chore(deps): Update npm dependencies - #494
Merged
Merged
Conversation
renovate
Bot
added
dependencies
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
13 times, most recently
from
June 30, 2026 10:53
02d5a9f to
eedcc8f
Compare
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
10 times, most recently
from
July 6, 2026 22:48
1e22286 to
1c420ac
Compare
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
3 times, most recently
from
July 8, 2026 14:42
d32094c to
fc6e7fd
Compare
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
13 times, most recently
from
July 15, 2026 17:09
11d0880 to
f37c244
Compare
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
6 times, most recently
from
July 21, 2026 13:42
3babb53 to
ef9cf64
Compare
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
from
July 21, 2026 21:11
ef9cf64 to
d16fdbe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.4.0→^1.5.1^0.8.0→^0.9.0^1.19.11→^1.20.2^2.108.0→^2.110.8^4.3.0→^4.3.3^5.101.0→^5.101.4^12.40.0→^12.42.2^4.12.25→^4.12.31^2.1.9→^2.1.10^1.17.0→^1.25.0^3.24.0→^3.26.0^12.40.0→^12.42.2^5.6.0→^5.7.0^4.3.0→^4.3.3^1.8.17→^1.9.1^4.22.4→^4.23.1^2.9.16→^2.10.5^7.3.5→^7.3.6^4.1.8→^4.1.10^7.12.7→^7.12.11^4.98.0→^4.113.0Release Notes
honojs/middleware (@hono/zod-openapi)
v1.5.1Compare Source
Patch Changes
7bc11dffa7dd5b639c614b12c34bd76722d76354]:v1.5.0Compare Source
Minor Changes
#1878
443a8dc5cd8a6a65daa2bec1f251adfc605b05ceThanks @SAY-5! - feat: inheritdefaultHookfrom parent app on nested routes mounted viaapp.route()Behavior change: if a parent app has a
defaultHookand a mounted sub-app does not declare its own, the sub-app's routes now use the parent'sdefaultHookinstead of the built-in validation response.Patch Changes
#2033
740123c01aadb6c2ed742d1c67c2763a4cdc4f1fThanks @yusukebe! - fix: resolve defaultHook through the ancestor chain on nested routes#2031
bf52ec2f18e32479ec85c00922c8aede68dc8286Thanks @tokiya-takai! - fix(zod-openapi): preserveonError()/notFound()set afterbasePath()OpenAPIHono.basePath()used to rebuild the instance by spreading the plainHonoclone returned bysuper.basePath().That spread copied the clone's arrow-function instance fields (
onError,notFound,request,fetch),which stay bound to the discarded clone — so calling
.onError()(or.notFound()) after.basePath()mutated the throwaway clone instead of the returned app and silently had no effect (the parent's handler ran instead).basePath()now transplants only the routing state onto a properly constructedOpenAPIHono, keeping its own correctly-bound methods. Fixes #2021.honojs/middleware (@hono/zod-validator)
v0.9.0Compare Source
Minor Changes
7bc11dffa7dd5b639c614b12c34bd76722d76354Thanks @yusukebe! - UseInferInputfromhono/validatorinstead of a local copy to avoid duplication (requireshono >=4.11.2)opennextjs/opennextjs-cloudflare (@opennextjs/cloudflare)
v1.20.2Compare Source
Patch Changes
#1312
38ea40bThanks @james-elicx! - fix: handle encoded middleware and cache paths safelyUpgrade
@opennextjs/awsto prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.#1313
766eee9Thanks @james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11#1306
97ef330Thanks @james-elicx! - fix: normalize Windows paths when patching the Turbopack runtimeEnsure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.
v1.20.1Compare Source
Patch Changes
#1297
780a21cThanks @james-elicx! - fix: disable response compression for skew protection API requestsAvoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.
v1.20.0Compare Source
Minor Changes
#1290
46c50fcThanks @james-elicx! - feature: add opt-in batch upload viarclonefor fast R2 cache population.Key Changes:
Optional
rcloneUpload: Install the optionalrclone.jspeer dependency and pass--rcloneto opt in torclonebased batch uploads.R2_ACCESS_KEY_IDR2_SECRET_ACCESS_KEYCF_ACCOUNT_IDExplicit Opt-in: The existing worker-based population path remains the default.
rcloneis only loaded when--rcloneis used for a remote cache.Clear Errors: The CLI reports missing credentials or a missing
rclone.jsinstallation when the option is used.Usage:
Install
rclone.js, then add the secrets in a.env/.dev.varsfile in your project root:pnpm add rclone.js pnpm approve-builds # select rclone.js pnpm rebuild rclone.js R2_ACCESS_KEY_ID=your_key R2_SECRET_ACCESS_KEY=your_secret CF_ACCOUNT_ID=your_account opennextjs-cloudflare deploy --rcloneYou can also set the environment variables for CI builds.
