build(deps): bump the npm-minor-patch group across 1 directory with 12 updates by dependabot[bot] · Pull Request #14 · diegoarff/MemosNotify

dependabot · 2026-09-24T20:16:55Z

Bumps the npm-minor-patch group with 12 updates in the / directory:

Package	From	To
@hono/node-server	`2.0.5`	`2.1.1`
@hono/zod-validator	`0.8.0`	`0.9.1`
@libsql/client	`0.17.4`	`0.18.0`
drizzle-orm	`0.45.2`	`0.45.3`
grammy	`1.44.0`	`1.46.0`
hono	`4.12.26`	`4.13.8`
yaml	`2.9.0`	`2.9.1`
zod	`4.4.3`	`4.6.5`
drizzle-kit	`0.31.10`	`0.31.11`
oxfmt	`0.55.0`	`0.70.0`
oxlint	`1.70.0`	`1.85.0`
tsdown	`0.22.3`	`0.23.0`

Updates @hono/node-server from 2.0.5 to 2.1.1

Release notes

Sourced from @hono/node-server's releases.

v2.1.1

What's Changed

perf: lazily materialize request headers by @BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

feat: add Early Hints (HTTP 103) middleware by @bilal-azam in honojs/node-server#378

fix(listener): avoid uncaught error when force-closing a non-standard socket by @mohamedramadan14 in honojs/node-server#383

New Contributors

@bilal-azam made their first contribution in honojs/node-server#378

@mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

test: replace supertest by @BlankParticle in honojs/node-server#379

fix(response): copy headers when init is a foreign Response by @yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

test: use a custom helper for path traversal tests by @BlankParticle in honojs/node-server#377

perf(request): fast-path QUERY methods by @usualoma in honojs/node-server#376

perf(request): fast-path PATCH method by @yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

73c03ad 2.1.1
5515aa0 perf: lazily materialize request headers (#389)
82ba34e 2.1.0
1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
977a242 feat: add Early Hints (HTTP 103) middleware (#378)
a813b6c 2.0.12
caf48ba fix(response): copy headers when init is a foreign Response (#382)
3b1dd68 test: replace supertest (#379)
834e54f 2.0.11
ba72bcd perf(request): fast-path PATCH method (#380)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates @hono/zod-validator from 0.8.0 to 0.9.1

Release notes

Sourced from @hono/zod-validator's releases.

@hono/zod-validator@0.9.1

Patch Changes

#2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

@hono/zod-validator@0.9.0

Minor Changes

#2038 7bc11dffa7dd5b639c614b12c34bd76722d76354 Thanks @yusukebe! - Use InferInput from hono/validator instead of a local copy to avoid duplication (requires hono >=4.11.2)

Changelog

Sourced from @hono/zod-validator's changelog.

0.9.1

Patch Changes

#2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

0.9.0

Minor Changes

#2038 7bc11dffa7dd5b639c614b12c34bd76722d76354 Thanks @yusukebe! - Use InferInput from hono/validator instead of a local copy to avoid duplication (requires hono >=4.11.2)

Commits

8de0f1e Version Packages (#2114)
51b7f97 perf(zod-validator): Caching the key mapping table of the header scheme (#2112)
40f956e chore(dev-deps): partial upgrade to TypeScript 7 (#2048)
70623e3 Version Packages (#2037)
7bc11df fix(zod-validator): Use InferInput from hono/validator instead of a local...
5e32c00 chore: migrate to pnpm (#2006)
c5ba38b chore(deps-dev): bump tsdown from 0.22.2 to 0.22.3 (#1996)
f89ea30 chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 (#1866)
bf845ad chore: unblock TypeScript v6 (#1937)
2cbc5f0 chore(deps-dev): bump tsdown to 0.22.2 (#1908)
Additional commits viewable in compare view

Updates @libsql/client from 0.17.4 to 0.18.0

Commits

9496c78 0.18.0
f336495 fix(sqlite3): settle in-flight operations when the pool is torn down
1174d51 fix(sqlite3): give a client a connection pool, like the hrana clients
05e3344 fix(sqlite3): keep connection handle for in-memory databases across transactions
See full diff in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3 New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
Additional commits viewable in compare view

Updates grammy from 1.44.0 to 1.46.0

Release notes

Sourced from grammy's releases.

v1.46.0

What's Changed

fix: prevent memory buildup by unregistering signals by @KnorpelSenf in grammyjs/grammY#934

fix: increase robustness for future error handling changes by @KnorpelSenf in grammyjs/grammY#963

feat: support Bot API 10.3 by @KnorpelSenf in grammyjs/grammY#964

Full Changelog: grammyjs/grammY@v1.45.1...v1.46.0

v1.45.1

What's Changed

fix: bad subscription narrowing by @KnorpelSenf in grammyjs/grammY#923

Full Changelog: grammyjs/grammY@v1.45.0...v1.45.1

v1.45.0

What's Changed

fix(platform): set default fetch duplex to "half" for all API requests by @KnightNiwrem in grammyjs/grammY#913

feat: support Bot API 10.2 by @KnorpelSenf in grammyjs/grammY#921

fix: narrow down ctx.subscription by @KnorpelSenf in grammyjs/grammY#922

Full Changelog: grammyjs/grammY@v1.44.0...v1.45.0

Commits

055a5a4 1.46.0
53cc4e3 feat: support Bot API 10.3 (#964)
10599f0 fix: increase robustness for future error handling changes (#963)
99c780f docs: add @roshda as a contributor for code, and test (#946)
843f820 docs: update contributor information (#936)
7b2cacd fix: prevent memory buildup by unregistering signals (#934)
9f70bb1 test: migrate seed-dependent payload fixtures to snapshot testing (#933)
1f3e064 docs: update contributor information (#932)
94808e8 fix: update-contributors workflow (#926)
08df850 test: update fixtures after V8 upgrade (#931)
Additional commits viewable in compare view

Updates hono from 4.12.26 to 4.13.8

Release notes

Sourced from hono's releases.

v4.13.8

What's Changed

docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343

perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340

fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351

fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311

fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349

fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357

fix(request): keep the request media type when reusing a cached body in honojs/hono#5366

docs(combine): fix except() JSDoc param and add missing @returns in honojs/hono#5346

perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

... (truncated)

Commits

098e119 4.13.8
e8c8c21 perf(jsx/dom): optimize matching-head child lookup during reconciliation (#5329)
8755b17 docs(combine): fix except() JSDoc param and add missing @returns (#5346)
edd138e fix(request): keep the request media type when reusing a cached body (#5366)
9b4e9c2 fix(accept): clamp a negative q to 0, not 1 (#5357)
65cff90 fix(accept): treat the q parameter name as case-insensitive (#5349)
f147de5 fix(accepts, language): skip accept entries with quality 0 when matching (#5311)
90e1b94 fix(aws-lambda): respect backpressure when streaming the response body (#5351)
7792f5d perf(jsx/dom): reduce lookup work for large keyed updates (#5340)
e7b38ee docs: fix typos in code comments and link third-party middleware section (#5343)
Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

Limit recursive merge aliases (#685, #713)

Simplify line unfolding during quoted string parsing (#714)

Commits

1440ecd 2.9.1
c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
d11ce77 fix: Limit recursive merge aliases (#713)
c5f49f4 chore: Update docs-slate
See full diff in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

0c483c58 docs: the Zod 4.6 announcement post (#6546)

a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577

dd9c36fa fix(v4): defer recursive object index inference (#6580)

3b154992 feat(lang): add Tajik (tg) locale (#6581) by @ismoil77

2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.
npm install zod@latest
At a glance:

... (truncated)

Commits

59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
0f3f5ee 4.6.5
cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
743aedb 4.6.4
Additional commits viewable in compare view

Updates drizzle-kit from 0.31.10 to 0.31.11

Release notes

Sourced from drizzle-kit's releases.

drizzle-kit@0.31.11

Warn about silent migration skips on drizzle-kit checks - thanks @shaneikennedy

Commits

15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
Additional commits viewable in compare view

Updates oxfmt from 0.55.0 to 0.70.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.70.0

🚀 Features

415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[0.67.0] - 2026-09-07

🛡️ Security

9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

Commits

288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
9a612d5 chore(deps): update npm packages (#26178)
0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
63bc313 chore(npm): update funding URL (#26066)
97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
Additional commits viewable in compare view

Updates oxlint from 1.70.0 to 1.85.0

Release notes

Sourced from oxlint's releases.

oxlint v1.85.0

🚀 Features

415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.82.0] - 2026-09-07

🚀 Features

6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)

aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)

36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)

beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)

4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)

285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)

4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)

d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)

5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

... (truncated)

Commits

288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
63bc313 chore(npm): update funding URL (#26066)
97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
Additional commits viewable in compare view

Updates tsdown from 0.22.3 to 0.23.0

Release notes

Sourced from tsdown's releases.

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

config:

bundle: false → unbundle: true; bundle: true can be removed

outExtension → outExtensions

publicDir / --public-dir → copy / --copy

removeNodeProtocol: true → nodeProtocol: 'strip'

injectStyle → css.inject

deps:

inlineOnly / deps.onlyAllowBundle → deps.onlyBundle

skipNodeModulesBundle: true → deps.neverBundle: true

resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior

dts:

rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5

dts.oxc: true → dts.generator: 'oxc'

dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators

dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins

Custom languages, including vue, now throw when combined with an incompatible generator

dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass

attw:

The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks

programmatic API:

build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()

requirements:

Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0

rolldown-plugin-dts now requires Rolldown 1.2.x

Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

Drop support for Node.js 25 - by @sxzz (26950)

Remove deprecated tsup compatibility options - by @sxzz (50766)

Drop types and typesVersionsfields - by @sxzz (be3ea)

attw:

Change default profile to esm-only - by @sxzz (9b3cf)

deps:

Remove deprecated deps.onlyAllowBundle - by @sxzz (30c55)

Disable resolveDepSubpath by default - by @sxzz (d300f)

Remove deprecated skipNodeModulesBundle - by @sxzz (f2a3d)

dts:

Remove dts.cjsReexport option - by @sxzz (9c70f)

Make dts.generator the only way to select generator - by @sxzz (eb75f)

   🚀 Features

Expose programmatic watch controls - by @sxzz in rolldown/tsdown#1062 (96a40)

css: Support function form for css.modules.localsConvention - by @sxzz and @lazerg (b566f)

... (truncated)

Commits

ced9a2c chore: release v0.23.0
f5f9ea9 docs: add Ember support guide (#1043)
8ac89dc chore: upgrade Vitest to v5
96a4098 feat: expose programmatic watch controls (#1062)
61718d7 chore: upgrade deps
d04119c chore: upgrade deps
55f89c5 chore(deps): update pnpm to v12.1.0 (#1060)
946224d fix: ignore optional dependencies in type definitions
62f01cd chore: release v0.23.0-rc.1
bf53f43 fix(cli): camel-case nested flag keys
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…2 updates Bumps the npm-minor-patch group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.5` | `2.1.1` | | [@hono/zod-validator](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator) | `0.8.0` | `0.9.1` | | [@libsql/client](https://github.com/tursodatabase/libsql-client-ts/tree/HEAD/packages/libsql-client) | `0.17.4` | `0.18.0` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` | | [grammy](https://github.com/grammyjs/grammY) | `1.44.0` | `1.46.0` | | [hono](https://github.com/honojs/hono) | `4.12.26` | `4.13.8` | | [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` | | [drizzle-kit](https://github.com/drizzle-team/drizzle-orm) | `0.31.10` | `0.31.11` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.55.0` | `0.70.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.70.0` | `1.85.0` | | [tsdown](https://github.com/rolldown/tsdown) | `0.22.3` | `0.23.0` | Updates `@hono/node-server` from 2.0.5 to 2.1.1 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.5...v2.1.1) Updates `@hono/zod-validator` from 0.8.0 to 0.9.1 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-validator/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/zod-validator@0.9.1/packages/zod-validator) Updates `@libsql/client` from 0.17.4 to 0.18.0 - [Release notes](https://github.com/tursodatabase/libsql-client-ts/releases) - [Changelog](https://github.com/tursodatabase/libsql-client-ts/blob/main/CHANGELOG.md) - [Commits](https://github.com/tursodatabase/libsql-client-ts/commits/v0.18.0/packages/libsql-client) Updates `drizzle-orm` from 0.45.2 to 0.45.3 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3) Updates `grammy` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/grammyjs/grammY/releases) - [Commits](grammyjs/grammY@v1.44.0...v1.46.0) Updates `hono` from 4.12.26 to 4.13.8 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.26...v4.13.8) Updates `yaml` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) Updates `zod` from 4.4.3 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.5) Updates `drizzle-kit` from 0.31.10 to 0.31.11 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.31.10...drizzle-kit@0.31.11) Updates `oxfmt` from 0.55.0 to 0.70.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.70.0/npm/oxfmt) Updates `oxlint` from 1.70.0 to 1.85.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.85.0/npm/oxlint) Updates `tsdown` from 0.22.3 to 0.23.0 - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.22.3...v0.23.0) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@hono/zod-validator" dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@libsql/client" dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: drizzle-orm dependency-version: 0.45.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: grammy dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: hono dependency-version: 4.13.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: drizzle-kit dependency-version: 0.31.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: oxfmt dependency-version: 0.70.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: oxlint dependency-version: 1.85.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: tsdown dependency-version: 0.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Docker / Images label Sep 24, 2026

Navigation Menu

Repository navigation

build(deps): bump the npm-minor-patch group across 1 directory with 12 updates - #14

build(deps): bump the npm-minor-patch group across 1 directory with 12 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-4b31308df2

dependabot Bot commented on behalf of github Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 24, 2026

v2.1.1

What's Changed

v2.1.0

What's Changed

New Contributors

v2.0.12

What's Changed

v2.0.11

What's Changed

v2.0.10

Security fixes

Unauthenticated memory-leak DoS via aborted WebSocket handshake

v2.0.9

What's Changed

@​hono/zod-validator@​0.9.1

Patch Changes

@​hono/zod-validator@​0.9.0

Minor Changes

0.9.1

Patch Changes

0.9.0

Minor Changes

0.45.3

New Netlify DB Driver

v1.46.0

What's Changed

v1.45.1

What's Changed

v1.45.0

What's Changed

v4.13.8

What's Changed

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

v2.9.1

v4.6.5

Commits:

v4.6.4

v4.6.3

v4.6.2

v4.6.1

v4.6.0

drizzle-kit@0.31.11

oxfmt v0.70.0

🚀 Features

Changelog

[0.67.0] - 2026-09-07

🛡️ Security

[0.64.0] - 2026-08-18

🚀 Features

📚 Documentation

[0.62.0] - 2026-08-03

🐛 Bug Fixes

[0.59.0] - 2026-07-13

🐛 Bug Fixes

oxlint v1.85.0

🚀 Features

Changelog

[1.82.0] - 2026-09-07

🚀 Features

[1.81.0] - 2026-08-31

📚 Documentation

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

🐛 Bug Fixes

[1.78.0] - 2026-08-10

🚀 Features

🐛 Bug Fixes

[1.77.0] - 2026-08-03

🐛 Bug Fixes

v0.23.0

`@hono/zod-validator@0`.9.1

`@hono/zod-validator@0`.9.0

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory