Skip to content

fix(deps): update all minor dependencies#410

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-dependencies
Open

fix(deps): update all minor dependencies#410
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-dependencies

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 19, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@dotenvx/dotenvx 1.52.0 → 1.54.1 age confidence devDependencies minor 1.57.1 (+4)
@faker-js/faker (source) 10.2.0 → 10.3.0 age confidence devDependencies minor
@hono/swagger-ui (source) 0.5.3 → 0.6.0 age confidence dependencies minor 0.6.1
@supabase/ssr 0.8.0 → 0.9.0 age confidence dependencies minor
@supabase/supabase-js (source) 2.93.3 → 2.98.0 age confidence dependencies minor 2.99.3 (+3)
@tailwindcss/postcss (source) 4.1.18 → 4.2.1 age confidence dependencies minor 4.2.2
@types/node (source) 24.10.11 → 24.12.0 age confidence dependencies minor
@types/node (source) 24.10.11 → 24.12.0 age confidence devDependencies minor
es-toolkit (source) 1.44.0 → 1.45.1 age confidence dependencies minor
hono (source) 4.11.8 → 4.12.5 age confidence dependencies minor 4.12.8 (+2)
lucide-react (source) 0.563.0 → 0.577.0 age confidence dependencies minor
node (source) 24.13.0 → 24.14.0 age confidence minor
postgres 18.1 → 18.2 age confidence service minor 18.3
supabase/edge-runtime v1.70.1 → v1.71.0 age confidence minor v1.73.0 (+3)
supabase/gotrue v2.186.0 → v2.187.0 age confidence minor v2.188.1
supabase/logflare 1.30.8 → 1.34.10 age confidence minor 1.34.14 (+2)
supabase/postgres-meta v0.95.2 → v0.96.1 age confidence minor
supabase/realtime v2.73.5 → v2.78.11 age confidence minor v2.78.15 (+3)
supabase/storage-api v1.36.0 → v1.42.2 age confidence minor v1.44.9 (+14)
tailwind-merge 3.4.0 → 3.5.0 age confidence dependencies minor
tailwindcss (source) 4.1.18 → 4.2.1 age confidence dependencies minor 4.2.2

Release Notes

dotenvx/dotenvx (@​dotenvx/dotenvx)

v1.54.1

Compare Source

Changed
  • Fix npm publish

v1.53.0

Compare Source

Removed
  • Remove radar. It has been a year since replaced by ops. (#​743)
faker-js/faker (@​faker-js/faker)

v10.3.0

Compare Source

New Locales
Features
Changed Locales
Bug Fixes
honojs/middleware (@​hono/swagger-ui)

v0.6.0

Compare Source

Minor Changes
supabase/ssr (@​supabase/ssr)

v0.9.0

Compare Source

Features
  • release workflow RC versioning and publish reliability (#​164) (81e68f4)
supabase/supabase-js (@​supabase/supabase-js)

v2.98.0

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

v2.97.0

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

v2.96.0

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

v2.95.3

Compare Source

🚀 Features
  • supabase: add canonical CORS headers export for edge functions (#​2071)
❤️ Thank You

v2.95.2

Compare Source

2.95.2 (2026-02-05)

🩹 Fixes
  • supabase: add module to tsdoc (1fac0c45)
❤️ Thank You
  • Katerina Skroumpelou

v2.95.1

Compare Source

2.95.1 (2026-02-05)

This was a version bump only, there were no code changes.

v2.95.0

Compare Source

🚀 Features
  • supabase: add canonical CORS headers export for edge functions (#​2071)
❤️ Thank You

v2.94.1

Compare Source

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

v2.94.0

Compare Source

🚀 Features
  • postgrest: add URL length validation and timeout protection (#​2078)
❤️ Thank You
tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.2.1

Compare Source

Fixed
  • Allow trailing dash in functional utility names for backwards compatibility (#​19696)
  • Properly detect classes containing . characters within curly braces in MDX files (#​19711)

v4.2.0

Compare Source

Added
  • Add mauve, olive, mist, and taupe color palettes to the default theme (#​19627)
  • Add @tailwindcss/webpack package to run Tailwind CSS as a webpack plugin (#​19610)
  • Add pbs-* and pbe-* utilities for padding-block-start and padding-block-end (#​19601)
  • Add mbs-* and mbe-* utilities for margin-block-start and margin-block-end (#​19601)
  • Add scroll-pbs-* and scroll-pbe-* utilities for scroll-padding-block-start and scroll-padding-block-end (#​19601)
  • Add scroll-mbs-* and scroll-mbe-* utilities for scroll-margin-block-start and scroll-margin-block-end (#​19601)
  • Add border-bs-* and border-be-* utilities for border-block-start and border-block-end (#​19601)
  • Add inline-*, min-inline-*, max-inline-* utilities for inline-size, min-inline-size, and max-inline-size (#​19612)
  • Add block-*, min-block-*, max-block-* utilities for block-size, min-block-size, and max-block-size (#​19612)
  • Add inset-s-*, inset-e-*, inset-bs-*, inset-be-* utilities for inset-inline-start, inset-inline-end, inset-block-start, and inset-block-end (#​19613)
  • Add font-features-* utility for font-feature-settings (#​19623)
Fixed
  • Prevent double @supports wrapper for color-mix values (#​19450)
  • Allow whitespace around @source inline() argument (#​19461)
  • Emit comment when source maps are saved to files when using @tailwindcss/cli (#​19447)
  • Detect utilities containing capital letters followed by numbers (#​19465)
  • Fix class extraction for Rails' strict locals (#​19525)
  • Align @utility name validation with Oxide scanner rules (#​19524)
  • Fix infinite loop when using @variant inside @custom-variant (#​19633)
  • Allow multiples of .25 in aspect-* fractions (e.g. aspect-8.5/11) (#​19688)
  • Ensure changes to external files listed via @source trigger a full page reload when using @tailwindcss/vite (#​19670)
  • Improve performance of Oxide scanner in bigger projects by reducing file system walks (#​19632)
  • Ensure import aliases in Astro v5 work without crashing when using @tailwindcss/vite (#​19677)
  • Allow escape characters in @utility names to improve support with formatters such as Biome (#​19626)
  • Fix incorrect canonicalization results when canonicalizing multiple times (#​19675)
  • Add .jj to default ignored content directories (#​19687)
Deprecated
  • Deprecate start-* and end-* utilities in favor of inset-s-* and inset-e-* utilities (#​19613)
toss/es-toolkit (es-toolkit)

v1.45.1

Compare Source

Released on March 4th, 2026.

  • Reverted the return type of sample to not include undefined.
  • Fixed Deno install command to include jsr: prefix. ([#​1627])

We sincerely thank @​mwln for their contributions. We appreciate your great efforts!

v1.45.0

Compare Source

Released on March 2nd, 2026.

  • Fixed findIndex to add missing default parameter for doesMatch. ([#​1373])
  • Fixed sample to include undefined in return union type. ([#​1302])
  • Fixed cloneDeep to support cloning Error objects.
  • Fixed retry to correctly match retry count with the retries option.
  • Fixed missing Map and Set in check-dist entrypoints.
  • Fixed missing packages in publishConfig. ([#​1597])
  • Reverted the overload for runtime-determined key arrays in omit. ([#​1595])
  • Added AI Integration page with llms.txt documentation to docs.

We sincerely thank @​D-Sketon, @​dayongkr, @​matthiasfeist, @​raon0211, and @​screendriver for their contributions. We appreciate your great efforts!

honojs/hono (hono)

v4.12.5

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Compare Source

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

Middleware Bypass in Serve Static

Affects: Serve Static middleware. Fixes inconsistent URL decoding that could allow protected static resources to be accessed without triggering route-based middleware. GHSA-q5qw-h33p-qvwr

Users who uses Strreaming Helper, Cookie utility, and Serve Static are strongly encouraged to upgrade to this version.

Other changes

New Contributors

Full Changelog: honojs/hono@v4.12.3...v4.12.4

v4.12.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.2...v4.12.3

v4.12.2

Compare Source

Security fix

Fixed incorrect handling of X-Forwarded-For in the AWS Lambda adapter behind ALB that could allow IP-based access control bypass. The detail: GHSA-xh87-mx6m-69f3

Thanks @​EdamAme-x

What's Changed

Full Changelog: honojs/hono@v4.12.1...v4.12.2

v4.12.1

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.12.0...v4.12.1

v4.12.0

Compare Source

Release Notes

Hono v4.12.0 is now available!

This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context.

$path for Hono Client

The Hono client now has a $path() method that returns the path string instead of a full URL. This is useful when you need just the path portion for routing or key-based operations:

const client = hc<typeof app>('http://localhost:8787')

// Get the path string
const path = client.api.posts.$path()
// => '/api/posts'

// With path parameters
const postPath = client.api.posts[':id'].$path({
  param: { id: '123' },
})
// => '/api/posts/123'

// With query parameters
const searchPath = client.api.posts.$path({
  query: { filter: 'test' },
})
// => '/api/posts?filter=test'

Unlike $url() which returns a URL object, $path() returns a plain path string, making it convenient for use with routers or as cache keys.

Thanks @​ShaMan123!

ApplyGlobalResponse Type Helper for RPC Client

The new ApplyGlobalResponse type helper allows you to add global error response types to all routes in the RPC client. This is useful for typing common error responses from app.onError() or global middlewares:

const app = new Hono()
  .get('/api/users', (c) => c.json({ users: ['alice', 'bob'] }, 200))
  .onError((err, c) => c.json({ error: err.message }, 500))

type AppWithErrors = ApplyGlobalResponse<
  typeof app,
  {
    401: { json: { error: string; message: string } }
    500: { json: { error: string; message: string } }
  }
>

const client = hc<AppWithErrors>('http://api.example.com')
// Now client knows about both success and error responses
const res = await client.api.users.$get()
// InferResponseType includes { users: string[] } | { error: string; message: string }

Thanks @​mohankumarelec!

SSG Redirect Plugin

A new redirectPlugin for SSG generates static HTML redirect pages for HTTP redirect responses (301, 302, 303, 307, 308):

import { toSSG } from 'hono/ssg'
import { defaultPlugin, redirectPlugin } from 'hono/ssg'

const app = new Hono()
app.get('/old', (c) => c.redirect('/new'))
app.get('/new', (c) => c.html('New Page'))

// redirectPlugin must be placed before defaultPlugin
await toSSG(app, fs, {
  plugins: [redirectPlugin(), defaultPlugin()],
})

The generated redirect pages include a <meta http-equiv="refresh"> tag, a canonical link, and a robots noindex meta tag.

Thanks @​3w36zj6!

onAuthSuccess Callback for Basic Auth

The Basic Auth middleware now supports an onAuthSuccess callback that is invoked after successful authentication. This allows you to set context variables or perform logging without re-parsing the Authorization header:

app.use(
  '/auth/*',
  basicAuth({
    username: 'hono',
    password: 'ahotproject',
    onAuthSuccess: (c, username) => {
      c.set('user', { name: username, role: 'admin' })
      console.log(`User ${username} authenticated`)
    },
  })
)

The callback also works with async functions and the verifyUser mode.

Thanks @​AprilNEA!

getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify

getConnInfo() is now available for three additional adapters:

// AWS Lambda (supports API Gateway v1, v2, and ALB)
import { handle, getConnInfo } from 'hono/aws-lambda'

// Cloudflare Pages
import { handle, getConnInfo } from 'hono/cloudflare-pages'

// Netlify
import { handle, getConnInfo } from 'hono/netlify'

app.get('/', (c) => {
  const info = getConnInfo(c)
  return c.text(`Your IP: ${info.remote.address}`)
})

Thanks @​rokasta12!

alwaysRedirect Option for Trailing Slash Middleware

The trailing slash middleware now supports an alwaysRedirect option. When enabled, the middleware redirects before executing handlers, which fixes the issue where trailing slash handling doesn't work with wildcard routes:

app.use(trimTrailingSlash({ alwaysRedirect: true }))

app.get('/my-path/*', async (c) => {
  return c.text('wildcard')
})

// /my-path/something/ will be redirected to /my-path/something
// before the wildcard handler is executed

Progressive Locale Code Truncation

The normalizeLanguage function in the language middleware now supports RFC 4647 Lookup-based progressive truncation. Locale codes like ja-JP will match ja when only the base language is in supportedLanguages:

app.use(
  '/*',
  languageDetector({
    supportedLanguages: ['en', 'ja'],
    fallbackLanguage: 'en',
    order: ['cookie', 'header'],
  })
)

// Accept-Language: ja-JP → matches 'ja'
// Accept-Language: ko-KR → falls back to 'en'

Thanks @​sorafujitani!

exports Field for ExecutionContext

The ExecutionContext type now includes an exports property for Cloudflare Workers. You can use module augmentation to type it with Wrangler's generated types:

import 'hono'

declare module 'hono' {
  interface ExecutionContext {
    readonly exports: Cloudflare.Exports
  }
}

Thanks @​toreis-up!

Performance Improvements

TrieRouter 1.5x ~ 2.0x Faster

The TrieRouter has been significantly optimized with reduced spread syntax usage, O(1) hasChildren checks, lazy regular expression generation, and removal of redundant processes:

Route Node.js Deno Bun
short static GET /user 1.70x 1.40x 1.34x
dynamic GET /user/lookup/username/hey 1.38x 1.69x 1.51x
wildcard GET /static/index.html 1.51x 1.72x 1.43x
all together 1.58x 1.60x 1.82x

Thanks @​EdamAme-x!

Fast Path for c.json()

c.json() now has the same fast path optimization as c.text(). When no custom status, headers, or finalized state exists, the Response is created directly without allocating a Headers object:

// This common pattern is now faster
return c.json({ message: 'Hello' })

Benchmark results:

Metric Before After Change
Reqs/sec 92,268 95,244 +3.2%
Latency 5.42ms 5.25ms -3.1%
Throughput 17.24MB/s 19.07MB/s +10.6%

Thanks @​mgcrea!

New features

  • feat(client): Add ApplyGlobalResponse type helper for RPC Client #​4556
  • feat(ssg): add redirect plugin #​4599
  • feat(client): $path #​4636
  • feat(basic-auth): add context key and callback options #​4645
  • feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify #​4649
  • feat(trailing-slash): add alwaysRedirect option to support wildcard routes #​4658
  • feat(language): add progressive locale code truncation to normalizeLanguage #​4717
  • feat(types): Add exports field to ExecutionContext #​4719

Performance

  • perf(context): add fast path to c.json() matching c.text() optimization #​4707
  • perf(trie-router): improve performance (1.5x ~ 2.0x) #​4724
  • perf(context): use createResponseInstance for new Response #​4733

All changes

New Contributors

Full Changelog: honojs/hono@v4.11.10...v4.12.0

v4.11.10

Compare Source

What's Changed

  • fix: fixed to be more properly timing safe (Merge commit from fork 91def7c)

Full Changelog: honojs/hono@v4.11.9...v4.11.10

v4.11.9

Compare Source

lucide-icons/lucide (lucide-react)

v0.577.0: Version 0.577.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

v0.576.0: Version 0.576.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

v0.575.0: Version 0.575.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

v0.574.0: Version 0.574.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.572.0...0.574.0

v0.573.0: Version 0.573.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.572.0...0.573.0

v0.572.0: Version 0.572.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.571.0...0.572.0

v0.571.0: Version 0.571.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.570.0...0.571.0

v0.570.0: Version 0.570.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@0.569.0...0.570.0

v0.569.0: Version 0.569.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@0.568.0...0.569.0

v0.568.0: Version 0.568.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.567.0...0.568.0

v0.567.0: Version 0.567.0

Compare Source

What's Changed

Configuration

📅 Schedule: Branch creation - Only on Friday ( * * * * 5 ) in timezone Asia/Tokyo, Automerge - Only on Sunday through Thursday and Saturday ( * * * * 0-4,6 ) in timezone Asia/Tokyo.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the renovate label Mar 19, 2026
@renovate renovate bot force-pushed the renovate/all-minor-dependencies branch 6 times, most recently from f7f731b to 9aebf18 Compare March 21, 2026 01:19
@renovate renovate bot force-pushed the renovate/all-minor-dependencies branch from 9aebf18 to 76d4704 Compare March 22, 2026 05:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants