build(deps): bump the npm-minor-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #12 · diegoarff/MemosNotify

dependabot · 2026-09-10T20:16:04Z

Bumps the npm-minor-patch group with 9 updates in the / directory:

Package	From	To
@hono/node-server	`2.0.5`	`2.1.1`
@hono/zod-validator	`0.8.0`	`0.9.1`
@libsql/client	`0.17.4`	`0.18.0`
grammy	`1.44.0`	`1.46.0`
hono	`4.12.26`	`4.13.7`
zod	`4.4.3`	`4.5.4`
oxfmt	`0.55.0`	`0.67.0`
oxlint	`1.70.0`	`1.82.0`
tsdown	`0.22.3`	`0.23.0`

Updates @hono/node-server from 2.0.5 to 2.1.1

Release notes

Sourced from @hono/node-server's releases.

v2.1.1

What's Changed

perf: lazily materialize request headers by @BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

feat: add Early Hints (HTTP 103) middleware by @bilal-azam in honojs/node-server#378

fix(listener): avoid uncaught error when force-closing a non-standard socket by @mohamedramadan14 in honojs/node-server#383

New Contributors

@bilal-azam made their first contribution in honojs/node-server#378

@mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

test: replace supertest by @BlankParticle in honojs/node-server#379

fix(response): copy headers when init is a foreign Response by @yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

test: use a custom helper for path traversal tests by @BlankParticle in honojs/node-server#377

perf(request): fast-path QUERY methods by @usualoma in honojs/node-server#376

perf(request): fast-path PATCH method by @yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

73c03ad 2.1.1
5515aa0 perf: lazily materialize request headers (#389)
82ba34e 2.1.0
1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
977a242 feat: add Early Hints (HTTP 103) middleware (#378)
a813b6c 2.0.12
caf48ba fix(response): copy headers when init is a foreign Response (#382)
3b1dd68 test: replace supertest (#379)
834e54f 2.0.11
ba72bcd perf(request): fast-path PATCH method (#380)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates @hono/zod-validator from 0.8.0 to 0.9.1

Release notes

Sourced from @hono/zod-validator's releases.

@hono/zod-validator@0.9.1

Patch Changes

#2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

@hono/zod-validator@0.9.0

Minor Changes

#2038 7bc11dffa7dd5b639c614b12c34bd76722d76354 Thanks @yusukebe! - Use InferInput from hono/validator instead of a local copy to avoid duplication (requires hono >=4.11.2)

Changelog

Sourced from @hono/zod-validator's changelog.

0.9.1

Patch Changes

#2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

0.9.0

Minor Changes

#2038 7bc11dffa7dd5b639c614b12c34bd76722d76354 Thanks @yusukebe! - Use InferInput from hono/validator instead of a local copy to avoid duplication (requires hono >=4.11.2)

Commits

8de0f1e Version Packages (#2114)
51b7f97 perf(zod-validator): Caching the key mapping table of the header scheme (#2112)
40f956e chore(dev-deps): partial upgrade to TypeScript 7 (#2048)
70623e3 Version Packages (#2037)
7bc11df fix(zod-validator): Use InferInput from hono/validator instead of a local...
5e32c00 chore: migrate to pnpm (#2006)
c5ba38b chore(deps-dev): bump tsdown from 0.22.2 to 0.22.3 (#1996)
f89ea30 chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 (#1866)
bf845ad chore: unblock TypeScript v6 (#1937)
2cbc5f0 chore(deps-dev): bump tsdown to 0.22.2 (#1908)
Additional commits viewable in compare view

Updates @libsql/client from 0.17.4 to 0.18.0

Commits

9496c78 0.18.0
f336495 fix(sqlite3): settle in-flight operations when the pool is torn down
1174d51 fix(sqlite3): give a client a connection pool, like the hrana clients
05e3344 fix(sqlite3): keep connection handle for in-memory databases across transactions
See full diff in compare view

Updates grammy from 1.44.0 to 1.46.0

Release notes

Sourced from grammy's releases.