Notes:
rclonemay not be supported on all platforms.Patch Changes
#1289
eef243fThanks @thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges runBucketCachePurge.alarm()passed its tag bindings toSqlStorage.execas asingle array.
exec(query, ...bindings)is variadic over its bindings, so for amulti-tag
DELETE ... WHERE tag IN (?, ?, …)the binding count (1) disagreedwith the placeholder count (N) and
execthrew "Wrong number of parameterbindings" on every flush. On-demand
revalidateTagpurges therefore neverreached the Cloudflare cache, and with
bypassTagCacheOnCacheHitenabled pagesserved stale until the ISR TTL expired.
Spread the bindings, normalise the
INSERTto the same variadic form, andtighten the drain loop's guard from
while (tags.length >= 0)(which neverexits via the condition) to
while (tags.length > 0).#1291
51439b1Thanks @james-elicx! - fix: disable response compression when provisioning R2 cache bucketsAvoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.
supabase/supabase-js (@supabase/supabase-js)
v2.110.8Compare Source
2.110.8 (2026-07-21)
🩹 Fixes
❤️ Thank You
v2.110.7Compare Source
🩹 Fixes
❤️ Thank You
v2.110.6Compare Source
2.110.6 (2026-07-15)
🩹 Fixes
❤️ Thank You
v2.110.5Compare Source
2.110.5 (2026-07-14)
🩹 Fixes
❤️ Thank You
v2.110.4Compare Source
2.110.4 (2026-07-14)
🩹 Fixes
❤️ Thank You
v2.110.3Compare Source
2.110.3 (2026-07-13)
🩹 Fixes
❤️ Thank You
v2.110.2Compare Source
This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.
v2.110.1Compare Source
This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.
v2.110.0Compare Source
🚀 Features
❤️ Thank You
v2.109.0Compare Source
🩹 Fixes
❤️ Thank You
v2.108.2Compare Source
This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.
v2.108.1Compare Source
2.108.1 (2026-06-09)
🩹 Fixes
❤️ Thank You
tailwindlabs/tailwindcss (@tailwindcss/postcss)
v4.3.3Compare Source
Fixed
--watch --poll[=ms]in@tailwindcss/cliwhen filesystem events are unreliable or unavailable (#20297)bg-[#fff]andbg-[#FFF]→bg-white) (#20298)iframe:focus-visibleoutline styles (#20292)theme('colors.foo')in JS plugins resolves correctly when both--color-fooand--color-foo-barexist (#20299)shadow-sm/12.5,text-shadow-sm/12.5,drop-shadow-sm/12.5, andinset-shadow-sm/12.5(#20302)[data-foo]divas two selectors instead of one (#20303)@tailwindcss/postcssrebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)@tailwindcss/browserand Tailwind Play (#20124)oklch(#20314)--spacing(0)is optimized to0pxinstead of0so it remains a<length>when used incalc(…)(#20319)@parcel/watcheronly when needed in@tailwindcss/cli --watchmode, so one-off builds and--watch --pollwork when@parcel/watchercan't be loaded (#20325)system-uiandui-sans-serifso CJK text respects the page'slangattribute on Windows (#20318)@tailwindcss/upgradefrom rewriting ignored files when run from a subdirectory (#20329)@sourcerules pointing to nested files are scanned when later@sourcerules point to files in parent folders (#20335)@tailwindcss/vitefrom triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)v4.3.2Compare Source
Fixed
auto-rows-*andauto-cols-*utilities (e.g.auto-rows-12andauto-cols-16) (#20229)@tailwindcss/cliin--watchmode from crashing on Windows when@sourcepoints to a directory that doesn't exist (#20242)@tailwindcss/vitefrom crashing in Deno v2.8.x whencontext.parentURLis not a valid URL (#20245)@tailwindcss/cliin--watchmode rebuilds when the input CSS file changes in an ignored directory (#20246)@variantrules used inaddBase(…)to use custom variants defined later (#20247)@tailwindcss/vitefrom crashing during HMR when scanned files or directories are deleted (#20259)font-sizeinstead ofcolordeclarations fortext-[--spacing(…)](#20260)@sourcepatterns from scanning unrelated sibling files and folders (#20263)%]…[%in.tt,.tt2, and.txfiles (#20269)p.text-black[condition](#20269)@position-tryrules from triggering unknown at-rule warnings when optimizing CSS (#20277)--opacitytheme values (#20287)@tailwindcss/postcsswhen used with newer PostCSS patch releases (#20289)v4.3.1Compare Source
Added
--silentoption to suppress output in@tailwindcss/cli(#20100)Fixed
Module#registerHooksinstead ofModule#registeron Node 26+ (#20028)@applyto be used with CSS mixins (#19427)not-*correctly negates@containerqueries, includingstyle(…)queries (#20059)drop-shadow-*color utilities work with custom shadow values containingcalc(…)(#20080)@tailwindcss/vite(#20103)@tailwindcss/webpackcan be installed in Rspack projects without requiringwebpackas a peer dependency (#20027)calc(…)expressions (e.g.px-[calc(1rem+0px)]→px-[calc(1rem+0)]) (#20127)left-[99999px]→left-[99999px], notleft-24999.75) (#20130)@tailwindcss/cliin--watchmode recovers when a tracked dependency is deleted and restored (#20137)@tailwindcss/clibinaries are ignored when scanning for class candidates (#20139)addClass(…)andremoveClass(…)calls (#20198)@variantto be used insideaddBase(#19480)@sourceglobs with symlinks are preserved (#20203)@sourcerules can re-include files excluded by earlier@source notrules (#20203)@utilityrules (#20205)inset-shadow-noneand other inset shadows work correctly (#20208)@sourcedirectories are scanned even when ignored by git (#20214)@sourceglobs ending in**/*preserve dynamic path segments to avoid scanning too many files (#20217)calc(…)divisions when the result would require high precision (e.g.w-[calc(100%/3.5)]→w-[calc(100%/3.5)], notw-[28.571428571428573%]) (#20221)@tailwindcss/postcss(#20228)Changed
0instead ofcalc(var(--spacing) * 0)for spacing utilities likem-0andleft-0(#20196)var(--spacing)instead ofcalc(var(--spacing) * 1)for spacing utilities likem-1andleft-1(#20196)TanStack/query (@tanstack/react-query)
v5.101.4Compare Source
Patch Changes
v5.101.3Compare Source
Patch Changes
7e3c822]:v5.101.2Compare Source
Patch Changes
v5.101.1Compare Source
Patch Changes
9eff92e]:motiondivision/motion (framer-motion)
v12.42.2Compare Source
Fixed
animateView: Cropped group layers now animateborder-radiusfrom the old to new radius.v12.42.1Compare Source
Fixed
animateView: Old layer fade out now cancelled when defining.new().v12.42.0Compare Source
Changed
animateView: Layers are automatically grouped to match their DOM-hierarchy. New.group(false)method opts-out.Fixed
animateView: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios.animateView: Disabled automaticborder-radiusanimation.v12.41.0Compare Source
Added
animateView: Moves from Motion+ Early Access and alpha to main library.animateView:.add()resolves a CSS selector orElementto automatically generate, apply and removeview-transition-name.animateView:.new()and.old()configures values to animate on new and old layers.animateView:.layout()can set a custom transition on the size/position animation of the currently selected elements.animateView: Group layers now automatically crop with children set tocover, withborder-radiusanimating from old radius to new..crop(false)disables this behaviour.animateView:.class(name)tags currently selected elements with aview-transition-classas a custom CSS hook.Fixed
AnimatePresence: Prevent stuck exit animations when children interrupt.drag: Childe.stopPropagation()no longer break drag end.motionpackage.animateLayout: Improve handling of parallel/interleaved calls.Changed
animateView:.enter()and.exit()now refer specifically tonewandoldlayers where there are no matchingoldornewlayers.animateView: Interrupted transition setups now return resolved animation rather than throwing.honojs/hono (hono)
v4.12.31Compare Source
v4.12.30Compare Source
What's Changed
Full Changelog: honojs/hono@v4.12.29...v4.12.30
v4.12.29Compare Source
What's Changed
compatibilityDateby @yusukebe in #5100*as a match by @yusukebe in #5084New Contributors
Full Changelog: honojs/hono@v4.12.28...v4.12.29
v4.12.28Compare Source
What's Changed
*.tsbuildinfoby @yusukebe in #5066devDependenciesby @yusukebe in #5085New Contributors
Full Changelog: honojs/hono@v4.12.27...v4.12.28
v4.12.27Compare Source
Security fixes
This release includes fixes for the following security issues:
hono/jsx does not isolate context per request
Affects:
hono/jsx,hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, souseContext()/useRequestContext()read after anawaitin an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfjServer-Side XSS via JSX escaping bypass in cx()
Affects:
hono/css.cx()marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSXclassattribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59API Gateway v1 adapter can drop a repeated request header value
Affects:
hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g.203.0.113.1dropped when203.0.113.10is present) — affecting logic such asX-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvcUsers of
hono/jsx/hono/jsx-renderer,hono/css(cx()), or thehono/aws-lambdaAPI Gateway v1 / VPC Lattice adapters are encouraged to upgrade.v4.12.26Compare Source
What's Changed
Full Changelog: honojs/hono@v4.12.25...v4.12.26
evilmartians/lefthook (lefthook)
v2.1.10Compare Source
NO_COLORis set (#1449) by @viralpraxislucide-icons/lucide (lucide-react)
v1.25.0Compare Source
v1.24.0: Version 1.24.0Compare Source
What's Changed
toBeRemovedInVersionmetadata and make it optional in schema by @ericfennis with @Copilot in #4513optionicon by @jamiemlaw in #4326doticon by @cnlancehu in #4492circle-euro-signicon by @Guido3000 in #4353server-plusicon by @Turboman3000 in #4232New Contributors
Full Changelog: lucide-icons/lucide@1.23.0...1.24.0
v1.23.0: Version 1.23.0Compare Source
What's Changed
paper-bagicon by @dkast in #4023New Contributors
Full Changelog: lucide-icons/lucide@1.22.0...1.23.0
v1.22.0[Compare Source](https://redirect.github.com/lucide-ico
Configuration
📅 Schedule: (in timezone Asia/Tokyo)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.