5.3

Commits:

v4.5.2

Commits:

v4.5.1

Commits:

v4.5.0

Changelog

[0.64.0] - 2026-08-18

🚀 Features

📚 Documentation

[0.62.0] - 2026-08-03

🐛 Bug Fixes

[0.59.0] - 2026-07-13

🐛 Bug Fixes

oxlint v1.80.0 & oxfmt v0.65.0

Table of Contents

Oxlint v1.80.0

🚀 Features

🐛 Bug Fixes

📚 Documentation

Oxfmt v0.65.0

🐛 Bug Fixes

oxlint v1.79.0 & oxfmt v0.64.0

Table of Contents

Oxlint v1.79.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

Changelog

[1.81.0] - 2026-08-31

📚 Documentation

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

🐛 Bug Fixes

[1.78.0] - 2026-08-10

🚀 Features

🐛 Bug Fixes

dependabot Bot commented on behalf of github Sep 3, 2026 •

edited

Loading

`@hono/zod-validator@0`.9.1

`@hono/zod-validator@0`.9.0

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion