Skip to content

Bump the minor-and-patch group with 5 updates - #35

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-160b2a2b47
Closed

Bump the minor-and-patch group with 5 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-160b2a2b47

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 5 updates:

Package From To
hono 4.13.14 4.13.16
@cloudflare/workers-types 5.20261028.1 5.20261103.1
@types/node 26.6.5 26.6.6
vitest 5.0.5 5.1.0
wrangler 4.154.0 4.157.0

Updates hono from 4.13.14 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

  • fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

Full Changelog: honojs/hono@v4.13.14...v4.13.15

Commits
  • c91b60a 4.13.16
  • e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
  • bf16471 Merge commit from fork
  • d88fab3 Merge commit from fork
  • 34f9043 Merge commit from fork
  • 8a103aa Merge commit from fork
  • 15bbd96 Merge commit from fork
  • 3cb29de 4.13.15
  • 17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
  • ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261028.1 to 5.20261103.1

Commits

Updates @types/node from 26.6.5 to 26.6.6

Commits

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates wrangler from 4.154.0 to 4.157.0

Release notes

Sourced from wrangler's releases.

wrangler@4.157.0

Minor Changes

  • #16660 34f34b3 Thanks @​punkeel! - Allow opting into zstd compression for Wrangler-built container image layers with WRANGLER_CONTAINER_IMAGE_COMPRESSION=zstd.

Patch Changes

  • #16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16011 44d1ee4 Thanks @​wra-sol! - Offer to delete a Worker's Container applications when running wrangler delete

    Previously, wrangler delete removed only the Worker, leaving the Container applications that wrangler deploy created for it running and billing. It now offers to delete them as well. With --force, or in CI and other non-interactive contexts, it lists them instead so they can be removed with wrangler containers delete <id>.

  • #16670 b14b9dc Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261102.1 ^5.20261103.1
    workerd 1.20261102.1 1.20261103.1

  • Updated dependencies [b14b9dc, b14b9dc, d2eda1c, 2750917]:

wrangler@4.156.2

Patch Changes

  • #16642 d38cb02 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16642 d38cb02 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261101.1 ^5.20261102.1
    workerd 1.20261101.1 1.20261102.1

  • #16623 51bbf8b Thanks @​petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

    Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:

    import {
  getNodeCompat,

... (truncated)

Commits
  • 9a0732c Version Packages (#16654)
  • 44d1ee4 fix(wrangler): stop wrangler delete orphaning Container applications (#16011)
  • 8ac43df Require explicit route metadata flags when downloading Worker configuration (...
  • 680666e Version Packages (#16646)
  • e5b1798 Avoid unrelated route permission checks when comparing dashboard configuratio...
  • 51bbf8b [miniflare] Move shared tooling helpers to workers-utils (#16623)
  • 1598fd3 [vitest-plugin] Support cloudflare.config.ts with the new config option (#16424)
  • ca55031 Version Packages (#16598)
  • 2667a9f [wrangler] Fix Pages Functions middleware routing for repeated slashes (#16603)
  • 5740867 [wrangler] Enforce the Pages development asset directory boundary (#16535)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-and-patch group with 5 updates
55cc21f 
Bumps the minor-and-patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.13.14` | `4.13.16` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261028.1` | `5.20261103.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.154.0` | `4.157.0` |


Updates `hono` from 4.13.14 to 4.13.16
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.14...v4.13.16)

Updates `@cloudflare/workers-types` from 5.20261028.1 to 5.20261103.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

Updates `wrangler` from 4.154.0 to 4.157.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.157.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261103.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.157.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-160b2a2b47 branch November 13, 2026 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants