Skip to content

Bump the npm_and_yarn group across 2 directories with 4 updates - #274

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/js-host-api/examples/mcp-server/npm_and_yarn-149f3ea2bc
Open

Bump the npm_and_yarn group across 2 directories with 4 updates#274
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/js-host-api/examples/mcp-server/npm_and_yarn-149f3ea2bc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 1 update in the /src/js-host-api directory: js-yaml.
Bumps the npm_and_yarn group with 3 updates in the /src/js-host-api/examples/mcp-server directory: @hono/node-server, hono and ip-address.

Updates js-yaml from 4.3.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
Commits

Updates @hono/node-server from 1.19.14 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg


Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates hono from 4.12.27 to 4.13.2

Release notes

Sourced from hono's releases.

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
pingGET / 165.83 ns 163.99 ns 1.01x
queryGET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
jsonGET /user 528.99 ns 422.44 ns 1.25x
bodyPOST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

... (truncated)

Commits
  • 41bdc42 4.13.2
  • 6ea514d feat(secure-headers): add missing W3C Permissions-Policy directives (#5214)
  • 329b6f4 fix(client): send falsy JSON bodies (#5215)
  • a1e4ac7 perf(cors): pre-join static array header options during initialization (#5210)
  • d982f63 fix(url): strip trailing question mark correctly for optional params with reg...
  • 26de731 fix(etag): stabilize digest across stream chunks (#5205)
  • 7075369 Revert " fix(etag): resolve incorrect incremental hashing for chunked respons...
  • f2a72d3 fix(client): serialize multiple cookies correctly (#5202)
  • 8a5852d fix(etag): resolve incorrect incremental hashing for chunked responses (#5199)
  • 765d13b fix(jsx): render async children of document metadata tags instead of [object ...
  • Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.5.0

Release notes

Sourced from ip-address's releases.

v10.5.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • ef98e0a 10.5.0
  • 9fd1110 Correct the documentation where it disagreed with the library (#219)
  • d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
  • fbb8db2 10.4.0
  • 45a2b11 Validate the byte arrays Address6 is given (#217)
  • bac8810 Keep the package loadable on node 12, and enforce it (#216)
  • 9b3d848 Add a security policy and a README section on security posture
  • e84a7b3 Order the README API reference Address4, Address6, AddressError
  • 015160b Collapse each class in the README API reference
  • 34061a8 Pin checkout and setup-node to commits in the release job
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


@dependabot dependabot Bot added the kind/dependencies Dependency updates label Aug 12, 2026

@dependabot-pr-auto-approver dependabot-pr-auto-approver Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically approved by dependabot auto-approve workflow

Bumps the npm_and_yarn group with 1 update in the /src/js-host-api directory: [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 3 updates in the /src/js-host-api/examples/mcp-server directory: [@hono/node-server](https://github.com/honojs/node-server), [hono](https://github.com/honojs/hono) and [ip-address](https://github.com/beaugunderson/ip-address).


Updates `js-yaml` from 4.3.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.1)

Updates `@hono/node-server` from 1.19.14 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v2.1.1)

Updates `hono` from 4.12.27 to 4.13.2
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.27...v4.13.2)

Updates `ip-address` from 10.2.0 to 10.5.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.5.0)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.0
  dependency-type: indirect
- dependency-name: hono
  dependency-version: 4.13.1
  dependency-type: indirect
- dependency-name: ip-address
  dependency-version: 10.5.0
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/src/js-host-api/examples/mcp-server/npm_and_yarn-149f3ea2bc branch from 14af1e9 to dfdcc5d Compare August 15, 2026 04:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/dependencies Dependency updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants