Skip to content

Bump the minor-and-patch group across 1 directory with 6 updates - #38

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-210d7374f4
Open

Bump the minor-and-patch group across 1 directory with 6 updates#38
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-210d7374f4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates in the / directory:

Package From To
hono 4.13.14 4.13.17
@cloudflare/workers-types 5.20261028.1 5.20261110.1
@types/node 26.6.5 26.6.6
vite 8.3.5 8.3.7
vitest 5.0.5 5.1.0
wrangler 4.154.0 4.160.0

Updates hono from 4.13.14 to 4.13.17

Release notes

Sourced from hono's releases.

v4.13.17

What's Changed

  • fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in honojs/hono#5608
  • fix(utils/url): do not match a query key across separators in honojs/hono#5607
  • fix(etag,pretty-json): cancel the discarded response body in honojs/hono#5606
  • fix(client): detect the JSON media type with whitespace before a parameter in honojs/hono#5609
  • fix(timing): honor a precision of 0 in setMetric in honojs/hono#5363
  • fix(utils/mime,ssg): match media types case-insensitively in honojs/hono#5449
  • fix(timing): escape double quotes and backslashes in Server-Timing descriptions in honojs/hono#5478
  • fix(etag): preserve commas within quoted entity tags in honojs/hono#5353
  • fix(accepts): preserve exact media type quality over subtype wildcards in honojs/hono#5427
  • fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in honojs/hono#5611
  • fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in honojs/hono#5430
  • fix(ssg): do not reuse created directories across toSSG runs in honojs/hono#5381
  • fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in honojs/hono#5483
  • fix(jsx): escape element and object attribute values in honojs/hono#5512
  • fix(jsx): do not render ref objects as attributes in honojs/hono#5615
  • fix(factory): keep independent return types for nine handlers in honojs/hono#5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

... (truncated)

Commits
  • 61f7c59 4.13.17
  • 1534ffa fix(factory): keep independent return types for nine handlers (#5618)
  • eb754bd fix(jsx): do not render ref objects as attributes (#5615)
  • 6cbe361 fix(jsx): escape element and object attribute values (#5512)
  • 8b7f9e9 fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events (#...
  • 7852e0a fix(ssg): do not reuse created directories across toSSG runs (#5381)
  • bcfd02b fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary (#5430)
  • 456fe46 fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in C...
  • 98b35af fix(accepts): preserve exact media type quality over subtype wildcards (#5427)
  • b3f1272 fix(etag): preserve commas within quoted entity tags (#5353)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261028.1 to 5.20261110.1

Commits

Updates @types/node from 26.6.5 to 26.6.6

Commits

Updates vite from 8.3.5 to 8.3.7

Release notes

Sourced from vite's releases.

v8.3.7

Bug Fixes

Miscellaneous Chores

Tests

Build System

v8.3.6

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.7 (2026-11-09)

Bug Fixes

Miscellaneous Chores

Tests

Build System

8.3.6 (2026-11-05)

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

... (truncated)

Commits

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates wrangler from 4.154.0 to 4.160.0

Release notes

Sourced from wrangler's releases.

wrangler@4.160.0

Minor Changes

  • #16760 cb9534f Thanks @​petebacondarwin! - Support forwarded Wrangler development server options in the experimental cf-wrangler delegate

    cf dev can now forward options such as --inspector-port 9229, --ip, --var, and --persist-to to the Wrangler development runtime. The delegate reuses Wrangler's dev option definitions and validation while retaining project config discovery, --mode environment selection, local development, and its .cloudflare/state default. Invalid option combinations produce a single-line usage error and exit code 2 before starting the server.

    Place server options that overlap cf's global options after --, for example cf dev -- --local --persist-to "custom state". Config and script overrides, whole-worker remote development, and Wrangler's global options remain unsupported.

  • #16739 6af492e Thanks @​GregBrimble! - Add custom Cloudflare API headers through CLOUDFLARE_API_HEADERS

    Set CLOUDFLARE_API_HEADERS to a JSON object such as {"X-Custom-Header":"value"} to add headers to Cloudflare API requests. Custom headers override existing unprotected request headers, body and transport headers are protected, and header values outside the diagnostic allowlist remain redacted regardless of log sanitization settings.

Patch Changes

  • #16810 cdc970b Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-10

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16810 cdc970b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261109.1 ^5.20261110.1
    workerd 1.20261109.1 1.20261110.1

  • #16709 022ee9d Thanks @​petebacondarwin! - Keep local Container images available for upload retries

    Keep prebuilt local image tags available until the caller finishes uploading the Worker and deploying its Container applications, so a later failure can be retried without rebuilding. When image push commands request cleanup, remove the source tag only after the push succeeds.

  • #16740 44b39b0 Thanks @​GregBrimble! - Redact header values outside a safe diagnostic allowlist, regardless of log sanitization settings.

    Apply the same filtering to request, response, and request-options diagnostics. Strip X-Auth-Key alongside Authorization when forwarding local artifact Git requests.

  • #16758 325dc69 Thanks @​petebacondarwin! - Fix JavaScript configuration parsing for Svelte projects using object spread

    Use a parser that supports object spread when updating JavaScript configuration files. This prevents configuration failures for Svelte projects using Drizzle or Better Auth and other framework configurations containing modern JavaScript syntax.

    Vite autoconfiguration reports a configuration error when an object spread, computed property, or accessor after the plugins array could override the Cloudflare plugin. Place the effective plugins array after these properties before retrying autoconfiguration.

  • Updated dependencies [cdc970b, cdc970b, 4e7e9f1, 267dadb, 44b39b0]:

wrangler@4.159.0

Minor Changes

... (truncated)

Commits
  • 2674eef Version Packages (#16799)
  • 022ee9d [containers-shared] Defer local image cleanup to upload callers (#16709)
  • cb9534f [wrangler] Support forwarded dev options in cf-wrangler (#16760)
  • 44b39b0 [wrangler, workers-utils, containers-shared, miniflare] Sanitize header diagn...
  • 6af492e [wrangler, workers-utils, containers-shared] Add custom Cloudflare API header...
  • bf3ec7b Version Packages (#16729)
  • dc4e093 [wrangler] Only mention a verification email when the created address is unve...
  • 56459a5 Update bundled third-party dependencies with known security fixes (#16648)
  • 3ef2afd [wrangler] Delegate Container cleanup to Miniflare (#16413)
  • 6f29f97 Stop persisting account selections made by cf (#16683)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-and-patch group across 1 directory with 6 updates
f145a91 
Bumps the minor-and-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.13.14` | `4.13.17` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261028.1` | `5.20261110.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.5` | `8.3.7` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.154.0` | `4.160.0` |



Updates `hono` from 4.13.14 to 4.13.17
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.14...v4.13.17)

Updates `@cloudflare/workers-types` from 5.20261028.1 to 5.20261110.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vite` from 8.3.5 to 8.3.7
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.7/packages/vite)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

Updates `wrangler` from 4.154.0 to 4.160.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.160.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261110.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.160.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 13, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants