Skip to content

chore(deps): bump the npm group across 1 directory with 9 updates - #54

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-19759087aa
Open

chore(deps): bump the npm group across 1 directory with 9 updates#54
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-19759087aa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 9 updates in the / directory:

Package From To
hono 4.13.13 4.13.14
js-yaml 5.4.3 5.5.0
@cloudflare/vitest-plugin 1.4.0 1.4.10
@cloudflare/workers-types 5.20261011.1 5.20261029.1
@vitest/eslint-plugin 1.6.27 1.6.28
eslint 10.12.0 10.13.0
typescript-eslint 8.71.1 8.72.1
vitest 5.0.3 5.0.5
wrangler 4.149.0 4.155.0

Updates hono from 4.13.13 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

Full Changelog: honojs/hono@v4.13.13...v4.13.14

Commits
  • bac5c4a 4.13.14
  • eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
  • 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
  • 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
  • e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
  • 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
  • e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
  • d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
  • ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
  • 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
  • Additional commits viewable in compare view

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

  • Updated argparse to v3.
  • Updated development dependencies.

Fixed

  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #801.
  • Report the exact position of non-printable characters in errors, #801.
Commits
  • cb62b2d 5.5.0 released
  • 87aed90 Deps bump
  • 3aec511 Fix error positions for non-printable characters, #801
  • 11aa483 Reject flow indicators at the start of block plain scalars, #801
  • 339d8e0 Refactor tag encoder and decoder to match the YAML specification
  • See full diff in compare view

Updates @cloudflare/vitest-plugin from 1.4.0 to 1.4.10

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.4.10

Patch Changes

@​cloudflare/vitest-plugin@​1.4.9

Patch Changes

@​cloudflare/vitest-plugin@​1.4.8

Patch Changes

  • #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

    The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

  • #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

    The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

  • #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

  • Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

@​cloudflare/vitest-plugin@​1.4.6

Patch Changes

  • #15708 3464abc Thanks @​samstarling! - Dispose Workflow step results and introspection modifiers after use

    Release RPC resources deterministically during local Workflow execution and introspection. This prevents undisposed RPC warnings and requests being cancelled after their execution context has ended. Live step results retain their original data shape, including typed-array offsets and backing buffers. Callbacks that finish after a step times out also release their results, cancelling unused streams without delaying retries.

    Disposing an introspector still aborts the instance if modifier acquisition failed, without introducing a teardown error. Non-stream results containing function-valued array properties are rejected according to the serialisable-output contract, instead of silently discarding those properties during storage normalisation.

  • #15846 a88cac4 Thanks @​oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.4.10

Patch Changes

1.4.9

Patch Changes

1.4.8

Patch Changes

  • #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

    The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

  • #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

    The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

  • #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

  • Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

1.4.7

Patch Changes

... (truncated)

Commits

Updates @cloudflare/workers-types from 5.20261011.1 to 5.20261029.1

Commits

Updates @vitest/eslint-plugin from 1.6.27 to 1.6.28

Release notes

Sourced from @​vitest/eslint-plugin's releases.

v1.6.28

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • c5df105 chore: release v1.6.28
  • 8eb6991 fix(parse-vitest-fn-call): recognize member-form hooks like test.aroundAll ...
  • e2aaac6 fix(prefer-describe-function-title): ignore type-only imports (#957)
  • 4c0ae5a fix(prefer-spy-on): pass an implementation to mockImplementation in the fix (...
  • a6acf78 fix(prefer-comparison-matcher): skip non-numeric operands with typecheck (#984)
  • 743f81f fix(unbound-method): account for optional chaining (#975)
  • 8bdb180 docs: typo in prefer-to-contain rule docs (#973)
  • 0bea6e1 refactor(valid-expect): remove unneeded conditions and use optional chaining ...
  • b3636d8 docs(consistent-test-it): fixed the description of the consistent-test-it opt...
  • 22d672a chore: Update TypeScript version to v6 (#945)
  • Additional commits viewable in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)
Commits

Updates typescript-eslint from 8.71.1 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
  • eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
  • typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

  • eslint-plugin: lazy load rules (#13010)
  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
  • typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

  • ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
  • eslint-plugin: [require-array-sort-compare] check tuples (#13058)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vitest from 5.0.3 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates wrangler from 4.149.0 to 4.155.0

Release notes

Sourced from wrangler's releases.

wrangler@4.155.0

Minor Changes

  • #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

    Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

    {
  "analytics_engine_datasets": [
    {
      "binding": "EVENTS",
      "dataset": "my-dataset",
      "remote": true
    }
  ]
}

Patch Changes

  • #16526 dba0e81 Thanks @​petebacondarwin! - Render terminal control characters as visible text in tail output

    Pretty tail and remote-preview output now escape control characters in log strings, exceptions and event metadata. Unicode, tabs and multiline logs remain readable, and JSON output keeps the original structured values.

  • #16489 fc57bc0 Thanks @​akshitsinha! - Keep Flagship flag metadata when updating flags

    wrangler flagship flags commands that update an existing flag, such as enable, set, rollout, split, and rules, no longer clear the flag's metadata. wrangler flagship flags pull now copies metadata into the local flag store.

  • #16521 ec6eddd Thanks @​petebacondarwin! - Validate .assetsignore encoding before building asset manifests

    Asset uploads and local development now stop with an actionable user error when .assetsignore is not valid UTF-8 or contains null characters, instead of silently losing its patterns. This also applies to standalone Miniflare and the Wrangler, Vite and Vitest development integrations. Save the file as UTF-8 to continue; UTF-8 files with a byte order mark and intentionally empty files remain supported.

  • Updated dependencies [a95d647, c7a3373,

@dependabot
chore(deps): bump the npm group across 1 directory with 9 updates
3e4d40a 
Bumps the npm group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.13.13` | `4.13.14` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.3` | `5.5.0` |
| [@cloudflare/vitest-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-plugin) | `1.4.0` | `1.4.10` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261011.1` | `5.20261029.1` |
| [@vitest/eslint-plugin](https://github.com/vitest-dev/eslint-plugin-vitest) | `1.6.27` | `1.6.28` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.1` | `8.72.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.149.0` | `4.155.0` |



Updates `hono` from 4.13.13 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.13...v4.13.14)

Updates `js-yaml` from 5.4.3 to 5.5.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.3...5.5.0)

Updates `@cloudflare/vitest-plugin` from 1.4.0 to 1.4.10
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-plugin/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-plugin@1.4.10/packages/vitest-plugin)

Updates `@cloudflare/workers-types` from 5.20261011.1 to 5.20261029.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@vitest/eslint-plugin` from 1.6.27 to 1.6.28
- [Release notes](https://github.com/vitest-dev/eslint-plugin-vitest/releases)
- [Commits](vitest-dev/eslint-plugin-vitest@v1.6.27...v1.6.28)

Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `typescript-eslint` from 8.71.1 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

Updates `vitest` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

Updates `wrangler` from 4.149.0 to 4.155.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.155.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: js-yaml
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@cloudflare/vitest-plugin"
  dependency-version: 1.4.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261029.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@vitest/eslint-plugin"
  dependency-version: 1.6.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: wrangler
  dependency-version: 4.155.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@dependabot
dependabot Bot requested a review from matbrgz as a code owner November 1, 2026 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matbrgz matbrgz Awaiting requested review from matbrgz matbrgz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants