fix(deps): update non-major dependencies by renovate[bot] · Pull Request #2 · goodmeta/x402-example

renovate · 2026-05-25T11:52:21Z

This PR contains the following updates:

Package	Change	Type	Update	Pending
@types/node (source)	`22.19.17` → `22.19.19`	devDependencies	patch	`22.19.21` (+1)
hono (source)	`^4.12.19` → `^4.12.23`	dependencies	patch	`4.12.25` (+1)
node	`20` → `20.20.2`	uses-with	minor
tsx (source)	`^4.22.2` → `^4.22.4`	devDependencies	patch
viem (source)	`^2.50.3` → `^2.51.3`	dependencies	minor	`2.52.2` (+1)

Release Notes

honojs/hono (hono)

`v4.12.23`

Compare Source

What's Changed

fix(serve-static): normalize all backslashes in file paths, not just the first in #4962
feat(context): export the Context class publicly by @BlankParticle in #4543
docs(contribution): add AI Usage Policy by @yusukebe in #4970
feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @na-trium-144 in #4961
fix(utils/ipaddr): do not compress a single 0 group to :: by @yusukebe in #4971

Full Changelog: honojs/hono@v4.12.22...v4.12.23

`v4.12.22`

Compare Source

What's Changed

chore: update vitest to v4 and cleanups by @BlankParticle in #4952
fix(mime): specify charset parameter per MIME type instead of mechanical detection by @renatograsso10 in #4912
fix(compress): respect Accept-Encoding when encoding option is set by @LeSingh1 in #4951
fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @ATOM00blue in #4955
feat: add msgpack as a compressible content type by @na-trium-144 in #4957

New Contributors

@renatograsso10 made their first contribution in #4912
@LeSingh1 made their first contribution in #4951
@ATOM00blue made their first contribution in #4955
@na-trium-144 made their first contribution in #4957

Full Changelog: honojs/hono@v4.12.21...v4.12.22

`v4.12.21`

Compare Source

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

`v4.12.20`

Compare Source

What's Changed

fix(route): preserve the base path of the mounted route() app by @usualoma in #4942
fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in #4947

New Contributors

@ashunar0 made their first contribution in #4947

Full Changelog: honojs/hono@v4.12.19...v4.12.20

actions/node-versions (node)

