Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Bump the npm_and_yarn group across 5 directories with 11 updates#2

Open
dependabot[bot] wants to merge 1 commit intomain from
dependabot/npm_and_yarn/npm_and_yarn-4c07c5fa54
Open

Bump the npm_and_yarn group across 5 directories with 11 updates #2
dependabot[bot] wants to merge 1 commit intomain from
dependabot/npm_and_yarn/npm_and_yarn-4c07c5fa54

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Jan 8, 2026

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
vitest 1.6.0 1.6.1
next 14.2.5 14.2.35
hono 4.6.3 4.10.3
tsup 8.3.0 8.3.5
@astrojs/node 8.3.4 9.4.1
astro 4.15.10 5.15.9
@remix-run/node 2.12.0 2.17.2
@remix-run/react 2.12.0 2.17.3
vite 5.4.8 5.4.21

Bumps the npm_and_yarn group with 1 update in the /examples/nextjs directory: next.
Bumps the npm_and_yarn group with 3 updates in the /examples/remix directory: @remix-run/node, @remix-run/react and vite.
Bumps the npm_and_yarn group with 1 update in the /packages/baseai directory: vitest.
Bumps the npm_and_yarn group with 1 update in the /packages/core directory: vitest.

Updates vitest from 1.6.0 to 1.6.1

Release notes

Sourced from vitest's releases.

v1.6.1

This release includes security patches for:

🐞 Bug Fixes

View changes on GitHub
Commits

Updates next from 14.2.5 to 14.2.35

Release notes

Sourced from next's releases.

v14.2.35

Please see the Next.js Security Update for information about this security patch.

Commits

Updates hono from 4.6.3 to 4.10.3

Release notes

Sourced from hono's releases.

v4.10.3

Securiy Fix

A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.10.2...v4.10.3

v4.10.2

Security hardening improvement

If you are using JWT middleware, please read the following and consider applying the configuration.

Improper Authorization in Hono (JWT Audience Validation)

Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up).

The issue is addressed by adding a new verification.aud configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification.

Recommended secure configuration

You can enable RFC 7519–compliant audience validation using the new verification.aud option:

import { Hono } from 'hono'
import { jwt } from 'hono/jwt'
const app = new Hono()
app.use(
'/api/*',
jwt({
secret: 'my-secret',
verification: {
// Require this API to only accept tokens with aud = 'service-a'
aud: 'service-a',
},
})
)

What's Changed

... (truncated)

Commits
  • fcefd50 4.10.3
  • 95ae4d3 refactor(jwt): reduce the size of the code generated by minification (#4480)
  • d9b8b4b Merge commit from fork
  • 5216117 fix(request-id): validation accepts = (#4478)
  • 253ec28 fix(aws-lambda): serve microsoft office files as binary in lambda handler (#4...
  • 0c6455d 4.10.2
  • 45ba3bf Merge commit from fork
  • 4cbad8b tests: Fix test case of handlers without a path (#4472)
  • db764c2 4.10.1
  • 8774bf9 fix(types): cannot .use non-return mw from createMiddleware (#4465)
  • Additional commits viewable in compare view

Updates tsup from 8.3.0 to 8.3.5

Release notes

Sourced from tsup's releases.

v8.3.5

🐞 Bug Fixes

View changes on GitHub

v8.3.4

No significant changes

View changes on GitHub

v8.3.3

No significant changes

View changes on GitHub

v8.3.1

🚀 Features

🐞 Bug Fixes

View changes on GitHub
Commits

Updates @astrojs/node from 8.3.4 to 9.4.1

Changelog

Sourced from @​astrojs/node's changelog.

9.4.1

Patch Changes

  • 5fc3c59 Thanks @​ematipico! - Fixes a routing bug in standalone mode with trailingSlash set to "always".

9.4.0

Minor Changes

  • #14188 e3422aa Thanks @​ascorbic! - Adds support for specifying a host to load prerendered error pages

    By default, if a user defines a custom error page that is prerendered, Astro will load it from the same host as the one that the request is made to. This change allows users to specify a different host for loading prerendered error pages. This can be useful in scenarios such as where the server is running behind a reverse proxy or when prerendered pages are hosted on a different domain.

    To use this feature, set the experimentalErrorPageHost adapter option in your Astro configuration to the desired host URL. For example, if your server is running on localhost and served via a proxy, you can ensure the prerendered error pages are fetched via the localhost URL:

    import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
export default defineConfig({
 adapter: node({
 // If your server is running on localhost and served via a proxy, set the host like this to ensure prerendered error pages are fetched via the localhost URL
 experimentalErrorPageHost: 'http://localhost:4321',
 }),
});

    For more information on enabling and using this experimental feature, see the @astrojs/node adapter docs.

9.3.3

Patch Changes

  • Updated dependencies [0567fb7]:
    • @​astrojs/internal-helpers@​0.7.1

9.3.2

Patch Changes

  • Updated dependencies [f4e8889]:
    • @​astrojs/internal-helpers@​0.7.0

9.3.1

Patch Changes

9.3.0

... (truncated)

Commits

Updates astro from 4.15.10 to 5.15.9

Release notes

Sourced from astro's releases.

astro@5.15.9

Patch Changes

  • #14786 758a891 Thanks @​mef! - Add handling of invalid encrypted props and slots in server islands.

  • #14783 504958f Thanks @​florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration

  • #14791 9e9c528 Thanks @​Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.

    In order to allow data URIs for remote images, you will need to update your astro.config.mjs file to include the following configuration:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
images: {
remotePatterns: [
{
protocol: 'data',
},
],
},
});

  • #14787 0f75f6b Thanks @​matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dots

    Previously, hostnames like localhost or other single-part names would incorrectly match patterns like *.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.

  • #14776 3537876 Thanks @​ktym4a! - Fixes the behavior of passthroughImageService so it does not generate webp.

  • Updated dependencies [9e9c528, 0f75f6b]:

    • @​astrojs/internal-helpers@​0.7.5
    • @​astrojs/markdown-remark@​6.3.9

astro@5.15.8

Patch Changes

  • #14772 00c579a Thanks @​matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don't explicitly support slots.

    Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.

  • #14771 6f80081 Thanks @​matthewp! - Fix middleware pathname matching by normalizing URL-encoded paths

    Middleware now receives normalized pathname values, ensuring that encoded paths like /%61dmin are properly decoded to /admin before middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.

astro@5.15.7

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

4.16.16

Patch Changes

4.16.15

Patch Changes

4.16.14

Patch Changes

4.16.13

Patch Changes

  • #12436 453ec6b Thanks @​martrapp! - Fixes a potential null access in the clientside router

  • #12392 0462219 Thanks @​apatel369! - Fixes an issue where scripts were not correctly injected during the build. The issue was triggered when there were injected routes with the same entrypoint and different pattern

4.16.12

Patch Changes

  • #12420 acac0af Thanks @​ematipico! - Fixes an issue where the dev server returns a 404 status code when a user middleware returns a valid Response.

4.16.11

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.


Updates @remix-run/node from 2.12.0 to 2.17.2

Release notes

Sourced from @​remix-run/node's releases.

v2.17.2

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2172

remix v2.17.1

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2171

Commits

Updates @remix-run/react from 2.12.0 to 2.17.3

Release notes

Sourced from @​remix-run/react's releases.

v2.17.3

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2173

v2.17.2

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2172

remix v2.17.1

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2171

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​remix-run/react since your current version.


Updates vite from 5.4.8 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

v5.4.18

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025年10月20日)

5.4.20 (2025年09月08日)

5.4.19 (2025年04月30日)

5.4.18 (2025年04月10日)

5.4.17 (2025年04月03日)

5.4.16 (2025年03月31日)

5.4.15 (2025年03月24日)

5.4.14 (2025年01月21日)

... (truncated)

Commits

Updates devalue from 5.1.1 to 5.6.1

Release notes

Sourced from devalue's releases.

v5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

v5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

  • ae904c5: fix: correctly differentiate between +0 and -0

v5.3.0

Minor Changes

  • 2896e7b: feat: support Temporal

... (truncated)

Changelog

Sourced from devalue's changelog.

5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

5.3.1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.


Updates prismjs from 1.29.0 to 1.30.0

Release notes

Sourced from prismjs's releases.

v1.30.0

What's Changed

New Contributors

Full Changelog: PrismJS/prism@v1.29.0...v1.30.0

Changelog

Sourced from prismjs's changelog.

Prism Changelog

Commits
Maintainer changes

This version was pushed to npm by dmitrysharabin, a new releaser for prismjs since your current version.


Updates next from 14.2.5 to 14.2.35

Release notes

Sourced from next's releases.

v14.2.35

Please see the Next.js Security Update for information about this security patch.

Commits

Updates @remix-run/node from 2.12.0 to 2.17.2

Release notes

Sourced from @​remix-run/node's releases.

v2.17.2

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2172

remix v2.17.1

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2171

Commits

Updates @remix-run/react from 2.12.0 to 2.17.3

Release notes

Sourced from @​remix-run/react's releases.

v2.17.3

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2173

v2.17.2

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2172

remix v2.17.1

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2171

Commits 

Bumps the npm_and_yarn group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.6.0` | `1.6.1` |
| [next](https://github.com/vercel/next.js) | `14.2.5` | `14.2.35` |
| [hono](https://github.com/honojs/hono) | `4.6.3` | `4.10.3` |
| [tsup](https://github.com/egoist/tsup) | `8.3.0` | `8.3.5` |
| [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `8.3.4` | `9.4.1` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `4.15.10` | `5.15.9` |
| [@remix-run/node](https://github.com/remix-run/remix/tree/HEAD/packages/remix-node) | `2.12.0` | `2.17.2` |
| [@remix-run/react](https://github.com/remix-run/remix/tree/HEAD/packages/remix-react) | `2.12.0` | `2.17.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.8` | `5.4.21` |
Bumps the npm_and_yarn group with 1 update in the /examples/nextjs directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 3 updates in the /examples/remix directory: [@remix-run/node](https://github.com/remix-run/remix/tree/HEAD/packages/remix-node), [@remix-run/react](https://github.com/remix-run/remix/tree/HEAD/packages/remix-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 1 update in the /packages/baseai directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).
Bumps the npm_and_yarn group with 1 update in the /packages/core directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).
Updates `vitest` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v1.6.1/packages/vitest)
Updates `next` from 14.2.5 to 14.2.35
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.2.5...v14.2.35)
Updates `hono` from 4.6.3 to 4.10.3
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.6.3...v4.10.3)
Updates `tsup` from 8.3.0 to 8.3.5
- [Release notes](https://github.com/egoist/tsup/releases)
- [Commits](egoist/tsup@v8.3.0...v8.3.5)
Updates `@astrojs/node` from 8.3.4 to 9.4.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/node@9.4.1/packages/integrations/node)
Updates `astro` from 4.15.10 to 5.15.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG-v4.md)
- [Commits](https://github.com/withastro/astro/commits/astro@5.15.9/packages/astro)
Updates `@remix-run/node` from 2.12.0 to 2.17.2
- [Release notes](https://github.com/remix-run/remix/releases)
- [Commits](https://github.com/remix-run/remix/commits/remix@2.17.2/packages/remix-node)
Updates `@remix-run/react` from 2.12.0 to 2.17.3
- [Release notes](https://github.com/remix-run/remix/releases)
- [Commits](https://github.com/remix-run/remix/commits/remix@2.17.3/packages/remix-react)
Updates `vite` from 5.4.8 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)
Updates `devalue` from 5.1.1 to 5.6.1
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.1.1...v5.6.1)
Updates `prismjs` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/PrismJS/prism/releases)
- [Changelog](https://github.com/PrismJS/prism/blob/v2/CHANGELOG.md)
- [Commits](PrismJS/prism@v1.29.0...v1.30.0)
Updates `next` from 14.2.5 to 14.2.35
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.2.5...v14.2.35)
Updates `@remix-run/node` from 2.12.0 to 2.17.2
- [Release notes](https://github.com/remix-run/remix/releases)
- [Commits](https://github.com/remix-run/remix/commits/remix@2.17.2/packages/remix-node)
Updates `@remix-run/react` from 2.12.0 to 2.17.3
- [Release notes](https://github.com/remix-run/remix/releases)
- [Commits](https://github.com/remix-run/remix/commits/remix@2.17.3/packages/remix-react)
Updates `vite` from 5.4.8 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)
Updates `vitest` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v1.6.1/packages/vitest)
Updates `vitest` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v1.6.1/packages/vitest)
---
updated-dependencies:
- dependency-name: vitest
 dependency-version: 1.6.1
 dependency-type: direct:development
 dependency-group: npm_and_yarn
- dependency-name: next
 dependency-version: 14.2.35
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: hono
 dependency-version: 4.10.3
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: tsup
 dependency-version: 8.3.5
 dependency-type: direct:development
 dependency-group: npm_and_yarn
- dependency-name: "@astrojs/node"
 dependency-version: 9.4.1
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: astro
 dependency-version: 5.15.9
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: "@remix-run/node"
 dependency-version: 2.17.2
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: "@remix-run/react"
 dependency-version: 2.17.3
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: vite
 dependency-version: 5.4.21
 dependency-type: direct:development
 dependency-group: npm_and_yarn
- dependency-name: devalue
 dependency-version: 5.6.1
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: prismjs
 dependency-version: 1.30.0
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: next
 dependency-version: 14.2.35
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: "@remix-run/node"
 dependency-version: 2.17.2
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: "@remix-run/react"
 dependency-version: 2.17.3
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: vite
 dependency-version: 5.4.21
 dependency-type: direct:development
 dependency-group: npm_and_yarn
- dependency-name: vitest
 dependency-version: 1.6.1
 dependency-type: direct:development
 dependency-group: npm_and_yarn
- dependency-name: vitest
 dependency-version: 1.6.1
 dependency-type: direct:development
 dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

AltStyle によって変換されたページ (->オリジナル) /