v1.46.0

What's Changed

fix: prevent memory buildup by unregistering signals by @KnorpelSenf in grammyjs/grammY#934

fix: increase robustness for future error handling changes by @KnorpelSenf in grammyjs/grammY#963

feat: support Bot API 10.3 by @KnorpelSenf in grammyjs/grammY#964

Full Changelog: grammyjs/grammY@v1.45.1...v1.46.0

v1.45.1

What's Changed

fix: bad subscription narrowing by @KnorpelSenf in grammyjs/grammY#923

Full Changelog: grammyjs/grammY@v1.45.0...v1.45.1

v1.45.0

What's Changed

fix(platform): set default fetch duplex to "half" for all API requests by @KnightNiwrem in grammyjs/grammY#913

feat: support Bot API 10.2 by @KnorpelSenf in grammyjs/grammY#921

fix: narrow down ctx.subscription by @KnorpelSenf in grammyjs/grammY#922

Full Changelog: grammyjs/grammY@v1.44.0...v1.45.0

Commits

055a5a4 1.46.0
53cc4e3 feat: support Bot API 10.3 (#964)
10599f0 fix: increase robustness for future error handling changes (#963)
99c780f docs: add @roshda as a contributor for code, and test (#946)
843f820 docs: update contributor information (#936)
7b2cacd fix: prevent memory buildup by unregistering signals (#934)
9f70bb1 test: migrate seed-dependent payload fixtures to snapshot testing (#933)
1f3e064 docs: update contributor information (#932)
94808e8 fix: update-contributors workflow (#926)
08df850 test: update fixtures after V8 upgrade (#931)
Additional commits viewable in compare view

Updates hono from 4.12.26 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

eebdf7b 4.13.7
2b8ed40 Merge commit from fork
cac0c4d 4.13.6
dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
ec648d6 chore: bump editorconfig-checker (#5336)
e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
499c35e fix(client): normalize root WebSocket URLs (#5291)
50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
06880c4 4.13.5
531e9c5 Merge commit from fork
Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)

e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema

87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines

99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)

e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open

7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar

eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)

d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)

212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)

e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)

fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator

6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)

6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution

019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates

652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller

571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card

9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm

8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.
npm install zod@latest
At a glance:

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

... (truncated)

Commits

e8e206f 4.5.4
84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
1a16102 4.5.3
eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
e3a695b docs(v4): record the email regex and container output-shape findings under Open
99fce39 bench(v4): z.compile() against zod-compiler (#6499)
87d6464 fix(docs): drop the OG description when the title wraps past two lines
e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
9a193aa 4.5.2
Additional commits viewable in compare view

Updates oxfmt from 0.55.0 to 0.67.0

Changelog

Sourced from oxfmt's changelog.

[0.67.0] - 2026-09-07

🛡️ Security

9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

Commits

b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
9a612d5 chore(deps): update npm packages (#26178)
0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
63bc313 chore(npm): update funding URL (#26066)
97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
fed6681 docs(oxfmt): skip expanding overrides options (#25572)
c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
Additional commits viewable in compare view

Updates oxlint from 1.70.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

Oxlint v1.82.0

Oxfmt v0.67.0

Oxlint v1.82.0

💥 BREAKING CHANGES

66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)

562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)

253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)

8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)

5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)

4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)

07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)

9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)

a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (#25925) (camc314)

304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (#26166) (Hamody We)

b41bb35 linter: Qualify rules in rules output (#26250) (camc314)

895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (#26231) (camc314)

4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (#26225) (camc314)

🛡️ Security

9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Oxfmt v0.67.0

💥 BREAKING CHANGES

66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

2c9a947 parser: [BREAKING] Reduce MAX_LEN to 256 bytes below u32::MAX (#26352) (overlookmotel)

🚀 Features

68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (#26337) (leaysgur)

🐛 Bug Fixes

f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (#26375) (leaysgur)

104061b formatter: Keep JSDoc cast parens with a comment inside them (#26374) (leaysgur)

3d00a76 formatter_css: Keep comment inside important and simple-vars colon (#26370) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.82.0] - 2026-09-07

🚀 Features

6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)

aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)

36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)

beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)

4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)

285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)

4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)

d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)

5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

... (truncated)

Commits

b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
63bc313 chore(npm): update funding URL (#26066)
97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
aa49d86 fix(linter): allow spread rule options in config types (#25675)
Additional commits viewable in compare view

Updates tsdown from 0.22.3 to 0.23.0

Release notes

Sourced from tsdown's releases.

v0.23.0

🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

config:

bundle: false → unbundle: true; bundle: true can be removed

outExtension → outExtensions

publicDir / --public-dir → copy / --copy

removeNodeProtocol: true → nodeProtocol: 'strip'

injectStyle → css.inject

deps:

inlineOnly / deps.onlyAllowBundle → deps.onlyBundle

skipNodeModulesBundle: true → deps.neverBundle: true

resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior

dts:

rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5

dts.oxc: true → dts.generator: 'oxc'

dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators

dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins

Custom languages, including vue, now throw when combined with an incompatible generator

dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass

attw:

The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks

programmatic API:

build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()

requirements:

Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0

rolldown-plugin-dts now requires Rolldown 1.2.x

Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

🚨 Breaking Changes

Drop support for Node.js 25 - by @sxzz (26950)

Remove deprecated tsup compatibility options - by @sxzz (50766)

Drop types and typesVersionsfields - by @sxzz Description has been truncated

… updates Bumps the npm-minor-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.5` | `2.1.1` | | [@hono/zod-validator](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator) | `0.8.0` | `0.9.1` | | [@libsql/client](https://github.com/tursodatabase/libsql-client-ts/tree/HEAD/packages/libsql-client) | `0.17.4` | `0.18.0` | | [grammy](https://github.com/grammyjs/grammY) | `1.44.0` | `1.46.0` | | [hono](https://github.com/honojs/hono) | `4.12.26` | `4.13.7` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.55.0` | `0.67.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.70.0` | `1.82.0` | | [tsdown](https://github.com/rolldown/tsdown) | `0.22.3` | `0.23.0` | Updates `@hono/node-server` from 2.0.5 to 2.1.1 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.5...v2.1.1) Updates `@hono/zod-validator` from 0.8.0 to 0.9.1 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-validator/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/zod-validator@0.9.1/packages/zod-validator) Updates `@libsql/client` from 0.17.4 to 0.18.0 - [Release notes](https://github.com/tursodatabase/libsql-client-ts/releases) - [Changelog](https://github.com/tursodatabase/libsql-client-ts/blob/main/CHANGELOG.md) - [Commits](https://github.com/tursodatabase/libsql-client-ts/commits/v0.18.0/packages/libsql-client) Updates `grammy` from 1.44.0 to 1.46.0 - [Release notes](https://github.com/grammyjs/grammY/releases) - [Commits](grammyjs/grammY@v1.44.0...v1.46.0) Updates `hono` from 4.12.26 to 4.13.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.26...v4.13.7) Updates `zod` from 4.4.3 to 4.5.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.4) Updates `oxfmt` from 0.55.0 to 0.67.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.67.0/npm/oxfmt) Updates `oxlint` from 1.70.0 to 1.82.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.82.0/npm/oxlint) Updates `tsdown` from 0.22.3 to 0.23.0 - [Release notes](https://github.com/rolldown/tsdown/releases) - [Commits](rolldown/tsdown@v0.22.3...v0.23.0) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@hono/zod-validator" dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@libsql/client" dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: grammy dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: hono dependency-version: 4.13.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: zod dependency-version: 4.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: oxfmt dependency-version: 0.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: oxlint dependency-version: 1.82.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: tsdown dependency-version: 0.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-17T20:15:36Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Docker / Images label Sep 10, 2026

dependabot Bot closed this Sep 17, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-b27aa5e9d8 branch September 17, 2026 20:15

Navigation Menu

Repository navigation

build(deps): bump the npm-minor-patch group across 1 directory with 9 updates - #12

build(deps): bump the npm-minor-patch group across 1 directory with 9 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-b27aa5e9d8

dependabot Bot commented on behalf of github Sep 10, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.1.1

What's Changed

v2.1.0

What's Changed

New Contributors

v2.0.12

What's Changed

v2.0.11

What's Changed

v2.0.10

Security fixes

Unauthenticated memory-leak DoS via aborted WebSocket handshake

v2.0.9

What's Changed

@​hono/zod-validator@​0.9.1

Patch Changes

@​hono/zod-validator@​0.9.0

Minor Changes

0.9.1

Patch Changes

0.9.0

Minor Changes

v1.46.0

What's Changed

v1.45.1

What's Changed

v1.45.0

What's Changed

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.5.4

Commits:

v4.5.3

Commits:

v4.5.2

Commits:

v4.5.1

Commits:

v4.5.0

[0.67.0] - 2026-09-07

🛡️ Security

[0.64.0] - 2026-08-18

🚀 Features

📚 Documentation

[0.62.0] - 2026-08-03

🐛 Bug Fixes

[0.59.0] - 2026-07-13

🐛 Bug Fixes

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

Oxlint v1.82.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

🛡️ Security

Oxfmt v0.67.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

[1.82.0] - 2026-09-07

🚀 Features

[1.81.0] - 2026-08-31

📚 Documentation

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

🐛 Bug Fixes

[1.78.0] - 2026-08-10

dependabot Bot commented on behalf of github Sep 10, 2026 •

edited

Loading

`@hono/zod-validator@0`.9.1

`@hono/zod-validator@0`.9.0

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion