chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
@hono/node-server	1.19.14	1.19.17
fast-uri	3.1.3	3.1.7
hono	4.12.28	4.13.5
ip-address	10.2.0	10.7.0
postcss	8.5.16	8.5.28
qs	6.15.3	6.16.0

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

• 71941da 1.19.17
• 0208500 ci: add stage option for publishing (#386)
• cbdf713 1.19.16
• 86e96c2 ci: add an action for trusted publisher (#385)
• 99c1a1a ci: run on v1.x branch pushes
• 84cb2ee Merge commit from fork
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

Updates fast-uri from 3.1.3 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits

• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• Additional commits viewable in compare view

Updates hono from 4.12.28 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
• fix(client): skip undefined header and cookie values in honojs/hono#5244
• fix(client): skip an undefined entry inside a query array in honojs/hono#5272
• fix(client): skip an undefined entry inside a form array in honojs/hono#5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
• fix(client): omit empty query delimiter in honojs/hono#5283
• fix(request): drop stale content length for cloned FormData in honojs/hono#5282
• fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
• fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
• fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• 3a67f7f Merge commit from fork
• 9c28d72 Merge commit from fork
• 017000d 4.13.4
• 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
• 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
• c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
• 612b59c fix(request): drop stale content length for cloned FormData (#5282)
• 73794bd fix(client): omit empty query delimiter (#5283)
• Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

• Honor the fromURL graceful-failure contract for non-IPv6 hosts by @​beaugunderson in beaugunderson/ip-address#218
• Correct the documentation where it disagreed with the library by @​beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

• Add GitHub Actions CI by @​beaugunderson in beaugunderson/ip-address#213
• Keep the package loadable on node 12, and enforce it by @​beaugunderson in beaugunderson/ip-address#216
• Validate the byte arrays Address6 is given by @​beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

• 2b7cab5 10.7.0
• 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
• 42c1f8b 10.6.0
• fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
• 38b02d7 10.5.1
• d03e960 Merge commit from fork
• ab3dc88 Merge commit from fork
• ef98e0a 10.5.0
• 9fd1110 Correct the documentation where it disagreed with the library (#219)
• d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates postcss from 8.5.16 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Commits

• e544bff Release 8.5.28 version
• f8fc252 Typo
• 5039fd7 Add missed release notes
• ae40ca4 Release 8.5.27 version
• 62b1626 Fix linter
• 1dba938 Update dependencies
• 3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
• 6d23bc3 Fix link
• 508e997 Add GitHub Sponsors link
• e993739 Add CodeRabbit sponsor (#2145)
• Additional commits viewable in compare view

Updates qs from 6.15.3 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.