Skip to content

fix(deps): update non-major dependencies - #4

Merged
Ectsang merged 1 commit into
mainfrom
renovate/non-major-dependencies
Oct 19, 2026
Merged

fix(deps): update non-major dependencies#4
Ectsang merged 1 commit into
mainfrom
renovate/non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@hono/node-server 2.1.1 → 2.1.3 age confidence
@types/node (source) 24.13.3 → 24.19.1 age confidence
hono (source) 4.13.5 → 4.13.13 age confidence
tsx (source) 4.23.13 → 4.23.15 age confidence
viem (source) 2.56.0 → 2.57.3 age confidence
ws 8.21.0 → 8.22.0 age confidence

Release Notes

honojs/node-server (@​hono/node-server)

v2.1.3

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

Compare Source

What's Changed

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

honojs/hono (hono)

v4.13.13

Compare Source

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in #​5439
  • docs(request): fix jsdoc comments for some getters in #​5445
  • fix(jsx): allow JSXNode function component results in #​5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in #​5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

Compare Source

What's Changed

  • fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #​5485
  • test(build): type-check the bundled declarations from a consumer project in #​5486
  • fix(etag): correctly match mixed-case header name in retainedHeader option in #​5475
  • fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #​5487
  • fix(combine): return a Response from a short-circuiting middleware in some() in #​5391
  • chore(deps): upgrade vite-plus to 1.0.0 in #​5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

  • chore: migrate the package manager from bun to pnpm in #​5433
  • chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
  • chore: replace prettier with oxfmt in #​5435
  • chore(deps): upgrade vitest to 5.0.1 in #​5437
  • chore: let oxfmt sort imports instead of eslint in #​5442
  • chore: replace eslint with oxlint in #​5443
  • chore: introduce Vite+ in #​5444
  • fix(types): allow returning a Blob as a response body in #​5446
  • chore: convert build scripts into plugins in #​5448
  • chore: stop editorconfig-checker from checking Markdown indent size in #​5455
  • ci: remove empty step left in cr.yml by the pnpm migration in #​5456
  • chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
  • feat(adapters): add @​hono/bun as a workspace package in #​5447
  • chore(adapters/bun): ship ESM only in #​5462
  • feat(adapters): add the seven adapters as workspace packages in #​5463
  • feat(adapters/deno): publish to JSR in #​5465
  • test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

  • fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
  • fix(accepts): match media types and language tags case-insensitively in #​5376
  • fix(linear-router): don't match an empty path segment as a param in #​5373
  • fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
  • fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
  • fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
  • fix(aws-lambda): preserve empty query parameters in #​5292
  • fix(lambda-edge): sync content type detection with aws-lambda in #​5426
  • fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

  • docs: fix typos in code comments and link third-party middleware section in #​5343
  • perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
  • fix(aws-lambda): respect backpressure when streaming the response body in #​5351
  • fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
  • fix(accept): treat the q parameter name as case-insensitive in #​5349
  • fix(accept): clamp a negative q to 0, not 1 in #​5357
  • fix(request): keep the request media type when reusing a cached body in #​5366
  • docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
  • perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Compare Source

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

Compare Source

What's Changed

  • fix(client): keep a param value of "index" in $url() and $path() in #​5297
  • fix(client): normalize root WebSocket URLs in #​5291
  • fix(types): allow symbol keys in Context get and set fallbacks in #​5300
  • chore: bump editorconfig-checker in #​5336
  • refactor(on-handler): use forEach for consistent handler iteration in #​5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

privatenumber/tsx (tsx)

v4.23.15

Compare Source

Bug Fixes
  • exclude bare builtins from namespace inheritance (38e1588)
  • expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
  • make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

v4.23.14

Compare Source

Bug Fixes
  • restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#​802) (6e5236b)

This release is also available on:

wevm/viem (viem)

v2.57.3

Compare Source

Patch Changes

v2.57.2

Compare Source

Patch Changes

v2.57.1

Compare Source

Patch Changes

v2.57.0

Compare Source

Minor Changes

  • #​5138 6599af365a27476c9f9b7b6f2950941709807393 Thanks @​jxom! - Added createClientResolver to lazily resolve and cache typed clients across configured chains using a transport map or callback.

  • #​5140 8a5ef5b06400530e7a45b6b52ed01e49c42f34dd Thanks @​jxom! - viem/tempo: Added a Relay RPC handler with a composable plugin mechanism.

    import { createClient, Relay, Store } from "viem/tempo";

const relay = Relay.create({
  client: createClient(),
  plugins: [
    Relay.multisig({ store: Store.memory() }),
    Relay.simulate(),
    Relay.feePayer(),
    Relay.feeToken(),
  ],
});

export default { fetch: relay.fetch };
Patch Changes

v2.56.9

Compare Source

Patch Changes

  • #​5123 2068265d2fefb41da2ca672f7b8ef0d221efdbde Thanks @​rabbitmainnet! - Added Rabbit Chain Testnet (chain ID 9280) to viem/chains.

  • #​5124 4767ff7be7aed3845b617f8b16806d72469ea657 Thanks @​kyscott18! - Added the getStorageValues action for batch retrieval of contract storage slots.

  • #​5108 5a201d9a5996a836023bdb676c8d7c0f43f9c8fa Thanks @​Lukecele! - Added Plasma mainnet addresses for USDC and EURC.

  • #​5114 de663c98de19da2ffccdd1681fd616e6ed653b98 Thanks @​jxom! - Resynced Tempo contract ABIs and added the current committee address.

     // Abis.earnMerkleRewardDistributor contract calls
-functionName: 'fundWithAssets',
-args: [funder, assets, minEarnShares],
+functionName: 'fundAndPublishRoot',
+args: [settlementId, expectedRootVersion, funder, assets, minEarnShares, root, totalEntitlement, statementHash],

 functionName: 'publishRoot',
-args: [root, totalEntitlement, statementHash],
+args: [expectedRootVersion, root, totalEntitlement, statementHash],

-const verifierAbi = Abis.zone
+const verifierAbi = Abis.core

-const selector = Selectors.zoneVerifier.verify
+const selector = Selectors.zoneVerifier.verify[
+  'verify(uint32,uint64,uint64,bytes32,uint64,(bytes32,bytes32),(bytes32,bytes32,uint64,uint64),bytes32,bytes,bytes)'
+]

  • #​5112 c704647d93ed5eaabe3ca9e22fdd4f7e9132b641 Thanks @​spalladino! - Added optional maxUsedGas to simulateBlocks call results, preserving the per-call maxUsedGas reported by eth_simulateV1.

    maxUsedGas is the node's measurement of the gas used by a call before gas refunds are applied – it is not a guaranteed minimum sufficient gas limit for the call. It is undefined against nodes that do not report it, and is available on both successful and failed call results.

  • #​5126 6feacb3a9066b47d3f083a0da0da2d8172577870 Thanks @​jxom! - viem/tempo: Added PropAMM actions.

v2.56.8

Compare Source

Patch Changes

v2.56.7

Compare Source

Patch Changes

v2.56.6

Compare Source

Patch Changes

v2.56.5

Compare Source

Patch Changes

v2.56.3

Compare Source

Patch Changes

v2.56.2

Compare Source

Patch Changes

v2.56.1

Compare Source

Patch Changes
websockets/ws (ws)

v8.22.0

Compare Source

Features

  • Introduced the protocols option (8b918b0).

Bug fixes

  • Calling websocket.close() with invalid arguments no longer transitions the
    state to WebSocket.CLOSING (#​2337).

v8.21.3

Compare Source

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming
    client_max_window_bits parameter value is smaller than its configured
    clientMaxWindowBits (e97a20e).

v8.21.2

Compare Source

Bug fixes

v8.21.1

Compare Source

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c).
  • The default values of the maxBufferedChunks and maxFragments options have
    been reduced (f197ac6).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 12:00 on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 4 times, most recently from 95e04ff to 2fcd073 Compare July 7, 2026 09:56
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 8 times, most recently from d36232b to 6f1bf9e Compare July 20, 2026 10:56
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 8 times, most recently from 3caadc8 to e062938 Compare July 28, 2026 22:37
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 7 times, most recently from 448586c to 45ca29e Compare August 7, 2026 10:41
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 3 times, most recently from 557c295 to e9867d9 Compare August 14, 2026 17:42
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 3 times, most recently from fd2b9e9 to 7f29f27 Compare August 31, 2026 00:42
Ectsang added a commit that referenced this pull request Aug 31, 2026
@Ectsang
Clear the dependency backlog and exact-pin the runtime deps
44406b7 
Six Renovate PRs had been open 28 to 63 days. Applied together in one verified
commit rather than merged sequentially, so the majors are exercised against each
other rather than against intermediate states.

- Runtime deps moved off caret ranges to exact pins, per house convention:
  @hono/node-server ^1.19.14 to 2.1.1 (#8), hono ^4.12.19 to 4.13.5,
  viem ^2.50.3 to 2.56.0 (#4). @hono/node-server v2 peers on hono ^4 and node
  >=20, both satisfied.
- tsx ^4.22.2 to 4.23.13, @types/node 22.19.17 to 24.13.3, aligning types with
  the node the workflow now runs.
- typescript 6.0.3 to 7.0.2 (#9). Taken because it was verified here, not
  assumed: typecheck is clean and the server boots and serves on it. Note
  ap2-conformance still holds typescript on 5.x for its own toolchain reasons.
- actions/checkout v4 to v7 (#6), actions/setup-node v4 to v7 (#10), and the
  workflow's node-version 20 to 24 (#7), clearing the runner's Node 20
  deprecation warning.

Verified: typecheck clean, npm audit --audit-level=high reports 0
vulnerabilities, and `npm run server` boots and prints its full startup banner
on the upgraded stack.
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch from 7f29f27 to 46ae1d6 Compare August 31, 2026 07:55
@renovate renovate Bot changed the title fix(deps): update non-major dependencies chore(deps): update non-major dependencies Aug 31, 2026
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from 2bbaba0 to 9ee7a14 Compare September 6, 2026 04:20
@renovate renovate Bot changed the title chore(deps): update non-major dependencies chore(deps): update dependency ws to v8.21.3 Sep 6, 2026
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 3 times, most recently from f2a7d9c to eea7c37 Compare September 14, 2026 11:43
@renovate renovate Bot changed the title chore(deps): update dependency ws to v8.21.3 fix(deps): update non-major dependencies Sep 14, 2026
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 3 times, most recently from 9b780e9 to a5b2120 Compare September 19, 2026 01:04
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 4 times, most recently from e435ffb to c70d686 Compare September 30, 2026 00:11
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 5 times, most recently from 34b6495 to 0bd6bc0 Compare October 8, 2026 06:31
@renovate
renovate Bot force-pushed the renovate/non-major-dependencies branch 4 times, most recently from cbd6ab3 to c722784 Compare October 12, 2026 09:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Ectsang