Skip to content

Repository navigation

chore(deps): bump the npm_and_yarn group across 4 directories with 3 updates - #253

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/claude-agent/npm_and_yarn-c057a005ca
Closed

chore(deps): bump the npm_and_yarn group across 4 directories with 3 updates#253
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/claude-agent/npm_and_yarn-c057a005ca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 1 update in the /examples/claude-agent directory: @hono/node-server.
Bumps the npm_and_yarn group with 2 updates in the /examples/firebase-functions directory: @hono/node-server and fast-xml-parser.
Bumps the npm_and_yarn group with 1 update in the /examples/genkit-agent directory: fast-xml-parser.
Bumps the npm_and_yarn group with 1 update in the /examples/sveltekit directory: @sveltejs/kit.

Updates @hono/node-server from 2.1.1 to 2.1.7

Release notes

Sourced from @​hono/node-server's releases.

v2.1.7

Security fixes

This release includes a fix for the following security issue:

serveStatic with allowPercentInPath still allows the double-decode middleware bypass

Affects: serveStatic with allowPercentInPath: true. The fix for GHSA-rmxm-3fg6-px4f rejects a path containing %, but the allowPercentInPath option skipped that check entirely. A malformed percent sequence such as /static/%%36%31dmin/secret.txt was routed as /static/%61dmin/secret.txt, so middleware on /static/admin/* did not run, and serveStatic then decoded %61 to a and served static/admin/secret.txt. The default configuration was already fixed in 2.1.3. GHSA-fj57-4f93-cfw6

serveStatic now accepts the second decode only when its result equals the routed path with %25 replaced by %. File names containing a literal %, requested as %25, are served as before.

The same fix ships in hono v4.13.18 (GHSA-74fm-fwc7-3fwp).

Full Changelog: honojs/node-server@v2.1.6...v2.1.7

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

What's Changed

New Contributors

... (truncated)

Commits
  • abe63c8 2.1.7
  • cc42986 Merge commit from fork
  • 123f782 2.1.6
  • cfaa79f Merge commit from fork
  • 61cc026 Merge commit from fork
  • a152a45 test: wait for the first chunk before sending the second in the readable-stre...
  • fb97395 Merge commit from fork
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • Additional commits viewable in compare view

Updates @hono/node-server from 2.1.1 to 2.1.7

Release notes

Sourced from @​hono/node-server's releases.

v2.1.7

Security fixes

This release includes a fix for the following security issue:

serveStatic with allowPercentInPath still allows the double-decode middleware bypass

Affects: serveStatic with allowPercentInPath: true. The fix for GHSA-rmxm-3fg6-px4f rejects a path containing %, but the allowPercentInPath option skipped that check entirely. A malformed percent sequence such as /static/%%36%31dmin/secret.txt was routed as /static/%61dmin/secret.txt, so middleware on /static/admin/* did not run, and serveStatic then decoded %61 to a and served static/admin/secret.txt. The default configuration was already fixed in 2.1.3. GHSA-fj57-4f93-cfw6

serveStatic now accepts the second decode only when its result equals the routed path with %25 replaced by %. File names containing a literal %, requested as %25, are served as before.

The same fix ships in hono v4.13.18 (GHSA-74fm-fwc7-3fwp).

Full Changelog: honojs/node-server@v2.1.6...v2.1.7

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

What's Changed

New Contributors

... (truncated)

Commits
  • abe63c8 2.1.7
  • cc42986 Merge commit from fork
  • 123f782 2.1.6
  • cfaa79f Merge commit from fork
  • 61cc026 Merge commit from fork
  • a152a45 test: wait for the first chunk before sending the second in the readable-stre...
  • fb97395 Merge commit from fork
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • Additional commits viewable in compare view

Updates fast-xml-parser from 5.11.1 to 5.12.0

Release notes

Sourced from fast-xml-parser's releases.

v5.12.0

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0

v5.11.2

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.12.0 / 2026-11-03

  • perf improvement for stop node: After the first failure in a given stop node, the function stops using readTagExp and switches to a cheap fallback.
  • devdep:jasmine 7.0
  • deps:
    • @​nodable/entities v3.1.0
    • fast-xml-builder v1.3.1
    • is-unsafe v2.0.3
    • strnum v2.5.1
  • fix cjs typing
  • fix: preserve original metadata offsets for CRLF input (#911) (By sskift)

5.11.2 / 2026-09-29

  • fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)
  • fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

  • fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0

... (truncated)

Commits

Updates fast-xml-parser from 5.11.1 to 5.12.0

Release notes

Sourced from fast-xml-parser's releases.

v5.12.0

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0

v5.11.2

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.12.0 / 2026-11-03

  • perf improvement for stop node: After the first failure in a given stop node, the function stops using readTagExp and switches to a cheap fallback.
  • devdep:jasmine 7.0
  • deps:
    • @​nodable/entities v3.1.0
    • fast-xml-builder v1.3.1
    • is-unsafe v2.0.3
    • strnum v2.5.1
  • fix cjs typing
  • fix: preserve original metadata offsets for CRLF input (#911) (By sskift)

5.11.2 / 2026-09-29

  • fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)
  • fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

  • fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0

... (truncated)

Commits

Updates @sveltejs/kit from 2.70.3 to 3.2.0

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​3.2.0

Minor Changes

  • feat: Add clickable links to remote function invocation in dev server logs (#17547)

Patch Changes

  • fix: reject URL inputs in resolve (#17627)

  • fix: respond with JSON instead of rendering the error page for a __data.json request to a missing route (#17630)

  • fix: resolve relative paths against the page URL in data requests when paths.relative is true (#17630)

  • fix: reject binary remote forms referencing files with an empty file-offset table as 400 Bad Request (#17579)

  • fix: correctly populate route and params for afterNavigate during hydration (#17577)

  • fix: include assets imported through dynamic imports, remote functions and param matchers in builder.findServerAssets so that read can find them (#17505)

  • fix: set navigation.from to null in afterNavigate on start when SSR is disabled (#17587)

  • fix: include remote function name and declaration file in schema validation failure logs (#17495)

  • fix: reuse SSR results of remote functions from packages during hydration in dev (#17604)

  • fix: remove empty type output directories for removed routes (#17472)

  • fix: use the UTF-8 byte length when reading inline assets (#17590)

  • chore: simplify a few server and build helpers (#17531)

  • fix: ignore the query string and hash of an imported asset's URL when using read (#17507)

  • fix: avoid reloading unrelated server modules when saving files during development (#17462)

@​sveltejs/kit@​3.1.1

Patch Changes

  • fix: return a 400 response instead of throwing when reroute rewrites a malformed pathname (1d21a3b)

  • fix: restore function snapshots on reload when SSR is disabled (#17477)

  • fix: prevent separate non-exported query.batch functions from sharing a batch (3529813)

  • fix: reuse the original fetch across dev server reloads (#17548)

  • fix: avoid adding a file watcher while loading src/env (#17502)

  • fix: parse remote form submissions in linear time (d593e7e)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

3.2.0

Minor Changes

  • feat: Add clickable links to remote function invocation in dev server logs (#17547)

Patch Changes

  • fix: reject URL inputs in resolve (#17627)

  • fix: respond with JSON instead of rendering the error page for a __data.json request to a missing route (#17630)

  • fix: resolve relative paths against the page URL in data requests when paths.relative is true (#17630)

  • fix: reject binary remote forms referencing files with an empty file-offset table as 400 Bad Request (#17579)

  • fix: correctly populate route and params for afterNavigate during hydration (#17577)

  • fix: include assets imported through dynamic imports, remote functions and param matchers in builder.findServerAssets so that read can find them (#17505)

  • fix: set navigation.from to null in afterNavigate on start when SSR is disabled (#17587)

  • fix: include remote function name and declaration file in schema validation failure logs (#17495)

  • fix: reuse SSR results of remote functions from packages during hydration in dev (#17604)

  • fix: remove empty type output directories for removed routes (#17472)

  • fix: use the UTF-8 byte length when reading inline assets (#17590)

  • chore: simplify a few server and build helpers (#17531)

  • fix: ignore the query string and hash of an imported asset's URL when using read (#17507)

  • fix: avoid reloading unrelated server modules when saving files during development (#17462)

3.1.1

Patch Changes

  • fix: return a 400 response instead of throwing when reroute rewrites a malformed pathname (1d21a3b)

  • fix: restore function snapshots on reload when SSR is disabled (#17477)

  • fix: prevent separate non-exported query.batch functions from sharing a batch (3529813)

  • fix: reuse the original fetch across dev server reloads (#17548)

  • fix: avoid adding a file watcher while loading src/env (#17502)

... (truncated)

Commits
  • 879c2c0 Version Packages (#17583)
  • 9bc12d3 chore: declare e2e coverage variants in one place (#16845)
  • decaf66 fix: resolve relative paths against the page URL in data requests (#17630)
  • fe4deb1 fix: reject URL inputs in resolve() (#17627)
  • 9ea73c6 pass dev_decoration to init_remote_functions and attach dev_loc
  • 5d1665a Merge branch 'main' into fix-remote-validation-log-name
  • a428a5c refactor: use if/else if instead of nested ternary
  • a03429c fix: reuse SSR results of package remote functions on hydration in dev (#17604)
  • 2dce9ca fix: set navigation.from to null on start without SSR (#17587)
  • 9c1eda4 feat: Clickable remote function logs (#17547)
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
@sveltejs/kit [>= 3.a, < 4]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 4 directories with 3 …
638d054 
…updates

Bumps the npm_and_yarn group with 1 update in the /examples/claude-agent directory: [@hono/node-server](https://github.com/honojs/node-server).
Bumps the npm_and_yarn group with 2 updates in the /examples/firebase-functions directory: [@hono/node-server](https://github.com/honojs/node-server) and [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser).
Bumps the npm_and_yarn group with 1 update in the /examples/genkit-agent directory: [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser).
Bumps the npm_and_yarn group with 1 update in the /examples/sveltekit directory: [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit).


Updates `@hono/node-server` from 2.1.1 to 2.1.7
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.7)

Updates `@hono/node-server` from 2.1.1 to 2.1.7
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.7)

Updates `fast-xml-parser` from 5.11.1 to 5.12.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.11.1...v5.12.0)

Updates `fast-xml-parser` from 5.11.1 to 5.12.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.11.1...v5.12.0)

Updates `@sveltejs/kit` from 2.70.3 to 3.2.0
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@3.2.0/packages/kit)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@sveltejs/kit"
  dependency-version: 3.2.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 12, 2026
@arcjet-review arcjet-review Bot added needs review Awaiting human review and removed needs review Awaiting human review labels Nov 12, 2026
@socket-security

socket-security Bot commented Nov 12, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​sveltejs/​adapter-node@​5.5.7 ⏵ 6.0.2100 +11007697 +1100
Updatednpm/​@​sveltejs/​kit@​2.70.3 ⏵ 3.2.099 +1100 +282 +198 +1100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/examples/claude-agent/npm_and_yarn-c057a005ca branch November 13, 2026 19:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants