Repository navigation
build(deps): update all non-major dependencies - #33
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
February 9, 2026 17:57
bcf0861 to
d05b786
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
February 19, 2026 13:35
8d05175 to
5e909de
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
February 23, 2026 13:08
dc52fcc to
b9fba5d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
March 2, 2026 20:57
c0e0576 to
d1af473
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
12 times, most recently
from
March 13, 2026 01:31
e6fc1ba to
ba49a5d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
9 times, most recently
from
March 19, 2026 21:30
e05c192 to
643d51e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
8 times, most recently
from
March 27, 2026 00:38
2af9317 to
00b5890
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
9.39.3→9.39.5^0.5.0→^0.6.01.2.2→1.6.3^0.17.0→^0.18.0^0.9.40→^0.12.04.2.1→4.3.520.19.33→20.19.438.56.0→8.72.22.4.6→2.5.117.3.1→17.4.20.31.9→0.31.115.5.5→5.5.72.8.10→2.11.1117.3.0→17.14.030.2.0→30.5.216.2.7→16.4.0^0.575.0→^0.577.03.8.1→3.10.1^0.7.0→^0.8.06.1.3→6.1.44.2.1→4.3.529.4.6→29.4.158.56.0→8.72.23.5.28→3.5.454.6.4→4.6.54.12.0→4.18.1Release Notes
eslint/eslint (@eslint/js)
v9.39.5Compare Source
Bug Fixes
253be16fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)Documentation
74930eddocs: switch build to Node.js 24 (#20894) (Milos Djermanovic)eaec8bbdocs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)Chores
458205fchore: update@eslint/eslintrcand@eslint/jsfor v9.39.5 (#21077) (Francesco Trotta)202117bchore: package.json update for @eslint/js release (Jenkins)d9eb6edtest: disable warning forvm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER(#21074) (Francesco Trotta)7b431a7chore: overridere2dependency for@metascraper/helpers(#21068) (Milos Djermanovic)daf7791chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)daee8baci: use pnpm ineslint-flat-config-utilstype integration test (#20829) (Milos Djermanovic)116d4beci: unpin Node.js 25.x in CI (#20619) (Copilot)v9.39.4Compare Source
Bug Fixes
f18f6c8fix: update dependency minimatch to ^3.1.5 (#20564) (Milos Djermanovic)a3c868ffix: update dependency @eslint/eslintrc to ^3.3.4 (#20554) (Milos Djermanovic)234d005fix: minimatch security vulnerability patch for v9.x (#20549) (Andrej Beles)b1b37eefix: updateajvto6.14.0to address security vulnerabilities (#20538) (루밀LuMir)Documentation
4675152docs: add deprecation notice partial (#20520) (Milos Djermanovic)Chores
b8b4eb1chore: update dependencies for ESLint v9.39.4 (#20596) (Francesco Trotta)71b2f6bchore: package.json update for @eslint/js release (Jenkins)1d16c2fci: pin Node.js 25.6.1 (#20563) (Milos Djermanovic)honojs/middleware (@hono/swagger-ui)
v0.6.2Compare Source
Patch Changes
28b6f52Thanks @yusukebe! - Escape the title and the string options embedded in the Swagger UI pagev0.6.1Compare Source
Patch Changes
3ca0fab1f52dcbef755363ca43b94bb654de4babThanks @matzehecht! - do not delete version and baseUrl from the passed swagger ui options refv0.6.0Compare Source
Minor Changes
1844c8bc785b7cacc647d835d1374eb88d314823Thanks @travzhang! - add support for custom CDN base URL in remoteAssetshonojs/middleware (@hono/zod-openapi)
v1.6.3Compare Source
Patch Changes
3b0860026438694e76c3155737cf0b8df32384f5Thanks @WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty objectv1.6.2Compare Source
Patch Changes
#2115
525564dc5c275bfe8468b330902ea12dc450f54dThanks @scttcper! - Flatten batched route type inference so largeopenapiRoutestuples do not hit TypeScript's recursive instantiation limit.#2116
38232db06e1c366e5eb1fb7cf6949c2541debd8cThanks @scttcper! - Reuse projected response types betweenopenapi()route handlers and returned schemas to reduce TypeScript checker work.#1986
28f1d39cd2a480d9d3bd557df9037c054a674279Thanks @VihaanAgarwal! - fix(zod-openapi): infer route middleware env indefineOpenAPIRoutehandlerv1.6.1Compare Source
Patch Changes
4fce28c6fbba41795b316becaf7d8cffa11fb521Thanks @thekiwi! - Reduce route-typing type instantiations (~54% on TS6, ~48% on TS7 in a 100-route benchmark) by binding expensive sub-expressions once and sharing the input intersection / response-shape conditional.v1.6.0Compare Source
Minor Changes
1dc1a4a5418be24d571652e1013b8a6a925824c0Thanks @WolfieLeader! - feat: support the HTTP QUERY method increateRoute()by bumping@asteasolutions/zod-to-openapito v9v1.5.3Compare Source
Patch Changes
9a9324937cfa77db210a966be33e8c73bbbe33e3Thanks @kamaal111! - Revert the local z binding export because it causes zod types to degrade to any when built with tsdown.v1.5.2Compare Source
Patch Changes
#2069
fc0377c5595bde3147d181e5013a3fc710175e40Thanks @edenbuilds! - fix(zod-openapi): keep thezimport edge so.openapi()survives bundlingRe-exporting zod's
zas a pass-through let esbuild code-splitting resolveimport { z } from '@hono/zod-openapi'straight to zod and drop the edge to themodule that runs
extendZodWithOpenApi(z), so schemas could be built before thepatch applied and
.openapi()was undefined at runtime. Exportzas an aliasdeclaration instead: it compiles to a binding local to the module, which keeps
that edge, while still carrying zod's type namespace so
z.infer,z.ZodTypeand the rest continue to work. Fixes #2051.
v1.5.1Compare Source
Patch Changes
7bc11dffa7dd5b639c614b12c34bd76722d76354]:v1.5.0Compare Source
Minor Changes
#1878
443a8dc5cd8a6a65daa2bec1f251adfc605b05ceThanks @SAY-5! - feat: inheritdefaultHookfrom parent app on nested routes mounted viaapp.route()Behavior change: if a parent app has a
defaultHookand a mounted sub-app does not declare its own, the sub-app's routes now use the parent'sdefaultHookinstead of the built-in validation response.Patch Changes
#2033
740123c01aadb6c2ed742d1c67c2763a4cdc4f1fThanks @yusukebe! - fix: resolve defaultHook through the ancestor chain on nested routes#2031
bf52ec2f18e32479ec85c00922c8aede68dc8286Thanks @tokiya-takai! - fix(zod-openapi): preserveonError()/notFound()set afterbasePath()OpenAPIHono.basePath()used to rebuild the instance by spreading the plainHonoclone returned bysuper.basePath().That spread copied the clone's arrow-function instance fields (
onError,notFound,request,fetch),which stay bound to the discarded clone — so calling
.onError()(or.notFound()) after.basePath()mutated the throwaway clone instead of the returned app and silently had no effect (the parent's handler ran instead).basePath()now transplants only the routing state onto a properly constructedOpenAPIHono, keeping its own correctly-bound methods. Fixes #2021.v1.4.0Compare Source
Minor Changes
#1881
e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67Thanks @T4ko0522! - fix(zod-openapi): bumppeerDependencies.honoto>=4.10.0to match the runtime requirement coming through@hono/zod-validator.@hono/zod-openapilists@hono/zod-validatoras a direct (non-peer) dependency, so its peer range must be at least as strict as@hono/zod-validator's. After the typed-400 fix bumps@hono/zod-validator'speerDependencies.honoto>=4.10.0, leaving@hono/zod-openapi's peer at>=4.3.6would let consumers install@hono/zod-openapiagainst e.g.hono@4.9.9, where the bundled@hono/zod-validatortypes reference the 4-argumentMiddlewareHandler<E, P, I, R>(introduced in Hono v4.10.0) and fail to compile (TS2707).Patch Changes
e90e4fb30877f3e3f4b0588bdb2bbfc337efbf67]:v1.3.0Compare Source
Minor Changes
#1752
fe0f8e4b44ca8e78d2ed60ed8591f415cd85eaa9Thanks @destroSunRay! - This PR adds two new utilities to improve route definition and registration in@hono/zod-openapi:defineOpenAPIRoute: Provides explicit type safety for route definitionsopenapiRoutes: Enables batch registration of multiple routes with full type safetydefineOpenAPIRoute: Wraps route definitions with explicit types for better IDE support and type checkingopenapiRoutes: Accepts an array of route definitions and registers them all at onceaddRouteflag for conditional registrationSee the updated README for usage examples.
v1.2.4Compare Source
Patch Changes
40ede9c55abe672798deca6970ef60b945382d34Thanks @yusukebe! - fix: publish to JSRv1.2.3Compare Source
Patch Changes
db8fd160d0685cda0d874a5908326c004f72522aThanks @dirkluijk! - fix: bump @asteasolutions/zod-to-openapi to allow nested discriminated unionstursodatabase/libsql-client-ts (@libsql/client)
v0.18.0Compare Source
v0.17.4Compare Source
v0.17.3Compare Source
v0.17.2Compare Source
v0.17.1Compare Source
scalar/scalar (@scalar/hono-api-reference)
v0.12.20No changes in this release.
v0.12.19v0.12.18v0.12.17v0.12.16v0.12.14v0.12.13Patch Changes
v0.12.12Patch Changes
v0.12.11Patch Changes
#backdropslot onScalarDropdown,ScalarPopover,ScalarListbox, andScalarComboboxis removed; style the floating element withclassinstead.ScalarFloatingBackdrop,--scalar-lifted-brightness, and thebrightness-liftedutility are deprecated in favor ofbg-b-1 dark:bg-b-1.5.ScalarFloatingBackdropitself now uses the same surface styles, so it no longer clips its slot or draws a real border. A newinset-shadow-borderutility draws the hairline border so it can stack withshadow-*without taking up layout space; Tailwind's defaultinset-shadow-*sizes are reset, matching the other theme namespaces.v0.12.10v0.12.9v0.12.8v0.12.7Patch Changes
#10375: Raise muted text, code-string blue and the deprecated schema row to the 4.5:1 text contrast minimum across the shipped themes
An accessibility audit turned up text that is legible in the default theme but not in several of the presets, which pair the default greys and blues with an off-white page background. Nine presets and four integration themes get a hue-preserving nudge:
--scalar-color-2now clears 4.5:1 on both the page background and the grey card background in every preset. That coversalternate,bluePlanet,marsandsaturn, which paired the default grey with an off-white page, andcustom-theme-starter,deepSpace,elysiajs,fastify,keplerandpurple, which copied the default grey and were left behind when the default moved.--scalar-color-blue, which colours code strings, now clears 4.5:1 on the grey example background inalternate,bluePlanet,deepSpace,elysiajs,fastify,keplerandmoon, and in the Docusaurus, NestJS, Next.js and SvelteKit themes.--scalar-color-bluenow clears 4.5:1 inpurpleandsaturn, and in the Hono and Docusaurus dark themes.laserwave.--scalar-focus-colorsits further from the accent so a keyboard focus ring clears 3:1 on--scalar-background-3as well, which some presets use for the selected sidebar item.laserwavestill misses in light mode, where it reuses its dark accents unchanged; bringing it up is a redesign of the preset rather than a nudge.v0.12.6v0.12.5v0.12.4Patch Changes
#10290: Update Hono and its Node.js server, WebSocket, and OpenAPI integration dependencies.
Replace the deprecated
@hono/node-wsadapter with Node server v2 WebSocket support.createAsyncApiMockServer()now returnswebsocketinstead ofinjectWebSocket. Start the server withserve({ fetch: app.fetch, websocket })instead of callinginjectWebSocket(server).AsyncAPI callers must upgrade to
@hono/node-serverv2. Node server v1 ignores thewebsocketoption, so WebSocket channels will silently stop accepting connections if the server dependency is not upgraded.v0.12.3v0.12.2No changes in this release.
v0.12.1v0.12.0Minor Changes
Scalar.serve()to render the API reference and serve its OpenAPI document from a single mount. Instead of wiring a separate document route and keeping the reference'surlin sync, mount it once withapp.route('/scalar', Scalar.serve({ document })).documentaccepts an OpenAPI object or a function that returns one (for example() => app.getOpenAPI31Document(...)from Zod OpenAPI Hono), and the JSON path is configurable viadocumentPath.v0.11.16Patch Changes
v0.11.14v0.11.13v0.11.12v0.11.11Patch Changes
v0.11.10Patch Changes
readmetoscalarReadme: npm treats areadmefield as the readme text itself, so affected packages were published with a literal[object Object]readme on the registry instead of README.md.v0.11.9v0.11.8v0.11.7v0.11.6v0.11.5v0.11.4v0.11.3v0.11.2v0.11.1Patch Changes
v0.11.0Minor Changes
#9422: Add a
nonceoption for Content Security Policy support.When you pass a
nonce, the rendered HTML stamps it onto the inline<script>and the CDN<script>tag (and Scalar's own<style>tags, plus a matching<meta property="csp-nonce">). This lets the API Reference run under a strictscript-srcwith nounsafe-inlineand nounsafe-eval.Note:
style-srcstill needs'unsafe-inline'. The reference renders inlinestyle="…"attributes, which a CSP nonce can never authorize (nonces only apply to<script>,<style>and<link>elements), so a nonce-onlystyle-srcis not possible. The win is a fully strictscript-src.v0.10.20v0.10.19v0.10.18v0.10.17v0.10.16v0.10.14v0.10.13v0.10.12v0.10.11v0.10.10v0.10.9Patch Changes
v0.10.8v0.10.7v0.10.6v0.10.5v0.10.4Patch Changes
v0.10.3Patch Changes
Updated Dependencies
v0.10.2v0.10.1v0.10.0Minor Changes
Patch Changes
Updated Dependencies
v0.9.48Patch Changes
Updated Dependencies
v0.9.47Patch Changes
Updated Dependencies
v0.9.46Patch Changes
Updated Dependencies
v0.9.45Patch Changes
Updated Dependencies
tailwindlabs/tailwindcss (@tailwindcss/vite)
v4.3.5Compare Source
Fixed
matchVariantplugin with thousands of values) (#20663)color-mix(…)without a color interpolation method (e.g.color-mix(var(--color-red-500))orcolor-mix(currentcolor 50%, transparent)) (#20658, #20666)@tailwindcss/oxide-wasm32-wasiloads instead of hanging forever (e.g. withNAPI_RS_FORCE_WASI=erroror in WebContainers) (#20667)as: '*.css'from the@tailwindcss/turbopacksetup in its README, because it breaks CSS modules (#20660)<!--and-->between top-level rules in CSS instead of throwing or swallowing the next rule (e.g.a { color: red } --> b { color: blue }) (#20665)@tailwindcss/oxide-wasm32-wasidetects changed and new source files after the first scan (e.g. in WebContainers) (#20487)skipLibCheck: falsecaused by imports of unshipped modules in the@tailwindcss/nodetype declarations (#20632)v4.3.4Compare Source
Added
@tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)Fixed
@sourcefiles whose real paths aren't otherwise scanned (#20356)@scopewrap generated utilities instead of nesting inside them (#20369)@scoperules preserve their scoping semantics when flattened ([#20369](htConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.