chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates by dependabot[bot] · Pull Request #1664 · getsentry/cli

dependabot · 2026-10-12T08:14:55Z

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package	From	To
hono	`4.12.34`	`4.13.7`
http-cache-semantics	`4.2.0`	`4.3.0`
astro	`7.1.6`	`7.3.8`
sharp	`0.35.3`	`0.35.5`
@vitest/mocker	`4.1.10`	`4.1.11`
baseline-browser-mapping	`2.10.43`	`2.11.28`
browserslist	`4.28.6`	`4.29.3`
devalue	`5.9.0`	`5.9.4`
smol-toml	`1.7.1`	`1.9.1`
svgo	`4.0.2`	`4.1.0`

Updates hono from 4.12.34 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

eebdf7b 4.13.7
2b8ed40 Merge commit from fork
cac0c4d 4.13.6
dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
ec648d6 chore: bump editorconfig-checker (#5336)
e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
499c35e fix(client): normalize root WebSocket URLs (#5291)
50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
06880c4 4.13.5
531e9c5 Merge commit from fork
Additional commits viewable in compare view

Updates http-cache-semantics from 4.2.0 to 4.3.0

Commits

See full diff in compare view

Updates astro from 7.1.6 to 7.3.8

Release notes

Sourced from astro's releases.

astro@7.3.8

Patch Changes

#18293 28e7410 Thanks @astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

#18298 0e9e857 Thanks @matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

#18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

#18290 31f13c3 Thanks @astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

astro@7.3.7

Patch Changes

#18266 cba76cc Thanks @astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

#18287 38f6793 Thanks @astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

#18222 fcf6ed6 Thanks @mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

#18240 de4df06 Thanks @astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

#18268 547b572 Thanks @astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

astro@7.3.6

Patch Changes

#18166 5134d0f Thanks @astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

#18076 8a2df66 Thanks @astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

#18252 2d29e7e Thanks @astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

#18000 6724575 Thanks @barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

#18241 7c5fd6f Thanks @astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

#18164 1a6997f Thanks @astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

#18243 dd29d62 Thanks @astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

#18193 95d5d16 Thanks @astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

#18220 d6c13a4 Thanks @astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

#18133 faac481 Thanks @astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

#18146 2af4516 Thanks @astro-factory! - Fixes CSS imported from an injectScript('page') script being dropped during build

#18159 e5f8fe0 Thanks @astro-factory! - Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.8

Patch Changes

#18293 28e7410 Thanks @astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

#18298 0e9e857 Thanks @matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

#18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

#18290 31f13c3 Thanks @astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

7.3.7

Patch Changes

#18266 cba76cc Thanks @astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

#18287 38f6793 Thanks @astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

#18222 fcf6ed6 Thanks @mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

#18240 de4df06 Thanks @astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

#18268 547b572 Thanks @astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

7.3.6

Patch Changes

#18166 5134d0f Thanks @astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

#18076 8a2df66 Thanks @astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

#18252 2d29e7e Thanks @astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

#18000 6724575 Thanks @barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

#18241 7c5fd6f Thanks @astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

#18164 1a6997f Thanks @astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

#18243 dd29d62 Thanks @astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

#18193 95d5d16 Thanks @astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

#18220 d6c13a4 Thanks @astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

#18133 faac481 Thanks @astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

... (truncated)

Commits

3571e2d [ci] release (#18292)
0e9e857 Keep existing pnpm allowBuilds approvals in astro add (#18298)
882dd98 Replace esbuild with Vite and Rolldown APIs (#18263)
28e7410 fix(astro): provide Astro.cache when rendering error pages (#18293)
31f13c3 Fix glob() loader watcher ignoring patterns starting with an extglob like `!(...
25c19fa [ci] release (#18272)
38f6793 fix(astro): approve workerd builds in astro add cloudflare for pnpm v11+ an...
547b572 Restore content-type gate in security.checkOrigin so JSON requests are not bl...
fcf6ed6 fix(assets): return requested format from Sharp transform (#18222)
bec7d18 Ignore layout frontmatter in Markdown content collection entries with `defe...
Additional commits viewable in compare view

Updates sharp from 0.35.3 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract and rotate operations. #4606

Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract operation. #4606

... (truncated)

Commits

51a990f Release v0.35.5
96de105 Upgrade to sharp-libvips v1.3.4
3a61390 CI: Configure Dependabot with all package.json locations
4940c50 Improve gain map support for rotate/flip/flop ops
20654aa Prerelease v0.35.5-rc.1
ef4f934 CI: Upgrade to Ubuntu 26.04
358df95 Upgrade to libvips v8.18.7
49f4903 Improve gain map support for rotate-then-extract #4606
0e2e55e Silence a couple of compiler/static analysis warnings
cef3b8c Improve gain map support for extract operation #4606
Additional commits viewable in compare view

Updates @vitest/mocker from 4.1.10 to 4.1.11

Release notes

Sourced from @vitest/mocker's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
fe5a11d fix(mocker): restrict redirect mocks to the fs allowlist [backport to v4] (#1...
See full diff in compare view

Updates baseline-browser-mapping from 2.10.43 to 2.11.28

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

17963c0 Patch to 2.11.28 because browser or feature data changed
5d628d8 Browser or feature data changed
18ccb38 Updating static site
6141d06 Patch to 2.11.27 because browser or feature data changed
e1d166b Browser or feature data changed
42972a7 Updating static site
c1934c6 Patch to 2.11.26 because browser or feature data changed
4873684 Browser or feature data changed
9030798 Updating static site
a5df351 Updating static site
Additional commits viewable in compare view

Updates browserslist from 4.28.6 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

Changelog

Sourced from browserslist's changelog.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

Commits

b4809dd Release 4.29.3 version
9d844f8 Update Firefox ESR
0033f34 Update dependencies
906d329 Release 4.29.2 version
ff8c83f Update dependencies
067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
f760921 Do not add versions without usage data to cover queries
5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
1e5356f Note that Android version queries return only the latest version
5b7e941 Add missed changes to ChangeLog
Additional commits viewable in compare view

Updates devalue from 5.9.0 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Patch Changes

8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references

686e379: fix: emit valid JS for Node Buffer in uneval

376b65c: fix: preserve -0 in float typed arrays in uneval

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population

9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check

dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises

84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints

6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval

8f8d78e: fix: validate revived backing buffers before constructing typed arrays

46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

5.9.2

Patch Changes

8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references

686e379: fix: emit valid JS for Node Buffer in uneval

376b65c: fix: preserve -0 in float typed arrays in uneval

Commits

434358a Version Packages (#202)
067b125 perf: annotate module-level Object.freeze calls as pure (#200)
53cd3db Version Packages (#201)
46dc877 Merge commit from fork
84f6f67 Merge commit from fork
6861dbb Merge commit from fork
8f8d78e Merge commit from fork
dae8153 Merge commit from fork
9ec5130 Merge commit from fork
8ade61d chore: fix bench:compare script (#198)
Additional commits viewable in compare view

Updates smol-toml from 1.7.1 to 1.9.1

Release notes

Sourced from smol-toml's releases.

v1.9.1

What's Changed

fix: reject invalid extra exponent sign by @cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.9.0...v1.9.1

v1.9.0

Huge update!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.

Performance improvements

Significant parts of the internal parse logic have been rewritten, improving performance by 1.5x-2x. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at 4x faster parse performance than the closest maintained implementation.

Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.

Note: the objects returned by the library now have a null prototype. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.

Full Temporal support

Version 1.8.0 brought support for Temporal in stringify; now the library is also able to emit Temporal objects instead of its own ad-hoc TomlDate object. It is not enabled by default, but it will become the default in v2. Enable by setting useLegacyDate: false in the parser's options.

Better Temporal support in stringify

Temporal support has been improved since it released: Temporal objects that cannot be represented (such as Temporal.PlainMonthDay) now throw an error (instead of silently emitting a bogus object).

A new option has been added to stringify to disallow Temporal objects that cannot be fully represented in TOML. This includes ZonedDateTime objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting strictTemporal: true in the options.

Handling of unsafe keys

Since its release the library has been protected against prototype pollution attacks, setting properties like __proto__ using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.

Inspired by secure-json-parse, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.

Miscellaneous updates

Unicode BOM is now gracefully accepted and ignored.

Table array headers are now properly checked again. Reported in #65.

Closed certain gaps where invalid whitespace would be accepted. Reported in #61.

Bogus local date and local time values with a UTC offset are no longer accepted.

Certain error messages are more accurate and handle errors at line boundaries better.

The default export of the lib is now formally deprecated; use a import * instead. Proposed in #50.

On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.

On Node 20+, keys that contain lone surrogates are now rejected.

Full Changelog: squirrelchat/smol-toml@v1.8.0...v1.9.0

v1.8.0

What's Changed

feat: stringify temporal objects by @Gouvernathor and @cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.7.2...v1.8.0

... (truncated)

Commits

69aa050 fix: actually properly fix exponent issues
7be7084 chore: version bump
be3290d chore: upgrade deps
86c7613 fix: reject invalid extra exponent sign
6f9739a fix: gate [is|to]WellFormed (Node 18 compat)
a73ca32 fix: no Temporal with toml-test when Node < 26
7727890 chore: version bump
641903d chore: rewrite README.md
2df14c5 fix(types): make it work if Temporal doesn't exist
3eaa44e chore: update benchmark harness
Additional commits viewable in compare view

Updates svgo from 4.0.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, , and ;

UTF-16 surrogate code points such as &#xD800;;

invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).

Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).

Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

GHSA-4vpr-x523-8j87

GHSA-w27v-7q3p-w38r

Dependencies

Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@TrySound is back as an active SVGO maintainer.

Many thanks to @KTibow, @SethFalco, and @XhmikosR for maintaining and improving SVGO over th...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.7` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.6` | `7.3.8` | | [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.5` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.10` | `4.1.11` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.43` | `2.11.28` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.6` | `4.29.3` | | [devalue](https://github.com/sveltejs/devalue) | `5.9.0` | `5.9.4` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.9.1` | | [svgo](https://github.com/svg/svgo) | `4.0.2` | `4.1.0` | Updates `hono` from 4.12.34 to 4.13.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.34...v4.13.7) Updates `http-cache-semantics` from 4.2.0 to 4.3.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `astro` from 7.1.6 to 7.3.8 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.8/packages/astro) Updates `sharp` from 0.35.3 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.5) Updates `@vitest/mocker` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/mocker) Updates `baseline-browser-mapping` from 2.10.43 to 2.11.28 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.43...v2.11.28) Updates `browserslist` from 4.28.6 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.6...4.29.3) Updates `devalue` from 5.9.0 to 5.9.4 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.9.0...v5.9.4) Updates `smol-toml` from 1.7.1 to 1.9.1 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.1...v1.9.1) Updates `svgo` from 4.0.2 to 4.1.0 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.2...v4.1.0) --- updated-dependencies: - dependency-name: hono dependency-version: 4.13.7 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: http-cache-semantics dependency-version: 4.3.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 7.3.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 4.1.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.28 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.9.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: smol-toml dependency-version: 1.9.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-12T08:15:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cli	Ready	Preview	Oct 12, 2026 8:15am UTC
sentry-local	Ready	Preview	Oct 12, 2026 8:15am UTC

dependabot · 2026-10-14T01:43:46Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026

dependabot Bot mentioned this pull request Oct 12, 2026

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #1592

Closed

vercel Bot deployed to Preview – cli October 12, 2026 08:15

View deployment

vercel Bot deployed to Preview – sentry-local October 12, 2026 08:15

View deployment

BYK closed this Oct 14, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-0c96d2e273 branch October 14, 2026 01:43

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates - #1664

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates#1664
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-0c96d2e273

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

vercel Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 14, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

astro@7.3.8

Patch Changes

astro@7.3.7

Patch Changes

astro@7.3.6

Patch Changes

7.3.8

Patch Changes

7.3.7

Patch Changes

7.3.6

Patch Changes

v0.35.5

v0.35.5-rc.1

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v2.11.0

What's Changed in 2.11.0

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

v5.9.4

Patch Changes

v5.9.3

Patch Changes

v5.9.2

Patch Changes

v5.9.1

Patch Changes

5.9.4

Patch Changes

5.9.3

Patch Changes

5.9.2

Patch Changes

5.9.1

Patch Changes

v1.9.1

What's Changed

v1.9.0

Performance improvements

Full Temporal support

Better Temporal support in stringify

Handling of unsafe keys

Miscellaneous updates

v1.8.0

What's Changed

v4.1.0

Support SVGO

Stricter XML validation

Security

Dependencies

Project maintenance

Uh oh!

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

vercel Bot commented Oct 12, 2026 •

edited

Loading