Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates - #29

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-9da5f298c5
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-9da5f298c5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026 •

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
uuid 11.1.1 14.0.1
@ai-sdk/provider-utils 3.0.29 5.0.21
@hono/node-server 1.19.14 2.1.0
fast-uri 3.1.3 3.1.5
hono 4.12.30 4.13.0
ip-address 10.2.0 10.4.0

Updates uuid from 11.1.1 to 14.0.1

Release notes

Sourced from uuid's releases.

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

  • rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

  • update to typescript@5.2 (#887)
  • remove CommonJS support (#886)
  • drop node@16 support (#883)

Features

Bug Fixes

... (truncated)

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @ai-sdk/provider-utils from 3.0.29 to 5.0.21

Release notes

Sourced from @​ai-sdk/provider-utils's releases.

@​ai-sdk/provider-utils@​5.0.21

Patch Changes

  • 1bec07d: Fix streamed tool calls with non-zero, non-contiguous, reused, or missing indexes.

@​ai-sdk/provider-utils@​5.0.20

Patch Changes

  • 160ccdb: Reduce bundle size by removing the runtime Zod 3 dependency.
Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.21

Patch Changes

  • 1bec07d: Fix streamed tool calls with non-zero, non-contiguous, reused, or missing indexes.

5.0.20

Patch Changes

  • 160ccdb: Reduce bundle size by removing the runtime Zod 3 dependency.

5.0.19

Patch Changes

  • Updated dependencies [79e133c]
    • @​ai-sdk/provider@​4.0.5

5.0.18

Patch Changes

  • 5fc7da5: chore: centralize empty language model usage creation in provider utilities.
  • 93b2acd: chore: centralize response metadata conversion

5.0.17

Patch Changes

  • fa95504: feat(ai): support experimental tool callers in ToolLoopAgent

5.0.16

Patch Changes

  • d8210b6: chore: centralize record type guards in provider-utils
  • b192878: feat: add experimental_toolCaller routing to generateText for code mode

5.0.15

Patch Changes

  • 1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
  • 6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.

5.0.14

Patch Changes

... (truncated)

Commits

Updates @hono/node-server from 1.19.14 to 2.1.0

Release notes

Sourced from @​hono/node-server's releases.

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg


Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

New Contributors

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates fast-uri from 3.1.3 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits

Updates hono from 4.12.30 to 4.13.0

Release notes

Sourced from hono's releases.

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
ping — GET / 165.83 ns 163.99 ns 1.01x
query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
json — GET /user 528.99 ns 422.44 ns 1.25x
body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

... (truncated)

Commits
  • 192768f 4.13.0
  • b0c2d90 Merge pull request #5154 from honojs/next
  • 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
  • 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
  • 3feb355 fix(jsx): allow a function component to return an array (#5179)
  • 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
  • 30277ae feat(jwt,jwk): add a configurable WWW-Authenticate realm (#5141)
  • 1f707c5 feat(middleware): add method-not-allowed middleware (#5132)
  • 2df0b47 feat(jsx): add React-compatible overloads to useRef (#5063)
  • 3bc96ba feat(cache): add first-class support for QUERY requests (#5119)
  • Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • fbb8db2 10.4.0
  • 45a2b11 Validate the byte arrays Address6 is given (#217)
  • bac8810 Keep the package loadable on node 12, and enforce it (#216)
  • 9b3d848 Add a security policy and a README section on security posture
  • e84a7b3 Order the README API reference Address4, Address6, AddressError
  • 015160b Collapse each class in the README API reference
  • 34061a8 Pin checkout and setup-node to commits in the release job
  • c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
  • e0ef048 Replace CircleCI with GitHub Actions
  • 5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [uuid](https://github.com/uuidjs/uuid) | `11.1.1` | `14.0.1` |
| [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) | `3.0.29` | `5.0.21` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `2.1.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.5` |
| [hono](https://github.com/honojs/hono) | `4.12.30` | `4.13.0` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.4.0` |



Updates `uuid` from 11.1.1 to 14.0.1
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.1.1...v14.0.1)

Updates `@ai-sdk/provider-utils` from 3.0.29 to 5.0.21
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@5.0.21/packages/provider-utils)

Updates `@hono/node-server` from 1.19.14 to 2.1.0
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v2.1.0)

Updates `fast-uri` from 3.1.3 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.3...v3.1.5)

Updates `hono` from 4.12.30 to 4.13.0
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.30...v4.13.0)

Updates `ip-address` from 10.2.0 to 10.4.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 14.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@ai-sdk/provider-utils"
  dependency-version: 5.0.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.13.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 5, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-9da5f298c5 branch August 10, 2026 02:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants