chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #253 · Venipa/ytmdesktop2

dependabot · 2026-09-08T23:13:01Z

Bumps the npm_and_yarn group with 3 updates in the / directory: next, hono and sharp.

Updates next from 16.3.0 to 16.3.3

Release notes

v16.3.3

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution on windows-hosted servers

Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)

[backport] Fix catch-all index page being served for every other slug (#97416)

[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)

[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)

[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)

[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

v16.3.1

What's Changed

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in vercel/next.js#96653

[16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @lukesandberg in vercel/next.js#96655

[16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in vercel/next.js#96675

[16.x] fix(next/image): preserve image response after optimization by @styfle in vercel/next.js#96733

[16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in vercel/next.js#96900

[backport] Bump @swc/helpers by @mischnic in vercel/next.js#96885

[backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in vercel/next.js#97308

[backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in vercel/next.js#97302

[backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in vercel/next.js#97317

[backport] Restore the live headers() view of the incoming request by @unstubbable in vercel/next.js#97311

[backport] Allow literal exports in 'use cache' files by @unstubbable in vercel/next.js#97312

[backport] Keep the dev validation worker alive across HMR updates by @unstubbable in vercel/next.js#97315

[backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @unstubbable in vercel/next.js#97314

[backport] Encode the cache item name built by unstable_cache by @unstubbable in vercel/next.js#97313

[16.3] [ci] Use OIDC tokens to read private preview builds by @eps1lon in vercel/next.js#97258

[backport] [test] Compile the middleware redirect routes up front in dev by @lukesandberg in vercel/next.js#97328

[backport] Fix Nav Inspector request loop on repeat captures by @acdlite in vercel/next.js#97326

[backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @acdlite in vercel/next.js#97325

[backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @lukesandberg in vercel/next.js#97304

[backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

a9a1cb7 v16.3.3
968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
3a15b4a [16.3.x] [next/image]: disable avif image optimization
7378b51 Backport/docs fixes 16.3 (#97649)
528c1cd [16.3.x] Stop generating error codes (#97780)
d0ac882 v16.3.2
81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
Additional commits viewable in compare view

Updates hono from 4.13.0 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

v0.35.4-rc.0

Upgrade to libvips v8.18.6 for upstream bug fixes.

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

Commits

7f1a0a2 Release v0.35.4
f927818 Upgrade to sharp-libvips v1.3.3
e802092 Prerelease v0.35.4-rc.0
e13eb2f CI: Fix wasm32 build (#4589)
a82a0b3 Upgrade to libvips v8.18.6
8044fe4 Bound resize dimensions to coordinate limit
147f859 Docs: changelog entries for #4578 #4584
ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
Additional commits viewable in compare view

Updates @vitest/mocker from 4.1.10 to 5.0.0

Release notes

Sourced from @vitest/mocker's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

🚨 Breaking Changes

Replace loupe.inspect with pretty-format - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)

Remove quotes from string values in test.for/each title $ variable (take 2) - by @hi-ogawa in vitest-dev/vitest#10170 (04d37)

Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/ - by @MdSadiqMd in vitest-dev/vitest#10186 (1ba73)

Remove sequential test/suite options in favor of concurrent - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)

Represent locator as an object instead of a string - by @sheremet-va in vitest-dev/vitest#10212 (80f07)

Inline expect package - by @sheremet-va in vitest-dev/vitest#10221 (ad162)

Remove deprecated entry points - by @sheremet-va in vitest-dev/vitest#10222 (994c6)

Require Node.js 22 and Vite 6.4 - by @sheremet-va in vitest-dev/vitest#10178 (38762)

Fail expect.poll when function didn't resolve in time - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)

Throw an error if hoistable methods are outside the top level scope - by @sheremet-va in vitest-dev/vitest#10460 (d0b4f)

toHaveTextContent is strict, add toMatchTextContent as alternative - by @sheremet-va in vitest-dev/vitest#10473 (18f30)

Don't lookup config file from ancestor directories - by @hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)

Inline @vitest/runner package, do not publish it anymore - by @sheremet-va in vitest-dev/vitest#10511 (6d6e4)

Allow mutating happy-dom/jsdom window object - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)

Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based - by @sheremet-va in vitest-dev/vitest#10516 (bdd98)

Add screenshotDirectory config to browser.expect.toMatchScreenshot - by @macarie in vitest-dev/vitest#10592 (a60de)

Update @sinonjs/fake-timers and support mocking Temporal - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)

Remove webdriverio package - by @sheremet-va in vitest-dev/vitest#10675 (5fed6)

Clear mocks by default before each test - by @sheremet-va in vitest-dev/vitest#10613 (0f646)

Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start - by @sheremet-va in vitest-dev/vitest#10293 (334ed)

Separate config resolution from the server creation - by @sheremet-va in vitest-dev/vitest#10554 (1c0ec)

Inline projects extend the root config by default - by @sheremet-va in vitest-dev/vitest#10750 (fec00)

Enable mocking Temporal without fake timers - by @fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)

Support nested projects - by @sheremet-va in vitest-dev/vitest#10846 (ec367)

Use > as separator in -t, calculate only once - by @sheremet-va in vitest-dev/vitest#10686 (a0b20)

Fail the test when an asynchronous assertion is not awaited - by @sheremet-va in vitest-dev/vitest#10868 (86d4a)

Share the Vite server between inline projects - by @sheremet-va in vitest-dev/vitest#10848 (d87c9)

Parse files statically in vitest list by default - by @sheremet-va in vitest-dev/vitest#11088 (51e94)

benchmark:

Rewrite the public API - by @sheremet-va in vitest-dev/vitest#10113 (19f6e)

browser:

Iframe scale - by @macarie in vitest-dev/vitest#9745 (b6398)

Enable locators.exact by default - by @sheremet-va in vitest-dev/vitest#10430 (e2032)

Require sessionId for orchestrator html request - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)

Save failure screenshots in attachmentsDir - by @macarie in vitest-dev/vitest#10917 (3b5bb)

coverage:

include/exclude globs too eager - by @AriPerkkio in vitest-dev/vitest#9818 (edacb)

Allow thresholds.perFile to accept an object - by @vladlenskiy and @AriPerkkio in vitest-dev/vitest#10190 (13b78)

expect:

Fix toThrow("") behavior by reverting #6710 - by @hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)

mocker:

Deserialize automock as automock - by @nami8824 in vitest-dev/vitest#10192 (2f892)

reporters:

blob reporter and --merge-reports default to .vitest/blob/ - by @AriPerkkio in vitest-dev/vitest#10232 (d22b0)

Write json and junit reporter output files to .vitest by default - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

f441c6f chore: release v5.0.0 (#11130)
897f51f chore: release v5.0.0-rc.4 (#11107)
7db80dc chore: release v5.0.0-rc.3 (#11089)
732df2c fix(deps): update all non-major dependencies (#11043)
1e9f80e perf(vm): don't prewarm modules the worker never requests (#11033)
af83d1b chore: release v5.0.0-rc.2 (#10976)
8ff9b9a fix(mocker): restrict redirect mocks to the fs allowlist (#10972)
65263d7 fix(deps): update all non-major dependencies (#10966)
a7fa111 chore: release v5.0.0-rc.1 (#10920)
0553851 chore: add Knip checks (#10847)
Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.10.8 to 2.11.21

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

0e5ed80 Patch to 2.11.21 because browser or feature data changed
11da0b6 Browser or feature data changed
69fcc81 Updating static site
b964de0 Patch to 2.11.20 because browser or feature data changed
723099f Browser or feature data changed
f44163d Updating static site
8966043 Patch to 2.11.19 because browser or feature data changed
e18601d Browser or feature data changed
28cb50a Updating static site
cb33a83 Patch to 2.11.18 because browser or feature data changed
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [next](https://github.com/vercel/next.js), [hono](https://github.com/honojs/hono) and [sharp](https://github.com/lovell/sharp). Updates `next` from 16.3.0 to 16.3.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.0...v16.3.3) Updates `hono` from 4.13.0 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.0...v4.13.5) Updates `sharp` from 0.35.3 to 0.35.4 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) Updates `@vitest/mocker` from 4.1.10 to 5.0.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/mocker) Updates `baseline-browser-mapping` from 2.10.8 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.8...v2.11.21) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 5.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 8, 2026

dependabot Bot mentioned this pull request Sep 8, 2026

chore(deps): bump @vitest/mocker from 4.1.10 to 5.0.0 in the npm_and_yarn group across 0 directory #252

Closed

Navigation Menu

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates - #253

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates#253
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-ec55cf996a

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 8, 2026

v16.3.3

v16.3.2

Core Changes

Credits

v16.3.1

What's Changed

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.13.3

What's Changed

v0.35.4

v0.35.4-rc.0

v5.0.0

🚨 Breaking Changes

v2.11.0

What's Changed in 2.11.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion