chore(deps): bump the npm-minor-and-patch group across 2 directories with 7 updates

[dependabot]

Bumps the npm-minor-and-patch group with 3 updates in the / directory: hono, @types/node and wrangler.
Bumps the npm-minor-and-patch group with 5 updates in the /frontend directory:

Package	From	To
@types/node	26.6.2	26.6.4
element-plus	2.14.6	2.14.7
@types/node	26.6.2	26.6.4
sass	1.104.1	1.105.1
vite	8.3.0	8.3.2
vue-tsc	3.3.11	3.3.12

Updates hono from 4.13.8 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in honojs/hono#5445
• fix(jsx): allow JSXNode function component results in honojs/hono#5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
• test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
• fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
• chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits

• 08a023c 4.13.13
• ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
• f23b146 fix(jsx): allow JSXNode function component results (#5476)
• 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
• deff529 test(client): simulate network error for undefined route in parseResponse tes...
• 6abd35b 4.13.12
• 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
• afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
• e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
• c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.4

Commits

• See full diff in compare view

Updates wrangler from 4.136.2 to 4.147.0

Release notes

Sourced from wrangler's releases.

wrangler@4.147.0

Minor Changes

• #15928 7f57b1c Thanks @​ichernetsky-cf! - Allow "us" as a jurisdiction for Container applications

  Container placement constraints now accept constraints.jurisdiction: "us" in Wrangler and typed Cloudflare configuration. This makes the US jurisdiction available alongside "eu" and "fedramp".

Patch Changes

• #15974 7f700ef Thanks @​martinezjandrew! - Fix wrangler containers list to report live instances

  The LIVE INSTANCES column now reports each application's active runtime instances instead of its configured instance count, matching the Cloudflare dashboard. JSON output continues to expose the configured count through the existing instances field.

• #15980 90e6a1b Thanks @​martinezjandrew! - Accept Durable Object application IDs in Containers commands

  wrangler containers instances and wrangler containers delete now accept the 32-character hexadecimal application IDs returned for Durable Object-backed applications, in addition to legacy dashed UUIDs.

• #15871 6a4b0fe Thanks @​tw4! - Retry transient API failures in wrangler workflows instances list and wrangler workflows instances describe

  Previously, a single temporary 5xx response or dropped connection made these read-only commands exit with an error, even though the next request would have succeeded. They now use Wrangler's existing bounded API retry handling. The read that resolves --id latest is retried too, which also benefits the other wrangler workflows instances commands that accept latest; the mutating requests they make afterwards are not retried. Persistent failures are still reported after the retries are exhausted, and under --json any retry notices are written to stderr so stdout stays valid JSON.

• Updated dependencies []:

  • miniflare@5.20261001.0-alpha

wrangler@4.146.0

Minor Changes

• #15777 464a582 Thanks @​Naapperas! - Support the new Workflows createBatch() API in local development

  Local Workflows bindings now accept object-form batches that create instances from a count or a list of instance options. The result includes handles for created instances and indexed per-instance errors, matching the runtime API while preserving the deprecated array form.

• #15639 aee2842 Thanks @​hugo-vicente11! - Add --allowed-mail to the experimental wrangler tunnel quick-start command

  The option forwards exact email addresses, comma-separated lists, and wildcard domains to cloudflared. It can be specified more than once to combine multiple recipient rules.

  Email-protected tunnels require cloudflared 2026.9.2 or later. Wrangler checks the selected binary before starting the tunnel and reports an upgrade error when it is incompatible.

Patch Changes

• #15992 b8e7cc3 Thanks @​zebp! - Mark wrangler artifacts commands as open beta

  Artifacts has entered open beta, so the wrangler artifacts commands no longer display a "private beta" label in help output and warnings.

• #15984 9d7b08e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260930.2	^5.20261001.1

... (truncated)

Commits

• 64c1337 Version Packages (#15996)
• 6a4b0fe [wrangler] Retry transient failures in workflows instances list and describe ...
• 7f700ef CC-8799: report active instead of configured instances in containers list (#1...
• 90e6a1b CC-8800: accept durable object app ids in container commands (#15980)
• b4954c1 Version Packages (#15983)
• b8e7cc3 [wrangler] Mark Artifacts commands as open beta (#15992)
• aee2842 [wrangler] Support email-protected Quick Tunnels (#15639)
• efd67e6 [wrangler] Keep colons in wrangler tail --header filter values (#15959)
• 89061a4 Version Packages (#15957)
• 4a5ab6c Preserve existing secret bindings during Worker deployments (#15964)
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.4

Commits

• See full diff in compare view

Updates @types/node from 26.6.2 to 26.6.4

Commits

• See full diff in compare view

Updates element-plus from 2.14.6 to 2.14.7

Release notes

Sourced from element-plus's releases.

2.14.7

2026-09-30

Bug fixes

• Build restore workspace context for package publishing (#24934 by @​rzzf)

• Components [time-picker] avoid triggering change twice when clearing (#24841 by @​patienry)

• Improvement(components): [image-viewer] add grab cursor to image viewer (#24903 by @​ixyzorg)

Changelog

Sourced from element-plus's changelog.

2.14.7

2026-09-30

Bug fixes

• Build restore workspace context for package publishing (#24934 by @​rzzf)
• Components [time-picker] avoid triggering change twice when clearing (#24841 by @​patienry)
• Improvement(components): [image-viewer] add grab cursor to image viewer (#24903 by @​ixyzorg)

Commits

• 77d5c32 Merge pull request #24942 from element-plus/dev
• ff6b12d chore: Update changelog 2.14.7 (#24943)
• 307b91c fix(components): [time-picker] avoid triggering change twice when clearing ...
• f78ce0a chore(deps): update all patch devdependencies to ^5.0.2 (#24925)
• 95b63f3 chore(deps): update dawidd6/action-download-artifact action to v27 (#24938)
• 06efb57 chore(deps): update pnpm to v12.8.1 (#24937)
• 1bfc79c chore(deps): update dependency lint-staged to v17.6.0 (#24931)
• 80af5a1 fix(build): restore workspace context for package publishing (#24934)
• 92d3e8f chore(deps): update dependency @​types/node to ^24.19.0 (#24930)
• 7780bc6 chore(deps): update dawidd6/action-download-artifact action to v25 (#24932)
• Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.4

Commits

• See full diff in compare view

Updates sass from 1.104.1 to 1.105.1

Release notes

Sourced from sass's releases.

Dart Sass 1.105.1

To install Sass 1.105.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Improve error messages for @extends across different media queries.

See the full changelog for changes in earlier releases.

Dart Sass 1.105.0

To install Sass 1.105.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Add support for first-class modules. These can be accessed using the new meta.load() and meta.get-module() functions, and may be passed as the $module argument to numerous eisting sass:meta functions.

• Add the meta.css() mixin, which includes CSS from a first-class module.

JS API

• Add a SassModule class and a corresponding Value.assertModule() method.

Dart API

• Add a SassModule class and a corresponding Value.assertModule() method.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.105.1

• Improve error messages for @extends across different media queries.

1.105.0

• Add support for first-class modules. These can be accessed using the new meta.load() and meta.get-module() functions, and may be passed as the $module argument to numerous eisting sass:meta functions.

• Add the meta.css() mixin, which includes CSS from a first-class module.

JS API

• Add a SassModule class and a corresponding Value.assertModule() method.

Dart API

• Add a SassModule class and a corresponding Value.assertModule() method.

Commits

• db3c666 Merge pull request #2869 from sass/extend-media-errors
• 2ac4515 Improve span boundaries for media queries and selectors
• 706cfbf Fix InterpolationMap._expandInterpolationSpanRight()
• 792a948 Bump bufbuild/buf-action from 1.5.0 to 1.6.0 in /.github/util/initialize (#2870)
• 61ab702 Improve errors for @extend across media queries
• 288d4e2 Auto-merge dependabot PRs as the Sass bot account (#2866)
• 4bf2b92 Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#2865)
• 850d57e [meta.load] Add support for meta.load() and related features (#2861)
• 6180be0 Bump postcss from 8.5.26 to 8.5.28 in /pkg/sass-parser (#2863)
• See full diff in compare view

Updates vite from 8.3.0 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

v8.3.1

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

8.3.1 (2026-09-24)

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Commits

• 1003321 release: v8.3.2 (#23623)
• 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
• 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
• 89574f6 perf: avoid encoding intermediate source maps (#23461)
• 5a3a010 fix(server): release previous environments after initialization (#23499)
• 1929b4c docs: fix dead og-image PNG links in vite6/vite7 changelog entries (#23594)
• 6894f5c fix(server): handle file watcher errors without crashing (#23503)
• cf5c028 perf(build): avoid quadratic link scan in the preload helper (#23510)
• bba3bb8 fix: merge build.rolldownOptions.output.minify correctly (#23536)
• 5e4b9ca fix(optimize-deps): avoid "unsupported" warnings for browser:false mappings (...
• Additional commits viewable in compare view

Updates vue-tsc from 3.3.11 to 3.3.12

Release notes

Sourced from vue-tsc's releases.

v3.3.12

language-core

• security: improved handling of untrusted Vue files (cea0698)
• feat: infer first parameter type of default factory for defineModel (1be73b8)
• feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)
• fix: keep union props when using withDefaults (084f30f)
• fix: keep inference-only props string single-line with block comments (55ca36f)
• fix: support calling template bindings without .value (7ad4a94)
• fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)
• fix: pad directive hook signatures to check short-arity directive bindings (94052b8)
• fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)
• fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)
• fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)
• fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)
• perf: precompile attribute glob matchers (7d2e603)

component-meta

• fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

• fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

• fix: prevent watch mode crash on incremental build (a59da36)

vscode

• perf: reduce focus mode overhead (b0936d1)

Contributors: @​johnsoncodehk, @​serkodev, @​KazariEX, @​00200200, @​camonunez, @​Cherry, @​hungateJoseph, @​uturnr, @​ValentinYoushkevich, @​xia-chao

Changelog

Sourced from vue-tsc's changelog.

3.3.12 (2026-10-02)

language-core

• security: improved handling of untrusted Vue files (cea0698)
• feat: infer first parameter type of default factory for defineModel (1be73b8)
• feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)
• fix: keep union props when using withDefaults (084f30f)
• fix: keep inference-only props string single-line with block comments (55ca36f)
• fix: support calling template bindings without .value (7ad4a94)
• fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)
• fix: pad directive hook signatures to check short-arity directive bindings (94052b8)
• fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)
• fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)
• fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)
• fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)
• perf: precompile attribute glob matchers (7d2e603)

component-meta

• fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

• fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

• fix: prevent watch mode crash on incremental build (a59da36)

vscode

• perf: reduce focus mode overhead (b0936d1)

Contributors: @​johnsoncodehk, @​serkodev, @​KazariEX, @​00200200, @​camonunez, @​Cherry, @​hungateJoseph, @​uturnr, @​ValentinYoushkevich, @​xia-chao

Commits

• cea0698 v3.3.12 (#6234)
• d4d4139 fix(language-core): stop typedef jsdoc from leaking into emitted dts
• 045a6a7 fix(component-meta): stop checking JS Vue files as TS (#6231)
• a59da36 fix(tsc): prevent watch mode crash on incremental build (#6213)
• 94052b8 fix(language-core): pad directive hook signatures to check short-arity direct...
• ffb85e5 fix(language-core): report duplicate non-identifier CSS module names (#6199)
• d41d919 feat(language-core): report duplicate CSS module names (#6198)
• 3167acf test(tsc): assert emitted declarations are self-contained and add jsxSlots te...
• d797f44 chore(deps): upgrade Vue to 3.6.0-rc.6 (#6189)
• 04954dd fix(language-core): eliminate unmapped codegen diagnostics (#6179)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.