`v20.20.2`: 20.20.2

Compare Source

Node.js 20.20.2

`v20.20.1`: 20.20.1

Compare Source

Node.js 20.20.1

`v20.20.0`: 20.20.0

Compare Source

Node.js 20.20.0

`v20.19.6`: 20.19.6

Compare Source

Node.js 20.19.6

`v20.19.5`: 20.19.5

Compare Source

Node.js 20.19.5

`v20.19.4`: 20.19.4

Compare Source

Node.js 20.19.4

`v20.19.3`: 20.19.3

Compare Source

Node.js 20.19.3

`v20.19.2`: 20.19.2

Compare Source

Node.js 20.19.2

`v20.19.1`: 20.19.1

Compare Source

Node.js 20.19.1

`v20.19.0`: 20.19.0

Compare Source

Node.js 20.19.0

`v20.18.3`: 20.18.3

Compare Source

Node.js 20.18.3

`v20.18.2`: 20.18.2

Compare Source

Node.js 20.18.2

`v20.18.1`: 20.18.1

Compare Source

Node.js 20.18.1

`v20.18.0`: 20.18.0

Compare Source

Node.js 20.18.0

`v20.17.0`: 20.17.0

Compare Source

Node.js 20.17.0

`v20.16.0`: 20.16.0

Compare Source

Node.js 20.16.0

`v20.15.1`: 20.15.1

Compare Source

Node.js 20.15.1

`v20.15.0`: 20.15.0

Compare Source

Node.js 20.15.0

`v20.14.0`: 20.14.0

Compare Source

Node.js 20.14.0

`v20.13.1`: 20.13.1

Compare Source

Node.js 20.13.1

`v20.13.0`: 20.13.0

Compare Source

Node.js 20.13.0

`v20.12.2`: 20.12.2

Compare Source

Node.js 20.12.2

`v20.12.1`: 20.12.1

Compare Source

Node.js 20.12.1

`v20.12.0`: 20.12.0

Compare Source

Node.js 20.12.0

`v20.11.1`: 20.11.1

Compare Source

Node.js 20.11.1

`v20.11.0`: 20.11.0

Compare Source

Node.js 20.11.0

`v20.10.0`: 20.10.0

Compare Source

Node.js 20.10.0

`v20.9.0`: 20.9.0

Compare Source

Node.js 20.9.0

`v20.8.1`: 20.8.1

Compare Source

Node.js 20.8.1

`v20.8.0`: 20.8.0

Compare Source

Node.js 20.8.0

`v20.7.0`: 20.7.0

Compare Source

Node.js 20.7.0

`v20.6.1`: 20.6.1

Compare Source

Node.js 20.6.1

`v20.6.0`: 20.6.0

Compare Source

Node.js 20.6.0

`v20.5.1`: 20.5.1

Compare Source

Node.js 20.5.1

`v20.5.0`: 20.5.0

Compare Source

Node.js 20.5.0

`v20.4.0`: 20.4.0

Compare Source

Node.js 20.4.0

`v20.3.1`: 20.3.1

Compare Source

Node.js 20.3.1

`v20.3.0`: 20.3.0

Compare Source

Node.js 20.3.0

`v20.2.0`: 20.2.0

Compare Source

Node.js 20.2.0

`v20.1.0`: 20.1.0

Compare Source

Node.js 20.1.0

privatenumber/tsx (tsx)

`v4.22.4`

Compare Source

Bug Fixes

resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

This release is also available on:

npm package (@latest dist-tag)

`v4.22.3`

Compare Source

wevm/viem (viem)

`v2.51.3`

Compare Source

Patch Changes

#4675 cc15e56ae47e03d2ec8fe9b0e443b4e52b7c350a Thanks @deodad! - Fixed access key metadata reads incorrectly using the client account.

`v2.51.2`

Compare Source

Patch Changes

#4668 672a7ef72cd7fb9b9330d5c90979729e6b96cbbc Thanks @deodad! - viem/tempo: Fixed signVoucher to raw sign channel vouchers with access key accounts.
#4672 c582dad966c136488b9f36c01f0f3986ff98e407 Thanks @deodad! - Added a Tempo key authorization manager that can be used by prepareTransactionRequest to attach pending key authorizations.

`v2.51.0`

Compare Source

Minor Changes

#4663 752712f1d2358715e9d63bd754f80c90a8d02e91 Thanks @jxom! - viem/tempo: Added Actions.channel actions for reading and mutating TIP-20 channel reserve state.
#4597 d346038e71f31cb1c82fc94bb49c4ac553a23717 Thanks @wwared! - viem/op-stack: Added OP Stack super-root dispute game support for withdrawal prove flows.
#4661 9713c7562eac9fd328e6cc1be7388bc1659a9c27 Thanks @jxom! - Updated generated Tempo precompile ABIs from latest Tempo main and added logoURI to TIP-20 metadata and token creation.
#4653 a29cf5eef5809b50bbb7931f35331203c32d7692 Thanks @islishude! - Added support for eth_getBlockReceipts.

Patch Changes

#4650 73b8b89c0369597bf4df781b021130f544ebe6b0 Thanks @deodad! - Exported ExtractFormattedTransactionRequest.
#4664 c3fda73603695bc68336f6e22f6475ba6ed0cdc7 Thanks @jxom! - Handled eth_createAccessList responses that include an error field.
#4660 c5cc58ebbc027029022f09eba54ed2e789b8b2b1 Thanks @struong! - Emitted a full broadcast envelope when the fee payer co-signed during eth_fillTransaction, enabling single round-trip sponsorship, and stripped feeToken from the sender's sign payload under sponsorship per the Tempo Transaction spec.
#4654 038a062a8c2a875a3bbd58426e6060cf5d1d7986 Thanks @deodad! - Added raw signing support to Tempo access key accounts.

`v2.50.4`

Compare Source

Patch Changes

#4647 423131df9e00e3df062274e483b98a4921674cea Thanks @jxom! - Fixed Tempo chain declarations to emit portable inferred types for exported derived chains.

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 12:00 on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from a6f42cf to b719fd2 Compare June 3, 2026 03:56

renovate Bot changed the title ~~chore(deps): update non-major dependencies~~ fix(deps): update non-major dependencies Jun 3, 2026

renovate Bot force-pushed the renovate/non-major-dependencies branch 2 times, most recently from feae7b6 to 608e7c4 Compare June 13, 2026 04:07

fix(deps): update non-major dependencies

635665f

renovate Bot force-pushed the renovate/non-major-dependencies branch from 608e7c4 to 635665f Compare June 14, 2026 15:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update non-major dependencies#2

fix(deps): update non-major dependencies#2
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-dependencies

renovate Bot commented May 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

New Contributors

Security fixes

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

IP Restriction bypasses static deny rules for non-canonical IPv6

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

JWT middleware accepts any Authorization scheme, not only Bearer

What's Changed

New Contributors

v20.20.2: 20.20.2

v20.20.1: 20.20.1

v20.20.0: 20.20.0

v20.19.6: 20.19.6

v20.19.5: 20.19.5

v20.19.4: 20.19.4

v20.19.3: 20.19.3

v20.19.2: 20.19.2

v20.19.1: 20.19.1

v20.19.0: 20.19.0

v20.18.3: 20.18.3

v20.18.2: 20.18.2

v20.18.1: 20.18.1

v20.18.0: 20.18.0

v20.17.0: 20.17.0

v20.16.0: 20.16.0

v20.15.1: 20.15.1

v20.15.0: 20.15.0

v20.14.0: 20.14.0

v20.13.1: 20.13.1

v20.13.0: 20.13.0

v20.12.2: 20.12.2

v20.12.1: 20.12.1

v20.12.0: 20.12.0

v20.11.1: 20.11.1

v20.11.0: 20.11.0

v20.10.0: 20.10.0

v20.9.0: 20.9.0

v20.8.1: 20.8.1

v20.8.0: 20.8.0

v20.7.0: 20.7.0

v20.6.1: 20.6.1

v20.6.0: 20.6.0

v20.5.1: 20.5.1

v20.5.0: 20.5.0

v20.4.0: 20.4.0

v20.3.1: 20.3.1

v20.3.0: 20.3.0

v20.2.0: 20.2.0

v20.1.0: 20.1.0

Bug Fixes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 25, 2026 •

edited

Loading

`v20.20.2`: 20.20.2

`v20.20.1`: 20.20.1

`v20.20.0`: 20.20.0

`v20.19.6`: 20.19.6

`v20.19.5`: 20.19.5

`v20.19.4`: 20.19.4

`v20.19.3`: 20.19.3

`v20.19.2`: 20.19.2

`v20.19.1`: 20.19.1

`v20.19.0`: 20.19.0

`v20.18.3`: 20.18.3

`v20.18.2`: 20.18.2

`v20.18.1`: 20.18.1

`v20.18.0`: 20.18.0

`v20.17.0`: 20.17.0

`v20.16.0`: 20.16.0

`v20.15.1`: 20.15.1

`v20.15.0`: 20.15.0

`v20.14.0`: 20.14.0

`v20.13.1`: 20.13.1

`v20.13.0`: 20.13.0

`v20.12.2`: 20.12.2

`v20.12.1`: 20.12.1

`v20.12.0`: 20.12.0

`v20.11.1`: 20.11.1

`v20.11.0`: 20.11.0

`v20.10.0`: 20.10.0

`v20.9.0`: 20.9.0

`v20.8.1`: 20.8.1

`v20.8.0`: 20.8.0

`v20.7.0`: 20.7.0

`v20.6.1`: 20.6.1

`v20.6.0`: 20.6.0

`v20.5.1`: 20.5.1

`v20.5.0`: 20.5.0

`v20.4.0`: 20.4.0

`v20.3.1`: 20.3.1

`v20.3.0`: 20.3.0

`v20.2.0`: 20.2.0

`v20.1.0`: 20.1.0