Skip to content

Bump the npm_and_yarn group across 1 directory with 13 updates - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-09c22068ac
Open

Bump the npm_and_yarn group across 1 directory with 13 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-09c22068ac

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package From To
dompurify 3.4.14 3.4.16
next 16.3.0 16.3.6
@vitest/mocker 4.1.10 5.0.3
baseline-browser-mapping 2.9.19 2.11.27
brace-expansion 2.1.4 2.1.7
browserslist 4.28.1 4.29.3
fast-uri 3.1.6 3.1.8
hono 4.13.5 4.13.13
ip-address 10.7.0 10.7.3
nanoid 3.3.17 3.3.19
sharp 0.35.3 0.35.5
smol-toml 1.7.0 1.9.0
undici 7.29.0 7.30.0

Updates dompurify from 3.4.14 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

  • Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
  • Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
  • Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
  • Migrated from rollup to rolldown because performance, thanks @​ssi02014
  • Bumped several dependencies where possible

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible
Commits

Updates next from 16.3.0 to 16.3.6

Release notes

Sourced from next's releases.

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
  • next/image: Reject empty images when reading/writing to the disk cache (#98186)
  • Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
  • Add CSP nonce to script tags of loading and template files (#98403)
  • Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

  • testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
  • Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
  • Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

... (truncated)

Commits
  • a758ffc v16.3.6
  • 868fad3 [active-lts] Harden next/og SVG serialization
  • 8c81cbb [lts-active] test: remove unsupported deployment ID builder cases (#98821)
  • ca2c75e v16.3.5
  • 14fb290 [backport] Fix use cache prerender signal retention (#98448)
  • 2b1f28d [16.3.x] Add CSP nonce to script tags of loading and template files (#98403)
  • 4b56cee [16.3.x] Backport docs fixes (#98317)
  • 5568a02 [backport] docs: local development: Rewrite docker section, add Windows Dev D...
  • 93249ab [16.3.X] Emit whole-app server NFTs when output: 'standalone' is used with ...
  • 6549fd7 [16.3.x] next/image: reject empty image on read/write to disk cache (#98186)
  • Additional commits viewable in compare view

Updates @vitest/mocker from 4.1.10 to 5.0.3

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.3

   🐞 Bug Fixes

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

... (truncated)

Commits

Updates baseline-browser-mapping from 2.9.19 to 2.11.27

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

  • Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
  • Adds specified Node version support in package.json for >=6.0.0.
  • Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
  • Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
  • Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
  • refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

Commits
  • 6141d06 Patch to 2.11.27 because browser or feature data changed
  • e1d166b Browser or feature data changed
  • 42972a7 Updating static site
  • c1934c6 Patch to 2.11.26 because browser or feature data changed
  • 4873684 Browser or feature data changed
  • 9030798 Updating static site
  • a5df351 Updating static site
  • ecc5b54 Updating static site
  • 719bf7a Patch to 2.11.25 because browser or feature data changed
  • c4f5b49 Browser or feature data changed
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.


Updates brace-expansion from 2.1.4 to 2.1.7

Commits

Updates browserslist from 4.28.1 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Changelog

Sourced from browserslist's changelog.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits
  • b4809dd Release 4.29.3 version
  • 9d844f8 Update Firefox ESR
  • 0033f34 Update dependencies
  • 906d329 Release 4.29.2 version
  • ff8c83f Update dependencies
  • 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
  • f760921 Do not add versions without usage data to cover queries
  • 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
  • 1e5356f Note that Android version queries return only the latest version
  • 5b7e941 Add missed changes to ChangeLog
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates fast-uri from 3.1.6 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

Commits

Updates hono from 4.13.5 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

  • fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
  • test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
  • fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
  • fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
  • fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
  • chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits
  • 08a023c 4.13.13
  • ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
  • f23b146 fix(jsx): allow JSXNode function component results (#5476)
  • 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
  • deff529 test(client): simulate network error for undefined route in parseResponse tes...
  • 6abd35b 4.13.12
  • 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
  • afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
  • e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
  • c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
  • Additional commits viewable in compare view

Updates ip-address from 10.7.0 to 10.7.3

Release notes

Sourced from ip-address's releases.

v10.7.3

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

Commits
  • c7f838e 10.7.3
  • 09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
  • 974b48d 10.7.2
  • 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
  • f0c25df 10.7.1
  • 8b34a21 Merge commit from fork
  • 13b6155 Merge commit from fork
  • 469ead1 Reject an address longer than the family allows before parsing it
  • 1343629 Report an address of the other family as not contained
  • 4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
  • See full diff in compare view

Updates nanoid from 3.3.17 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

  • Fixed killing the app by setting huge user ID.

3.3.18

Changelog

Sourced from nanoid's changelog.

3.3.19

3.3.18

Commits

Updates sharp from 0.35.3 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Updates smol-toml from 1.7.0 to 1.9.0

Release notes

Sourced from smol-toml's releases.

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

  • Unicode BOM is now gracefully accepted and ignored.
  • Table array headers are now properly checked again. Reported in #65.
  • Closed certain gaps where invalid whitespace would be accepted. Reported in #61.
  • Bogus local date and local time values with a UTC offset are no longer accepted.
  • Certain error messages are more accurate and handle errors at line boundaries better.
  • The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.
  • On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.
  • On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

v1.8.0

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.7.2...v1.8.0

v1.7.2

What's Changed

... (truncated)

Commits
  • 6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
  • a73ca32 fix: no Temporal with toml-test when Node < 26
  • 7727890 chore: version bump
  • 641903d chore: rewrite README.md
  • 2df14c5 fix(types): make it work if Temporal doesn't exist
  • 3eaa44e chore: update benchmark harness
  • cd3ba60 feat: safety option for dangerous properties
  • 6746a7f perf: refactor TomlDate to avoid regex path
  • 16fa64f chore: move benchmarks and test harness under 0BSD
  • bbd14b1 fix: correct sign for single-char numbers
  • Additional commits viewable in compare view

Updates undici from 7.29.0 to 7.30.0

Release notes

Sourced from undici's releases.

v7.30.0

What's Changed

@dependabot
Bump the npm_and_yarn group across 1 directory with 13 updates
a00412e 
Bumps the npm_and_yarn group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.14` | `3.4.16` |
| [next](https://github.com/vercel/next.js) | `16.3.0` | `16.3.6` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.10` | `5.0.3` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.9.19` | `2.11.27` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.1.4` | `2.1.7` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.6` | `3.1.8` |
| [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.13` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.7.0` | `10.7.3` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.17` | `3.3.19` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.5` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.0` | `1.9.0` |
| [undici](https://github.com/nodejs/undici) | `7.29.0` | `7.30.0` |



Updates `dompurify` from 3.4.14 to 3.4.16
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.14...3.4.16)

Updates `next` from 16.3.0 to 16.3.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.0...v16.3.6)

Updates `@vitest/mocker` from 4.1.10 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/mocker)

Updates `baseline-browser-mapping` from 2.9.19 to 2.11.27
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.9.19...v2.11.27)

Updates `brace-expansion` from 2.1.4 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.4...v2.1.7)

Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.3)

Updates `fast-uri` from 3.1.6 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.6...v3.1.8)

Updates `hono` from 4.13.5 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.5...v4.13.13)

Updates `ip-address` from 10.7.0 to 10.7.3
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.7.0...v10.7.3)

Updates `nanoid` from 3.3.17 to 3.3.19
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.17...3.3.19)

Updates `sharp` from 0.35.3 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.5)

Updates `smol-toml` from 1.7.0 to 1.9.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.7.0...v1.9.0)

Updates `undici` from 7.29.0 to 7.30.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.0...v7.30.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.16
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.3.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.27
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.19
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: smol-toml
  dependency-version: 1.9.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.30.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 4, 2026
@vercel

vercel Bot commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
hn Building Building Preview Oct 4, 2026 9:28pm UTC

Request Review

@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 4, 2026
@netlify

netlify Bot commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for mblode-hn ready!

Name Link
🔨 Latest commit a00412e
🔍 Latest deploy log https://app.netlify.com/projects/mblode-hn/deploys/6ac2c509702c1a0008561892
😎 Deploy Preview https://deploy-preview-14--mblode-hn.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants