Skip to content

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 12 updates#31

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-minor-patch-f8cb3c7b33
Open

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 12 updates#31
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-minor-patch-f8cb3c7b33

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the dev-dependencies-minor-patch group with 12 updates in the / directory:

Package From To
@hono/node-server 2.0.1 2.0.10
@remix-run/node-fetch-server 0.13.0 0.14.0
@types/node 26.0.0 26.1.1
@vitest/coverage-v8 4.1.5 4.1.10
pkg-pr-new 0.0.75 0.0.78
sherif 1.9.0 1.13.0
srvx 0.10.0 0.11.22
vitest 4.1.5 4.1.10
ws 8.19.0 8.21.1
supertest 7.1.4 7.2.2
@types/supertest 6.0.3 7.2.1
tsx 4.22.4 4.23.1

Updates @hono/node-server from 2.0.1 to 2.0.10

Release notes

Sourced from @​hono/node-server's releases.

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

What's Changed

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.7

What's Changed

Full Changelog: honojs/node-server@v2.0.6...v2.0.7

v2.0.6

What's Changed

Full Changelog: honojs/node-server@v2.0.5...v2.0.6

v2.0.5

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates @remix-run/node-fetch-server from 0.13.0 to 0.14.0

Release notes

Sourced from @​remix-run/node-fetch-server's releases.

node-fetch-server v0.14.0

Minor Changes

  • Added a trustProxy option to createRequestListener() and createRequest() so apps behind trusted reverse proxies can construct request.url from Forwarded, X-Forwarded-Host, and X-Forwarded-Proto headers. createRequestListener() also uses trusted Forwarded and X-Forwarded-For values for handler client address information (see #10874).

Patch Changes

  • Reject request body reads when clients abort uploads, and avoid writing fallback error responses after streaming response headers are already committed (see #11533 and #11534).

file-storage v0.13.6

Patch Changes

Changelog

Sourced from @​remix-run/node-fetch-server's changelog.

v0.14.0

Minor Changes

  • Added a trustProxy option to createRequestListener() and createRequest() so apps behind trusted reverse proxies can construct request.url from Forwarded, X-Forwarded-Host, and X-Forwarded-Proto headers. createRequestListener() also uses trusted Forwarded and X-Forwarded-For values for handler client address information (see #10874).

Patch Changes

  • Reject request body reads when clients abort uploads, and avoid writing fallback error responses after streaming response headers are already committed (see #11533 and #11534).

v0.13.3

Patch Changes

  • Cancel unfinished streaming response bodies when the client connection closes before the response completes so user-provided ReadableStream.cancel() hooks run for aborted requests (see #11432).

  • Drop handler responses when the client has already disconnected, and do not forward request abort errors from handlers or response streams to onError or write them to a closed socket (see #11431).

v0.13.2

Patch Changes

  • Start writing the first response stream chunk immediately instead of waiting for another chunk. Streaming responses with a delayed second chunk now flush their initial data without unnecessary blocking.

v0.13.1

Patch Changes

  • Improve request throughput so node-fetch-server is now on par with native node:http performance in the request-inspection benchmark, while preserving Fetch API request handlers. The main optimizations lazily materialize Request and Headers objects, specialize handlers by declared arity, avoid unnecessary client/request work on hot paths, and send single-chunk response bodies with less Web stream overhead. See the node-fetch-server benchmarks for current results.
Commits

Updates @types/node from 26.0.0 to 26.1.1

Commits

Updates @vitest/coverage-v8 from 4.1.5 to 4.1.10

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits

Updates pkg-pr-new from 0.0.75 to 0.0.78

Commits

Updates sherif from 1.9.0 to 1.13.0

Release notes

Sourced from sherif's releases.

v1.13.0

What's Changed

Full Changelog: QuiiBz/sherif@v1.12.0...v1.13.0

v1.12.0

What's Changed

New Contributors

Full Changelog: QuiiBz/sherif@v1...v1.12.0

v1.11.1

What's Changed

Full Changelog: QuiiBz/sherif@v1.11.0...v1.11.1

v1.11.0

What's Changed

New Contributors

Full Changelog: QuiiBz/sherif@v1.10.0...v1.11.0

v1.10.0

JSON configuration in root package.json

When using many CLI arguments, it might be easier to move to the configuration format. In your root package.json, add a sherif field containing the same options as the CLI, but in camelCase. Default values are shown below:

{
  "sherif": {
    "fix": false,
    "select": "highest", // "highest" | "lowest"
    "noInstall": false,
    "failOnWarnings": false,
    "ignoreDependency": [], // string[]
    "ignorePackage": [], // string[]
    "ignoreRule": [] // string[]
</tr></table>

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sherif since your current version.


Updates srvx from 0.10.0 to 0.11.22

Release notes

Sourced from srvx's releases.

v0.11.22

compare changes

🚀 Enhancements

📝 Docs

❤️ Contributors

v0.11.21

compare changes

🩹 Fixes

  • node: Do not mutate raw req.url on pathname change (#220)

v0.11.20

compare changes

🔥 Performance

  • node: Fast header lookups and fewer per-request allocations (#218)
  • node: Fire-and-forget response send on the serve() path (#219)

v0.11.19

compare changes

🚀 Enhancements

  • maxRequestBodySize server option (#216) (docs)

🩹 Fixes

  • node: Case-insensitive content-length/content-type dedup in FastResponse (#214)
  • url: Deopt FastURL for query percent-encode-set chars (" ' < >) (#215)
  • node: Read duplicate single-value headers from rawHeaders in get/has (#217)

Types

  • tracing: Satisfy tracingChannel StoreType object constraint (57001b6)

... (truncated)

Changelog

Sourced from srvx's changelog.

v0.11.22

compare changes

🚀 Enhancements

  • Add mtls plugin (#213)
  • Add trustProxy option (#223)

🏡 Chore

✅ Tests

  • mtls: Wire tls-peer-cert tests into CI, add Bun-guard regression test (137abc7)

❤️ Contributors

v0.11.21

compare changes

🩹 Fixes

  • node: Do not mutate raw req.url on pathname change (#220)

🏡 Chore

  • Improve node bench script (9dae95d)

❤️ Contributors

v0.11.20

compare changes

🔥 Performance

  • node: Fast header lookups and fewer per-request allocations (#218)
  • node: Fire-and-forget response send on the serve() path (#219)

❤️ Contributors

... (truncated)

Commits
  • f4cb8ec chore(release): v0.11.22
  • 7ff4e30 chore: update deps
  • 137abc7 test(mtls): wire tls-peer-cert tests into CI, add Bun-guard regression test
  • e093402 feat: add trustProxy option (#223)
  • 06460a3 feat: add mtls plugin (#213)
  • 46240d7 doc: add missing aws stream docs, tests and example (#222)
  • 2632c54 chore(release): v0.11.21
  • 06ee5a0 fix(node): do not mutate raw req.url on pathname change (#220)
  • 9dae95d chore: improve node bench script
  • 6097cdb chore(release): v0.11.20
  • Additional commits viewable in compare view

Updates vitest from 4.1.5 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • a8fd24c chore: release v4.1.6
  • Additional commits viewable in compare view

Updates ws from 8.19.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits
  • ae1de54 [dist] 8.21.1
  • 8e9511b [ci] Trust Coveralls Homebrew tap
  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
  • 8df8265 [ci] Update actions/checkout action to v7
  • a2f4e7c [fix] Count empty fragments toward the limit (#2329)
  • e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
  • 4ea355d [doc] Document 32-bit signed integer coercion for option values
  • 2120f4c [example] Remove uuid dependency
  • 4c534a6 [security] Add latest vulnerability to SECURITY.md
  • bca91ad [dist] 8.21.0
  • Additional commits viewable in compare view

Updates supertest from 7.1.4 to 7.2.2

Release notes

Sourced from supertest's releases.

v7.2.2

  • fix: replace &#39;should&#39; dependency with native assertions in cookies module 1954bcf

forwardemail/supertest@v7.2.1...v7.2.2

v7.2.1

  • fix: correct case-sensitive require path for assertion module d4f04fb

forwardemail/supertest@v7.2.0...v7.2.1

v7.2.0

  • fix: fixed package lock c4b08a6
  • fix: drop v14 and v16 from tests d084ce2
  • Merge pull request #872 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.14.2 61f3ddf
  • Merge pull request #873 from forwardemail/dependabot/npm_and_yarn/multi-6d05d0e569 bd2fe45
  • chore(deps): bump qs, body-parser and express 07bf4fb
  • Merge pull request #866 from SchroederSteffen/use-lowercase-header-name 0666797
  • Merge pull request #868 from dmurvihill/cookie-assertions 953eca7
  • chore(deps-dev): bump js-yaml from 3.14.1 to 3.14.2 81ab94c
  • Merge pull request #870 from kudlav/patch-1 14d905d
  • Update links to documentation in README f508b30
  • feat(cookies): add cookie assertions 4f89680
  • chore(readme): use lower-case header name 1e642b0

forwardemail/supertest@v7.1.4...v7.2.0

Commits
  • d799751 7.2.2
  • 1954bcf fix: replace 'should' dependency with native assertions in cookies module
  • 8fb7453 7.2.1
  • d4f04fb fix: correct case-sensitive require path for assertion module
  • b8f0a43 7.2.0
  • c4b08a6 fix: fixed package lock
  • d084ce2 fix: drop v14 and v16 from tests
  • 61f3ddf Merge pull request #872 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.14.2
  • bd2fe45 Merge pull request #873 from forwardemail/dependabot/npm_and_yarn/multi-6d05d...
  • 07bf4fb chore(deps): bump qs, body-parser and express
  • Additional commits viewable in compare view

Updates @types/supertest from 6.0.3 to 7.2.1

Commits

Updates tsx from 4.22.4 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

  • support tsImport after global preload (8d4ffc2)
  • watch: avoid clearing piped output (95d0672)
  • watch: treat script and dependency paths literally (79fddde)

Performance Improvements

  • index transform cache lazily (e818ad6)
  • load esbuild lazily in CLI (d067938)
  • map Node TypeScript formats directly (cdcc623)
  • use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

Features

This release is also available on:

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

  • isolate hook state per async module.register() registration (a305f36)

This release is also available on:

Commits
  • 79fddde fix(watch): treat script and dependency paths literally
  • e818ad6 perf: index transform cache lazily
  • cdcc623 perf: map Node TypeScript formats directly
  • d067938 perf: load esbuild lazily in CLI
  • 95d0672 fix(watch): avoid clearing piped output
  • 6fd4607 docs: add per-page metadata
  • f4176d8 docs: generate sitemap
  • 8d4ffc2 fix: support tsImport after global preload
  • f0e89b2 docs: document Node's public type-stripping API vs internal loader path
  • f8992f1 perf: use sync module hooks on Node v22.22.3+
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 15, 2026
@pkg-pr-new

pkg-pr-new Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
@standardserver/core

npm i https://pkg.pr.new/@standardserver/core@31

@standardserver/fetch

npm i https://pkg.pr.new/@standardserver/fetch@31

@standardserver/node

npm i https://pkg.pr.new/@standardserver/node@31

@standardserver/peer

npm i https://pkg.pr.new/@standardserver/peer@31

@standardserver/shared

npm i https://pkg.pr.new/@standardserver/shared@31

commit: a49ecfe

@codspeed-hq

codspeed-hq Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merging this PR will not alter performance

✅ 18 untouched benchmarks
⏩ 108 skipped benchmarks1

Comparing dependabot/npm_and_yarn/dev-dependencies-minor-patch-f8cb3c7b33 (a49ecfe) with main (29d8838)

Open in CodSpeed

Footnotes

  1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@codecov

codecov Bot commented Jul 15, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@dependabot
chore(deps-dev): bump the dev-dependencies-minor-patch group across 1…
a49ecfe 
… directory with 12 updates

Bumps the dev-dependencies-minor-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.1` | `2.0.10` |
| [@remix-run/node-fetch-server](https://github.com/remix-run/remix/tree/HEAD/packages/node-fetch-server) | `0.13.0` | `0.14.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.0.0` | `26.1.1` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.5` | `4.1.10` |
| [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.75` | `0.0.78` |
| [sherif](https://github.com/QuiiBz/sherif) | `1.9.0` | `1.13.0` |
| [srvx](https://github.com/h3js/srvx) | `0.10.0` | `0.11.22` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.5` | `4.1.10` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.21.1` |
| [supertest](https://github.com/ladjs/supertest) | `7.1.4` | `7.2.2` |
| [@types/supertest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/supertest) | `6.0.3` | `7.2.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.1` |



Updates `@hono/node-server` from 2.0.1 to 2.0.10
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.1...v2.0.10)

Updates `@remix-run/node-fetch-server` from 0.13.0 to 0.14.0
- [Release notes](https://github.com/remix-run/remix/releases)
- [Changelog](https://github.com/remix-run/remix/blob/main/packages/node-fetch-server/CHANGELOG.md)
- [Commits](https://github.com/remix-run/remix/commits/v0.14.0/packages/node-fetch-server)

Updates `@types/node` from 26.0.0 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 4.1.5 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `pkg-pr-new` from 0.0.75 to 0.0.78
- [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.78/packages/cli)

Updates `sherif` from 1.9.0 to 1.13.0
- [Release notes](https://github.com/QuiiBz/sherif/releases)
- [Commits](QuiiBz/sherif@v1.9.0...v1.13.0)

Updates `srvx` from 0.10.0 to 0.11.22
- [Release notes](https://github.com/h3js/srvx/releases)
- [Changelog](https://github.com/h3js/srvx/blob/main/CHANGELOG.md)
- [Commits](h3js/srvx@v0.10.0...v0.11.22)

Updates `vitest` from 4.1.5 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `ws` from 8.19.0 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.21.1)

Updates `supertest` from 7.1.4 to 7.2.2
- [Release notes](https://github.com/ladjs/supertest/releases)
- [Commits](forwardemail/supertest@v7.1.4...v7.2.2)

Updates `@types/supertest` from 6.0.3 to 7.2.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/supertest)

Updates `tsx` from 4.22.4 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.4...v4.23.1)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: "@remix-run/node-fetch-server"
  dependency-version: 0.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies-minor-patch
- dependency-name: "@types/supertest"
  dependency-version: 7.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies-minor-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: pkg-pr-new
  dependency-version: 0.0.78
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: sherif
  dependency-version: 1.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies-minor-patch
- dependency-name: srvx
  dependency-version: 0.11.22
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies-minor-patch
- dependency-name: supertest
  dependency-version: 7.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies-minor-patch
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-minor-patch-f8cb3c7b33 branch from 85ed931 to a49ecfe Compare July 18, 2026 01:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants