Skip to content

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 10 updates - #189

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-minor-patch-c9225bbce6
Open

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 10 updates#189
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-minor-patch-c9225bbce6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies-minor-patch group with 10 updates in the / directory:

Package From To
@hono/node-server 2.1.4 2.1.6
@types/node 26.6.4 26.6.6
fastify 5.12.5 5.12.8
h3 2.0.2 2.0.8
pkg-pr-new 0.0.91 0.0.93
srvx 1.0.5 1.0.8
ws 8.22.0 8.22.1
@fastify/cookie 11.1.3 11.1.5
supertest 7.3.1 7.3.2
@types/bun 1.4.2 1.4.4

Updates @hono/node-server from 2.1.4 to 2.1.6

Release notes

Sourced from @​hono/node-server's releases.

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

Commits
  • 123f782 2.1.6
  • cfaa79f Merge commit from fork
  • 61cc026 Merge commit from fork
  • a152a45 test: wait for the first chunk before sending the second in the readable-stre...
  • fb97395 Merge commit from fork
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • See full diff in compare view

Updates @types/node from 26.6.4 to 26.6.6

Commits

Updates fastify from 5.12.5 to 5.12.8

Release notes

Sourced from fastify's releases.

v5.12.8

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.7...v5.12.8

v5.12.7

Full Changelog: fastify/fastify@v5.12.6...v5.12.7

v5.12.6

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.5...v5.12.6

Commits
  • 0c7413a Bumped v5.12.8
  • 0ffe18f test: make handlerTimeout ended-but-not-finished test deterministic
  • 8e7c2b7 test: restore 100% coverage for handlerTimeout abort paths
  • 15fbadf [Backport 5.x] fix: abort streaming response when handlerTimeout fires after ...
  • 18a7049 docs: fix syntax errors in code examples (#7159)
  • c410867 docs: clarify that maxParamLength does not prevent ReDoS (#7140)
  • 0fa6bc2 [Backport 5.x] fix(decorators): evaluate instance getters once in getDecorato...
  • 0873d55 perf(request): hoist port regex to module level (#7110)
  • 25cd11e [Backport 5.x] docs: remove plugins that do not support Fastify v5 (#7152)
  • d60a57b [Backport 5.x] docs(reply): reorganize Reply reference by properties and meth...
  • Additional commits viewable in compare view

Updates h3 from 2.0.2 to 2.0.8

Release notes

Sourced from h3's releases.

v2.0.8

compare changes

🩹 Fixes

  • rules: Let HTTPError.headers opt out of headers rule on errors (#1613)

v2.0.7

🩹 Fixes

  • Keep middleware-staged headers out of handler-level caches (#1608)

v2.0.6

🩹 Fixes

  • rules: Fill target ** for named catch-all keys (/**:name) (48d650b)
  • rules: Keep middleware-staged headers out of cache entries (#1606)

v2.0.5

compare changes

🩹 Fixes

  • cli: Harden h3 docs page handling (7150b0e)

v2.0.4

compare changes

📦 Build

  • Remove bundled docs and open h3.dev from h3 docs (#1602)

🏡 Chore

v2.0.3

compare changes

🩹 Fixes

  • body: Match form content type case-insensitively in readBody (#1601)
  • static: Serve .wasm as application/wasm (#1581)
  • static: Match file extensions case-insensitively (#1580)
  • sse: Preserve empty event ids (#1590)
  • query: Decode valid escapes next to a malformed one (#1582)
  • response: Omit HEAD body for default errors (#1595)
  • tracing: Mount nested apps passed to use() (#1576)
  • cors: Make stateful origin regex checks repeatable (#1589)

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.8

compare changes

🩹 Fixes

  • rules: Let HTTPError.headers opt out of headers rule on errors (#1613)

❤️ Contributors

v2.0.7

compare changes

🩹 Fixes

  • Keep middleware-staged headers out of handler-level caches (#1608)

❤️ Contributors

v2.0.6

compare changes

🩹 Fixes

  • rules: Fill target ** for named catch-all keys (/**:name) (48d650b)
  • rules: Keep middleware-staged headers out of cache entries (#1606)

❤️ Contributors

v2.0.5

compare changes

🩹 Fixes

  • cli: Harden h3 docs page handling (7150b0e)

❤️ Contributors

... (truncated)

Commits
  • f0e1780 chore(release): v2.0.8
  • f90f4c8 fix(rules): let HTTPError.headers opt out of headers rule on errors (#1613)
  • 9d70cf3 chore(release): v2.0.7
  • 1326e74 fix: keep middleware-staged headers out of handler-level caches (#1608)
  • 31062a0 chore(release): v2.0.6
  • d658815 fix(rules): keep middleware-staged headers out of cache entries (#1606)
  • 48d650b fix(rules): fill target ** for named catch-all keys (/**:name)
  • b64166a chore(release): v2.0.5
  • 7150b0e fix(cli): harden h3 docs page handling
  • 2084eca chore(release): v2.0.4
  • Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.91 to 0.0.93

Commits

Updates srvx from 1.0.5 to 1.0.8

Release notes

Sourced from srvx's releases.

v1.0.8

compare changes

🩹 Fixes

  • node: Don't expose derived content-length on materialized FastResponse headers (#337)
  • node: Send the head for stream bodies that end without data (#339)

v1.0.7

compare changes

🩹 Fixes

  • node: Scope FastResponse subclass instanceof and avoid nesting as global Response (#330)
  • node: Keep derived content-length when FastResponse materializes (#335)
  • node: Resolve native Request/Response by base class to support globals patched by other servers (#331)

v1.0.6

compare changes

🩹 Fixes

  • node: Omit default port/host when node.path is set (19b33f9)
  • generic: Keep an existing request.waitUntil (#309)
  • node: Read a pre-set rawBody from every body method (#312)

🏡 Chore

🤖 CI

  • Update github actions (3cf7b25)
  • Restore workflow formatting (e59e62a)

❤️ Contributors

  • Pooya Parsa
  • Nitedani
  • Kaan Çelebi
Changelog

Sourced from srvx's changelog.

v1.0.8

compare changes

🩹 Fixes

  • node: Don't expose derived content-length on materialized FastResponse headers (#337)
  • node: Send the head for stream bodies that end without data (#339)

🏡 Chore

🤖 CI

  • Run deno vitest via npm specifier to bypass pnpm 12 bin shim (f0ef09c)

❤️ Contributors

v1.0.7

compare changes

🩹 Fixes

  • node: Scope FastResponse subclass instanceof and avoid nesting as global Response (#330)
  • node: Keep derived content-length when FastResponse materializes (#335)
  • node: Resolve native Request/Response by base class to support globals patched by other servers (#331)

❤️ Contributors

v1.0.6

compare changes

🩹 Fixes

  • node: Omit default port/host when node.path is set (19b33f9)
  • generic: Keep an existing request.waitUntil (#309)
  • node: Read a pre-set rawBody from every body method (#312)

🏡 Chore

... (truncated)

Commits
  • a961c16 chore(release): v1.0.8
  • f0ef09c ci: run deno vitest via npm specifier to bypass pnpm 12 bin shim
  • 3806369 chore: update deps
  • 2af7a1b fix(node): send the head for stream bodies that end without data (#339)
  • 30fb59a fix(node): don't expose derived content-length on materialized FastResponse h...
  • a9a0754 chore(release): v1.0.7
  • a327007 fix(node): resolve native Request/Response by base class to support globa...
  • f0c13e0 fix(node): keep derived content-length when FastResponse materializes (#335)
  • 008a954 fix(node): scope FastResponse subclass instanceof and avoid nesting as gl...
  • cc446f5 chore(release): v1.0.6
  • Additional commits viewable in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

  • The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

Commits
  • c18a80a [dist] 8.22.1
  • 2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
  • c9efa88 [ci] Test on node 27
  • aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
  • b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
  • 85319a7 [minor] Prevent Sender.frame() from returning empty chunks
  • See full diff in compare view

Updates @fastify/cookie from 11.1.3 to 11.1.5

Release notes

Sourced from @​fastify/cookie's releases.

v11.1.5

What's Changed

New Contributors

Full Changelog: fastify/fastify-cookie@v11.1.4...v11.1.5

v11.1.4

What's Changed

New Contributors

Full Changelog: fastify/fastify-cookie@v11.1.3...v11.1.4

Commits
  • a96460b Bumped v11.1.5
  • 7f9551e fix: forward custom encode option to cookie serializer (#377)
  • 4f47cf1 Bumped v11.1.4
  • c07e472 fix: forward encode option to cookie serializer (#374)
  • d27beb4 perf(signer): add early delimiter check in unsign to avoid redundant HMAC com...
  • See full diff in compare view

Updates supertest from 7.3.1 to 7.3.2

Release notes

Sourced from supertest's releases.

v7.3.2

  • fix: keep the shared server alive for every request that uses it 2a5e96f

forwardemail/supertest@v7.3.1...v7.3.2

Commits

Updates @types/bun from 1.4.2 to 1.4.4

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 24ae068f-d8c2-42ca-b667-536dc47c091e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@codecov

codecov Bot commented Nov 9, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@codspeed

codspeed Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Merging this PR will not alter performance

1 warning

⚠️ 2 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks1

Comparing dependabot/npm_and_yarn/dev-dependencies-minor-patch-c9225bbce6 (e25e0cb) with main (bb2cd0a)

Open in CodSpeed

Footnotes

  1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@dependabot
chore(deps-dev): bump the dev-dependencies-minor-patch group across 1…
44dec2d 
… directory with 10 updates

Bumps the dev-dependencies-minor-patch group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.4` | `2.1.6` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.6` |
| [fastify](https://github.com/fastify/fastify) | `5.12.5` | `5.12.8` |
| [h3](https://github.com/h3js/h3) | `2.0.2` | `2.0.8` |
| [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.91` | `0.0.93` |
| [srvx](https://github.com/h3js/srvx) | `1.0.5` | `1.0.8` |
| [ws](https://github.com/websockets/ws) | `8.22.0` | `8.22.1` |
| [@fastify/cookie](https://github.com/fastify/fastify-cookie) | `11.1.3` | `11.1.5` |
| [supertest](https://github.com/ladjs/supertest) | `7.3.1` | `7.3.2` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.2` | `1.4.4` |



Updates `@hono/node-server` from 2.1.4 to 2.1.6
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.4...v2.1.6)

Updates `@types/node` from 26.6.4 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `fastify` from 5.12.5 to 5.12.8
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.12.5...v5.12.8)

Updates `h3` from 2.0.2 to 2.0.8
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/main/CHANGELOG.md)
- [Commits](h3js/h3@v2.0.2...v2.0.8)

Updates `pkg-pr-new` from 0.0.91 to 0.0.93
- [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.93/packages/cli)

Updates `srvx` from 1.0.5 to 1.0.8
- [Release notes](https://github.com/h3js/srvx/releases)
- [Changelog](https://github.com/h3js/srvx/blob/main/CHANGELOG.md)
- [Commits](h3js/srvx@v1.0.5...v1.0.8)

Updates `ws` from 8.22.0 to 8.22.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.22.0...8.22.1)

Updates `@fastify/cookie` from 11.1.3 to 11.1.5
- [Release notes](https://github.com/fastify/fastify-cookie/releases)
- [Commits](fastify/fastify-cookie@v11.1.3...v11.1.5)

Updates `supertest` from 7.3.1 to 7.3.2
- [Release notes](https://github.com/ladjs/supertest/releases)
- [Commits](forwardemail/supertest@v7.3.1...v7.3.2)

Updates `@types/bun` from 1.4.2 to 1.4.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

---
updated-dependencies:
- dependency-name: "@fastify/cookie"
  dependency-version: 11.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: "@types/bun"
  dependency-version: 1.4.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: fastify
  dependency-version: 5.12.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: h3
  dependency-version: 2.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: pkg-pr-new
  dependency-version: 0.0.93
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: srvx
  dependency-version: 1.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: supertest
  dependency-version: 7.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: ws
  dependency-version: 8.22.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-minor-patch-c9225bbce6 branch from e25e0cb to 44dec2d Compare November 9, 2026 09:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants