chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 10 updates by dependabot[bot] · Pull Request #143 · middleapi/standard-server

dependabot · 2026-10-03T01:41:32Z

Bumps the dev-dependencies-minor-patch group with 10 updates in the / directory:

Package	From	To
@hono/node-server	`2.1.1`	`2.1.3`
@types/node	`26.4.1`	`26.6.4`
fastify	`5.12.1`	`5.12.5`
pkg-pr-new	`0.0.87`	`0.0.88`
ws	`8.21.3`	`8.22.0`
@types/ws	`8.18.1`	`8.18.2`
@types/aws-lambda	`8.10.163`	`8.10.164`
supertest	`7.2.2`	`7.3.1`
tsx	`4.23.13`	`4.23.15`
@types/bun	`1.4.0`	`1.4.2`

Updates @hono/node-server from 2.1.1 to 2.1.3

Release notes

Sourced from @hono/node-server's releases.

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

ci: add autofix.ci by @yusukebe in honojs/node-server#392

fix: type error in early hints and add typecheck to CI by @BlankParticle in honojs/node-server#390

chore: add better benchmarks by @BlankParticle in honojs/node-server#391

docs(readme): update the benchmark by @yusukebe in honojs/node-server#394

test(request): accept asynchronous body read errors by @usualoma in honojs/node-server#403

fix(listener): avoid mutating response headers when setting Content-Length by @usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits

720ac78 2.1.3
9821792 Merge commit from fork
35bca95 2.1.2
90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
fe7467c test(request): accept asynchronous body read errors (#403)
64dc09e docs(readm): update the benchmark (#394)
8f505ae chore: add better benchmarks (#391)
2469b1a fix: type error in early hints and add typecheck to CI (#390)
3f958da ci: add autofix.ci (#392)
See full diff in compare view

Updates @types/node from 26.4.1 to 26.6.4

Commits

See full diff in compare view

Updates fastify from 5.12.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

[Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in fastify/fastify#7019

[Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

Fix for GHSA-9q9j-q6p8-xq58

Fix for GHSA-hwr6-493r-vm6h

Fix for GHSA-p68q-wchp-6fh7

Fix for GHSA-667r-xxjv-c9mm

What's Changed

[Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in fastify/fastify#6973

[Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

ba235fd Bumped v5.12.5
ad06a4c Merge commit from fork
7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
1690e35 Bumped v5.12.4
1c991c4 Bumped v5.12.3
942a2be Bumped v5.12.2
853f6e2 test(validation): cover normalization and async branches
f02d8d4 fix(validation): do not unwrap async validator results
93c239a fix: reject malformed URLs before custom 404 handlers
Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.87 to 0.0.88

Commits

b594954 release: v0.0.88
See full diff in compare view

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

Introduced the protocols option (8b918b01).

Bug fixes

Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

297202c [dist] 8.22.0
8b918b0 [feature] Introduce the protocols option
73e03eb [ci] Update actions/setup-node action to v7
d9b8954 [fix] Change the ready state after validating the arguments (#2337)
See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

See full diff in compare view

Updates @types/aws-lambda from 8.10.163 to 8.10.164

Commits

See full diff in compare view

Updates supertest from 7.2.2 to 7.3.1

Release notes

Sourced from supertest's releases.

v7.3.1

Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind 884cd26

fix: bind ephemeral server to the loopback address it connects to e74a1e0

forwardemail/supertest@v7.3.0...v7.3.1

v7.3.0

fix: stabilize ephemeral server requests and assertions 71dc5fb

Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd8535d99 3b5ba5c

Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2.3.2 c3419b2

Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1 7e409db

Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expansion-1.1.21 b55a7f9

Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslist-4.29.0 7a5deaa

Merge pull request #900 from forwardemail/dependabot/npm_and_yarn/fast-uri-3.1.8 a75f6ee

Merge pull request #901 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.15.2 c2cb33e

Merge pull request #896 from pnookala-godaddy/codex/ephemeral-loopback-bind 7fb34e7

chore(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 c357584

chore(deps-dev): bump browserslist from 4.25.1 to 4.29.0 2a01b57

chore(deps-dev): bump fast-uri from 3.0.6 to 3.1.8 343394d

chore(deps-dev): bump brace-expansion from 1.1.12 to 1.1.21 6b203e9

Merge pull request #881 from forwardemail/dependabot/npm_and_yarn/qs-6.14.2 d40ca7e

fix: match ephemeral server address family b6f5995

chore(deps-dev): bump lodash from 4.17.21 to 4.18.1 81766ca

chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 985ac7c

chore(deps): bump minimatch 58baa5f

chore(deps): bump qs from 6.14.1 to 6.14.2 c406e82

forwardemail/supertest@v7.2.2...v7.3.0

Commits

3634bdd 7.3.1
884cd26 Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind
e74a1e0 fix: bind ephemeral server to the loopback address it connects to
a3f5cb8 7.3.0
71dc5fb fix: stabilize ephemeral server requests and assertions
3b5ba5c Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd85...
c3419b2 Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2...
7e409db Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1
b55a7f9 Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expan...
7a5deaa Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslis...
Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

exclude bare builtins from namespace inheritance (38e1588)

expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)

make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

npm package (@latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

npm package (@latest dist-tag)

Commits

ca66105 test: fix drive-less file URLs in ESM resolver fixtures
2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
38e1588 fix: exclude bare builtins from namespace inheritance
562c434 fix: make namespaced register() overloads portable for declaration emit
edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
70e7828 test: upgrade tinyspy for disposable API
9ed2022 ci: avoid duplicate release notifications
872e77f refactor: use disposables for cleanup
6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
See full diff in compare view

Updates @types/bun from 1.4.0 to 1.4.2

Commits

See full diff in compare view

pkg-pr-new · 2026-10-03T01:42:17Z

@standard-server/aws-lambda

npm i https://pkg.pr.new/@standard-server/aws-lambda@143

@standard-server/core

npm i https://pkg.pr.new/@standard-server/core@143

@standard-server/fastify

npm i https://pkg.pr.new/@standard-server/fastify@143

@standard-server/fetch

npm i https://pkg.pr.new/@standard-server/fetch@143

@standard-server/node

npm i https://pkg.pr.new/@standard-server/node@143

@standard-server/peer

npm i https://pkg.pr.new/@standard-server/peer@143

@standard-server/shared

npm i https://pkg.pr.new/@standard-server/shared@143

commit: 5993526

codspeed · 2026-10-03T01:44:16Z

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

_{Comparing dependabot/npm_and_yarn/dev-dependencies-minor-patch-5d6459cbd3 (5993526) with main (2f06dd6)²}

108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (1053d1f) during the generation of this report, so 2f06dd6 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

codecov · 2026-10-03T01:44:22Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

… directory with 10 updates Bumps the dev-dependencies-minor-patch group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.1.1` | `2.1.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.4` | | [fastify](https://github.com/fastify/fastify) | `5.12.1` | `5.12.5` | | [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.87` | `0.0.88` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [@types/aws-lambda](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/aws-lambda) | `8.10.163` | `8.10.164` | | [supertest](https://github.com/ladjs/supertest) | `7.2.2` | `7.3.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.0` | `1.4.2` | Updates `@hono/node-server` from 2.1.1 to 2.1.3 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.1.1...v2.1.3) Updates `@types/node` from 26.4.1 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `fastify` from 5.12.1 to 5.12.5 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.1...v5.12.5) Updates `pkg-pr-new` from 0.0.87 to 0.0.88 - [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.88/packages/cli) Updates `ws` from 8.21.3 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.0) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `@types/aws-lambda` from 8.10.163 to 8.10.164 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/aws-lambda) Updates `supertest` from 7.2.2 to 7.3.1 - [Release notes](https://github.com/ladjs/supertest/releases) - [Commits](forwardemail/supertest@v7.2.2...v7.3.1) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `@types/bun` from 1.4.0 to 1.4.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/aws-lambda" dependency-version: 8.10.164 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/bun" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: fastify dependency-version: 5.12.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: pkg-pr-new dependency-version: 0.0.88 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: supertest dependency-version: 7.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 3, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-minor-patch-5d6459cbd3 branch from 02f1f55 to 5993526 Compare October 4, 2026 04:21

Navigation Menu

Uh oh!

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 10 updates - #143

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 10 updates#143
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-minor-patch-5d6459cbd3

dependabot Bot commented on behalf of github Oct 3, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

codspeed Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

v2.1.2

What's Changed

v5.12.5

⚠️ Security release

What's Changed

v5.12.4

v5.12.2

⚠️ Security release

What's Changed

8.22.0

Features

Bug fixes

v7.3.1

v7.3.0

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

Uh oh!

pkg-pr-new Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

codecov Bot commented Oct 3, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 3, 2026 •

edited

Loading

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

pkg-pr-new Bot commented Oct 3, 2026 •

edited

Loading

codspeed Bot commented Oct 3, 2026 •

edited

Loading