[dependabot]

Bumps the minor-and-patch group with 122 updates in the / directory:

Package	From	To
dependency-cruiser	18.7.0	18.7.2
nx	24.0.1	24.0.4
ws	8.22.0	8.22.1
confbox	0.3.1	0.3.2
serialize-error	13.0.2	13.1.0
bun-types	1.4.3	1.4.4
happy-dom	21.0.3	21.0.4
basic-ftp	6.2.3	6.2.6
mongodb	7.7.0	7.8.0
@hono/node-server	2.1.5	2.1.6
hono	4.13.13	4.13.16
@cloudflare/vite-plugin	1.64.0	1.67.0
@cloudflare/workers-types	5.20261019.1	5.20261106.1
vite	8.3.4	8.3.6
wrangler	4.151.0	4.158.0
@napi-rs/cli	3.10.8	3.10.12
@biomejs/biome	2.5.15	2.6.5
@types/bun	1.4.3	1.4.4
@types/node	26.6.5	26.6.6
@biomejs/cli-darwin-arm64	2.5.15	2.6.5
@biomejs/cli-darwin-x64	2.5.15	2.6.5
@biomejs/cli-linux-arm64-musl	2.5.15	2.6.5
@biomejs/cli-linux-arm64	2.5.15	2.6.5
@biomejs/cli-linux-x64-musl	2.5.15	2.6.5
@biomejs/cli-linux-x64	2.5.15	2.6.5
@biomejs/cli-win32-arm64	2.5.15	2.6.5
@biomejs/cli-win32-x64	2.5.15	2.6.5
@inquirer/checkbox	5.2.6	5.2.8
@inquirer/editor	5.3.4	5.3.6
@inquirer/expand	5.1.6	5.1.8
@inquirer/external-editor	3.0.6	3.0.7
@inquirer/input	5.1.7	5.1.9
@inquirer/number	4.2.4	4.2.6
@inquirer/password	5.2.3	5.2.5
@inquirer/prompts	8.7.3	8.7.5
@inquirer/rawlist	5.3.6	5.3.8
@inquirer/search	4.3.4	4.3.6
@inquirer/select	5.2.6	5.2.8
@mongodb-js/saslprep	1.6.0	1.6.1
@napi-rs/cross-toolchain	1.0.3	1.0.5
@napi-rs/lzma-android-arm-eabi	1.5.1	1.5.3
@napi-rs/lzma-android-arm64	1.5.1	1.5.3
@napi-rs/lzma-darwin-arm64	1.5.1	1.5.3
@napi-rs/lzma-darwin-x64	1.5.1	1.5.3
@napi-rs/lzma-freebsd-x64	1.5.1	1.5.3
@napi-rs/lzma-linux-arm-gnueabihf	1.5.1	1.5.3
@napi-rs/lzma-linux-arm64-gnu	1.5.1	1.5.3
@napi-rs/lzma-linux-arm64-musl	1.5.1	1.5.3
@napi-rs/lzma-linux-ppc64-gnu	1.5.1	1.5.3
@napi-rs/lzma-linux-riscv64-gnu	1.5.1	1.5.3
@napi-rs/lzma-linux-s390x-gnu	1.5.1	1.5.3
@napi-rs/lzma-linux-x64-musl	1.5.1	1.5.3
@napi-rs/lzma-wasm32-wasi	1.5.1	1.5.3
@napi-rs/lzma-win32-arm64-msvc	1.5.1	1.5.3
@napi-rs/lzma-win32-ia32-msvc	1.5.1	1.5.3
@napi-rs/lzma-win32-x64-msvc	1.5.1	1.5.3
@napi-rs/lzma	1.5.1	1.5.3
@napi-rs/tar-android-arm-eabi	1.1.1	1.1.3
@napi-rs/tar-android-arm64	1.1.1	1.1.3
@napi-rs/tar-darwin-arm64	1.1.1	1.1.3
@napi-rs/tar-darwin-x64	1.1.1	1.1.3
@napi-rs/tar-freebsd-x64	1.1.1	1.1.3
@napi-rs/tar-linux-arm-gnueabihf	1.1.1	1.1.3
@napi-rs/tar-linux-arm64-gnu	1.1.1	1.1.3
@napi-rs/tar-linux-arm64-musl	1.1.1	1.1.3
@napi-rs/tar-linux-ppc64-gnu	1.1.1	1.1.3
@napi-rs/tar-linux-s390x-gnu	1.1.1	1.1.3
@napi-rs/tar-linux-x64-gnu	1.1.1	1.1.3
@napi-rs/tar-linux-x64-musl	1.1.1	1.1.3
@napi-rs/tar-wasm32-wasi	1.1.1	1.1.3
@napi-rs/tar-win32-arm64-msvc	1.1.1	1.1.3
@napi-rs/tar-win32-ia32-msvc	1.1.1	1.1.3
@napi-rs/tar-win32-x64-msvc	1.1.1	1.1.3
@napi-rs/tar	1.1.1	1.1.3
@napi-rs/wasm-tools-android-arm-eabi	1.1.0	1.1.2
@napi-rs/wasm-tools-android-arm64	1.1.0	1.1.2
@napi-rs/wasm-tools-darwin-arm64	1.1.0	1.1.2
@napi-rs/wasm-tools-darwin-x64	1.1.0	1.1.2
@napi-rs/wasm-tools-freebsd-x64	1.1.0	1.1.2
@napi-rs/wasm-tools-linux-arm64-gnu	1.1.0	1.1.2
@napi-rs/wasm-tools-linux-arm64-musl	1.1.0	1.1.2
@napi-rs/wasm-tools-linux-x64-gnu	1.1.0	1.1.2
@napi-rs/wasm-tools-linux-x64-musl	1.1.0	1.1.2
@napi-rs/wasm-tools-wasm32-wasi	1.1.0	1.1.2
@napi-rs/wasm-tools-win32-arm64-msvc	1.1.0	1.1.2
@napi-rs/wasm-tools-win32-ia32-msvc	1.1.0	1.1.2
@napi-rs/wasm-tools-win32-x64-msvc	1.1.0	1.1.2
@napi-rs/wasm-tools	1.1.0	1.1.2
@nx/nx-darwin-arm64	24.0.1	24.0.4
@nx/nx-darwin-x64	24.0.1	24.0.4
@nx/nx-freebsd-x64	24.0.1	24.0.4
@nx/nx-linux-arm-gnueabihf	24.0.1	24.0.4
@nx/nx-linux-arm64-gnu	24.0.1	24.0.4
@nx/nx-linux-arm64-musl	24.0.1	24.0.4
@nx/nx-linux-x64-gnu	24.0.1	24.0.4
@nx/nx-linux-x64-musl	24.0.1	24.0.4
@nx/nx-win32-arm64-msvc	24.0.1	24.0.4
@nx/nx-win32-x64-msvc	24.0.1	24.0.4
@oxc-project/types	0.153.0	0.156.0
@rolldown/binding-android-arm-eabi	1.2.13	1.2.16
@rolldown/binding-android-arm64	1.2.13	1.2.16
@rolldown/binding-darwin-arm64	1.2.13	1.2.16
@rolldown/binding-darwin-x64	1.2.13	1.2.16
@rolldown/binding-freebsd-x64	1.2.13	1.2.16
@rolldown/binding-linux-arm-gnueabihf	1.2.13	1.2.16
@rolldown/binding-linux-arm64-gnu	1.2.13	1.2.16
@rolldown/binding-linux-arm64-musl	1.2.13	1.2.16
@rolldown/binding-linux-ppc64-gnu	1.2.13	1.2.16
@rolldown/binding-linux-s390x-gnu	1.2.13	1.2.16
@rolldown/binding-linux-x64-gnu	1.2.13	1.2.16
@rolldown/binding-linux-x64-musl	1.2.13	1.2.16
@rolldown/binding-openharmony-arm64	1.2.13	1.2.16
@rolldown/binding-win32-arm64-msvc	1.2.13	1.2.16
@rolldown/binding-win32-x64-msvc	1.2.13	1.2.16
bson	7.3.3	7.3.4
es-toolkit	1.52.0	1.53.1
graphql	16.14.2	16.15.0
is-core-module	2.17.0	2.18.0
js-yaml	5.4.3	5.5.0
postcss	8.5.29	8.5.32
resolve	1.22.13	1.22.14
rolldown	1.2.13	1.2.16

Updates dependency-cruiser from 18.7.0 to 18.7.2

Release notes

Sourced from dependency-cruiser's releases.

v18.7.2

🐛 fixes

• e65bb5b4 fix(extract/resolve): adds correctly handling 'bundledDependencies: true' (#1120) thanks to @​sebdanielsson for finding and filing the issue that led to this fix.

👷 maintenance

• 4e2daa02 fix(manifest): updates contributor list with recent contributors
• a37c1cf6 chore(test): bumps minimum branch coverage up to current HWM
• 1ecdae89 build(npm): updates external dependencies

v18.7.1

🐛 fixes

• 2a46eecf fix(main/resolve-options): resolves tsconfig paths without baseUrl from the tsconfig directory (#1116) Thanks to @​thirtytwobits for raising the issue and @​Johannes7549 for making the fixing pull request!
• fd7889bf fix(extract/transpile): passes the file name to the typescript transpiler to prevent it choking on imports from './module' (#1118). Thanks to @​sebdanielsson for reporting the issue, finding the root cause and baking the fixing PR!

👷 maintenance

• 00ca161c build(npm): updates external dependencies
• 96a1dd35 doc(README): removes broken link
• c5b97371 chore(npm): refreshes lock-file
• dbe5e74e chore(Gort): makes agent instruction even more explicit
• 5adda5b2 chore(gha): replaces last remnant of yarn with node --run
• deea6a17 doc: corrects type references in jsdoc

Note for those eagerly awaiting typescript 7.1 support - thanks to @​buko106 there's a dependency-cruiser (beta) version that works with typescript 7.1 beta . The fixes in this (18.7.1) release combined with 7.1 beta support will be published as 18.8.0-beta-2.

Commits

• f51bc48 18.7.2
• 4e2daa0 fix(manifest): updates contributor list with recent contributors
• a37c1cf chore(test): bumps minimum branch coverage up to current HWM
• 1ecdae8 build(npm): updates external dependencies
• e65bb5b fix(extract/resolve): adds correctly handling 'bundledDependencies: true' (#1...
• 5173200 18.7.1
• 00ca161 build(npm): updates external dependencies
• fd7889b fix(extract/transpile): passes the file name to the typescript transpiler to ...
• 96a1dd3 doc(README): removes broken link
• 2a46eec fix(main/resolve-options): resolves tsconfig paths without baseUrl from the t...
• Additional commits viewable in compare view

Updates nx from 24.0.1 to 24.0.4

Release notes

Sourced from nx's releases.

24.0.4 (2026-11-03)

🩹 Fixes

• angular-rspack: respect component style minification (#37722, #37713)
• core: stop findImports when the jsx lexer stalls on multi-byte chars (#37695, #37687)
• core: prune task results before hash planning (#37714)
• core: keep cache restores and stores inside task outputs (#37661)
• core: harden git handling in nx import (#37663)
• core: verify and pin the nx versions that init and configure-ai-agents install (#37665)
• core: keep nx cloud credentials and task arguments out of analytics and urls (#37667)
• core: only serve the graph to local same-origin requests (#37668)
• core: hash uncovered node_modules reads and keep env out of runtime input logs (#37670)
• core: remove the duplicate redactUrlCredentials import (#37733)
• js: include yarn patch checksum in the external node hash (#37709)
• js: keep a workspace-root rootDir through the typescript plugin tsconfig cache (#37701, #37700)
• linter: correct converted eslint report paths and cache inferred reports (#37677, #37610)
• maven: only apply build state paths inside the workspace or build directory (#37671)
• misc: patch HTTP, XML and archive dependencies (#37693)
• misc: widen picomatch dependency from 4.0.4 to ^4.0.7 (#37698)
• release: treat git and commit-derived input as data in nx release (#37666)

❤️ Thank You

• Akinfenwa Obaseyi @​obaseyi2
• bylethviva @​bylethviva
• Cestercian @​cestercian
• Craigory Coppola @​AgentEnder
• Jacob Ley @​JacobLey
• Leosvel Pérez Espinosa @​leosvelperez
• Rahul Kashyap @​itisrmk

24.0.3 (2026-10-30)

🩹 Fixes

• angular-rspack: print diagnostic positions and full warning text (#37637, #37431)
• core: fix entryWhenNoChanges from adding empty lines to changelogs (#36516)
• core: detect package manager from workspace root in pnpm workspaces (#35003, #32579)
• core: resolve workspace-provided packages from the workspace root (#37272)
• core: recover project dependencies after configuration errors (#37611)
• core: fail run-commands tasks whose command cannot start (#37628)
• core: report continuous dependency inputs in nx show target --json (#37649)
• core: report skipped tasks and count summaries against the run total (#37626)
• core: load angular.json projects for nx executors converted to builders (#37645, #33651)
• core: keep claude md nx block that imports agents md (#37646)
• core: honor NO_PROXY forms and NODE_EXTRA_CA_CERTS in readyWhen url probes (#37676)
• core: support pnpm global virtual store installs in nx migrate (#37653, #37392)
• core: recover from native cache load failures (#37652)
• core: bump undici to 7.30.1 to patch security advisories (#37685, #37331)

... (truncated)

Commits

• 50b32e9 fix(core): remove the duplicate redactUrlCredentials import (#37733)
• 1434982 fix(core): hash uncovered node_modules reads and keep env out of runtime inpu...
• a429e42 fix(core): only serve the graph to local same-origin requests (#37668)
• 5a60701 fix(core): keep nx cloud credentials and task arguments out of analytics and ...
• b73509f fix(release): treat git and commit-derived input as data in nx release (#37666)
• 8437e92 fix(core): verify and pin the nx versions that init and configure-ai-agents i...
• 80debf7 fix(core): harden git handling in nx import (#37663)
• ca60009 fix(core): keep cache restores and stores inside task outputs (#37661)
• 599c8c9 fix(misc): patch HTTP, XML and archive dependencies (#37693)
• e0fbb66 fix(js): include yarn patch checksum in the external node hash (#37709)
• Additional commits viewable in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

• The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

• http.websocketMask() and http.websocketUnmask() are now used instead of the bufferutil variants when available (2ab3d3e5).
• Sender.frame() no longer returns empty chunks (85319a72).

Commits

• c18a80a [dist] 8.22.1
• 2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
• c9efa88 [ci] Test on node 27
• aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
• b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
• 85319a7 [minor] Prevent Sender.frame() from returning empty chunks
• See full diff in compare view

Updates confbox from 0.3.1 to 0.3.2

Release notes

Sourced from confbox's releases.

v0.3.2

compare changes

🔥 Performance

• format: Capture trailing whitespace in linear time (65f414f)

🩹 Fixes

• yaml: Use a non-zero indent when stringifying flat documents (#103)
• format: Honor an explicit indent of 0 or "" on parsed values (#99)
• format: Keep parse-time indent / preserveIndentation: false on stringify (a91779e)
• format: Ignore blank lines when detecting indent (0b8a560)

New Contributors

• @​RaphaelFakhri made their first contribution in unjs/confbox#103
• @​MFA-G made their first contribution in unjs/confbox#99

Changelog

Sourced from confbox's changelog.

v0.3.2

compare changes

🔥 Performance

• format: Capture trailing whitespace in linear time (65f414f)

🩹 Fixes

• yaml: Use a non-zero indent when stringifying flat documents (#103)
• format: Honor an explicit indent of 0 or "" on parsed values (#99)
• format: Keep parse-time indent / preserveIndentation: false on stringify (a91779e)
• format: Ignore blank lines when detecting indent (0b8a560)

🏡 Chore

• Update deps (d978538)
• Update vitest to v5 (05363ab)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Mochammad Fadhlan Al-Ghiffari (@​MFA-G)
• Raphael Fakhri rjf11@mail.aub.edu

Commits

• 199e223 chore(release): v0.3.2
• 0b8a560 fix(format): ignore blank lines when detecting indent
• 65f414f perf(format): capture trailing whitespace in linear time
• a91779e fix(format): keep parse-time indent / preserveIndentation: false on strin...
• ac337f1 fix(format): honor an explicit indent of 0 or "" on parsed values (#99)
• dafb56a fix(yaml): use a non-zero indent when stringifying flat documents (#103)
• bdd3840 chore(deps): update github-actions (#101)
• 05363ab chore: update vitest to v5
• d978538 chore: update deps
• eebbd54 chore(deps): update all non-major dependencies (#93)
• See full diff in compare view

Updates serialize-error from 13.0.2 to 13.1.0

Release notes

Sourced from serialize-error's releases.

v13.1.0

• Harden error serialization and constructor registration 1893fb0

---

sindresorhus/serialize-error@v13.0.2...v13.1.0

Commits

• 84eb6cf 13.1.0
• 1893fb0 Harden error serialization and constructor registration
• See full diff in compare view

Updates bun-types from 1.4.3 to 1.4.4

Release notes

Sourced from bun-types's releases.

Bun v1.4.4

To install Bun v1.4.4

curl -fsSL https://bun.com/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.4:

bun upgrade

Read Bun v1.4.4's release notes on Bun's blog

Thanks to 39 contributors!

• @​0xh3x
• @​1cedsoda
• @​alex-mextner
• @​alii
• @​Artoria2e5
• @​bompus
• @​C0casio45
• @​cirospaciari
• @​davidhevn
• @​deepshekhardas
• @​Dex4Sure
• @​dylan-conway
• @​EffortlessSteven
• @​eriklangille
• @​filipesarturi
• @​fredluz
• @​gerardp
• @​gohryt
• @​himself65
• @​hughescr
• @​Jarred-Sumner
• @​jdjkelly
• @​jecquas
• @​jobansd
• @​kernoeb
• @​KilianB
• @​MarshallOfSound
• @​Neekoras

... (truncated)

Commits

• a950fc5 Hardening follow-up: fix regressions from #46021 and more crashes (#46270)
• 9b4284f Hardening: fix crashes across the runtime, bundler, dev server, shell and CLI...
• 3880151 Move Crypto, TextDecoder, Bun.FileSystemRouter and three more classes t...
• 5667cd6 sql: fixes for problems found after the consolidation (#45304) (#45711)
• d0831bc Check published types against the bindgen schemas, honor memLevel and `stra...
• 017b243 sql: consolidate the open Bun.sql, bun:sqlite and node:sqlite pull requests (...
• f0c6cbc WebSocket: real closing handshake, one failure path, ws rewritten on native...
• 21620e2 Define eighteen Bun.* functions with the bindgen (#45450)
• e6f65f3 install: fix regressions and older bugs found after the package manager conso...
• 9510e74 install: consolidate the open package manager pull requests (#44968)
• Additional commits viewable in compare view

Updates happy-dom from 21.0.3 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• See full diff in compare view

Updates basic-ftp from 6.2.3 to 6.2.6

Release notes

Sourced from basic-ftp's releases.

6.2.6

• Fixed: Path traversal in downloadToDir(), fixes GHSA-2w5v-vj22-jp27.

6.2.5

• Changed: Releases are now built on GitHub Actions and published with npm provenance. Read RELEASING.md for the complete process.

6.2.4

• Fixed: A fact named __proto__ in an MLSD directory listing made listing a directory fail with a TypeError, fixes GHSA-5pm8-86m8-9m6r.

Changelog

Sourced from basic-ftp's changelog.

6.2.6

• Fixed: Path traversal in downloadToDir(), fixes GHSA-2w5v-vj22-jp27.

6.2.5

• Changed: Releases are now built on GitHub Actions and published with npm provenance. Read RELEASING.md for the complete process.

6.2.4

• Fixed: A fact named __proto__ in an MLSD directory listing made listing a directory fail with a TypeError, fixes GHSA-5pm8-86m8-9m6r.

Commits

• 1850100 Bump version
• 24eb41d Fix path traversal in downloadToDir(), see https://github.com/patrickjuchli...
• 2bf896e Reduce attack surface of CI
• 8cde939 Bump actions/checkout from 6 to 7 (#287)
• 5a011aa Bump actions/setup-node from 6 to 7 (#288)
• 18f3ba5 Harden release process
• 674fc09 Bump version
• 22f8935 Publish releases from Github
• ec91636 Fix wording
• 7b7a624 Include GHSA in fix changelog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for basic-ftp since your current version.

Updates mongodb from 7.7.0 to 7.8.0

Release notes

Sourced from mongodb's releases.

v7.8.0

7.8.0 (2026-10-30)

The MongoDB Node.js team is pleased to announce version 7.8.0 of the mongodb package!

Release Notes

[!WARNING]
Node Driver versions from v6.11.0 and from v7.0.0 before v7.8.0 (this release) are affected by a security issue related to the use of the experimental timeoutMS feature where connection pool desynchronization after operation timeout can expose other users' data (CVE-2026-119179). Users are encouraged to discontinue the use of timeoutMS as soon as possible.

[!WARNING] Node Driver versions from v3.3.3 before v7.8.0 (this release) are affected by a security issue concerning the verification of host names returned by SRV lookups, which could allow an attacker in control of the DNS response to redirect the driver to a host outside the user's domain. Users using SRV records are encouraged to upgrade to v7.8.0 as soon as possible.

timeoutMS is deprecated and now a no-op

[!WARNING] timeoutMS and timeoutMode are deprecated and have no effect starting in this release. They are still accepted and will not throw, but operations will no longer time out because of them. They are slated for removal in a future release.

Use the per-stage timeouts instead: serverSelectionTimeoutMS, waitQueueTimeoutMS, socketTimeoutMS, and maxTimeMS for server-side execution.

Configurable SRV host validation

This release adds two new methods of validating DNS:

1. srvAllowedHostsSuffix - A host name suffix that every host returned by the SRV lookup must end with. This option can be configured on the client or the connection string.
2. srvHostValidator - A synchronous function that decides whether a host returned by the SRV lookup may be used. This option can only be configured on the client. This function must accept a string and has to return a boolean; returning anything else, including the Promise returned by an async function, will result in an error.

[!WARNING] Modifying the default SRV domain name validation can create vulnerabilities.

SRV host names are now compared in a normalized form (case-insensitively, without a trailing dot, and with internationalized names in xn-- form). Connection strings whose SRV host name differs in case from the host names returned by DNS, such as mongodb+srv://TEST1.TEST.BUILD.10GEN.CC, previously failed SRV verification and now connect.

zstd compression no longer requires @mongodb-js/zstd on Node.js 22.15.0+

The driver now uses Node.js' built-in zstd implementation when it is available. On older Node.js versions it continues to use @mongodb-js/zstd, so no changes are needed for existing setups.

Thanks to @​axelonet for the original contribution!

Distinguish between command-level options and index-level options when creating indexes

Before:

// Index options and command options were on the same object
await collection.createIndex(
  { email: 1 },
  {
    // index options
    unique: true,
    name: 'email_unique',
    // command options
    commitQuorum: 'majority',
</tr></table> 

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.8.0 (2026-10-30)

Features

• NODE-6893: Distinguish between command-level options and index-level options when creating indexes (#5012) (ca0e451)
• NODE-7097: use Node.js built-in zstd when available (#5073) (b7eb8fd)
• NODE-7657: remove @​experimental tags from no-longer-experimental features (#5058) (694a848)
• NODE-7830: add srvAllowedHostsSuffix and srvHostValidator options (#5065) (19e2d3b)
• NODE-7958: make timeoutMS a no-op and deprecate it (#5085) (8345fe1)

Bug Fixes

• NODE-7643: preserve $meta direction in [field, direction] sort pair (#4988) (16136bb)
• NODE-7659: key unordered bulk insertedIds by originating operation index (#4989) (df513cf)
• NODE-7764: use $eq to match file IDs in GridFS queries (#5068) (218b6d7)
• NODE-7881: hello command is compressed (#5072) (399045a)

Commits

• c406cab chore(main): release 7.8.0 (#5070)
• 9c54464 docs: remove timeoutMS from experimental features (#5087)
• 8345fe1 feat(NODE-7958): make timeoutMS a no-op and deprecate it (#5085)
• 853ff46 ci(NODE-7963): pin node v26 in ci (#5086)
• 19e2d3b feat(NODE-7830): add srvAllowedHostsSuffix and srvHostValidator options (#5065)
• b7eb8fd feat(NODE-7097): use Node.js built-in zstd when available (#5073)
• 2a13e4b chore(NODE-6984): skip flaky CSOT test (#5079)
• 399045a fix(NODE-7881): hello command is compressed (#5072)
• ef6f6f3 chore(NODE-7833): 'latest' server binary behind s3 (#5074)
• 16136bb fix(NODE-7643): preserve $meta direction in [field, direction] sort pair (#4988)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.5 to 2.1.6

Release notes

Sourced from @​hono/node-server's releases.

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

Commits

• 123f782 2.1.6
• cfaa79f Merge commit from fork
• 61cc026 Merge commit from fork
• a152a45 test: wait for the first chunk before sending the second in the readable-stre...
• fb97395 Merge commit from fork
• See full diff in compare view

Updates hono from 4.13.13 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in honojs/hono#5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in honojs/hono#5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in honojs/hono#5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

What's Changed

• docs(contributing): ask for issues instead of RPs honojs/hono#5526
• docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.