chore: Bump the npm_and_yarn group across 1 directory with 9 updates by dependabot[bot] · Pull Request #428 · google/adk-js

dependabot · 2026-06-09T01:17:25Z

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
vitest	`3.2.4`	`4.1.8`
@mikro-orm/knex	`6.6.13`	`6.6.14`
qs	`6.14.2`	`6.15.2`
ip-address	`10.1.0`	`10.2.0`
fast-uri	`3.1.0`	`3.1.2`
fast-xml-builder	`1.1.5`	`1.2.0`
hono	`4.12.15`	`4.12.24`
protobufjs	`7.5.6`	`7.6.2`
ws	`8.20.0`	`8.21.0`

Updates vitest from 3.2.4 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in vitest-dev/vitest#10138 (31882)

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in vitest-dev/vitest#10196 (2847d)

browser: Simplify orchestrator otel carrier - by @hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

Stringify diff objects only once - by @sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in vitest-dev/vitest#10119 (0e0ff)

   🐞 Bug Fixes

--project negation excludes browser instances - by @felamaslen in vitest-dev/vitest#10131 (9423d)

Project color label on html reporter - by @hi-ogawa in vitest-dev/vitest#10142 (596f7)

Fix vi.defineHelper called as object method - by @hi-ogawa in vitest-dev/vitest#10163 (122c2)

Alias agent reporter to minimal - by @sheremet-va in vitest-dev/vitest#10157 (663b9)

Respect diff config options in soft assertions - by @Copilot, sheremet-va and @sheremet-va in vitest-dev/vitest#8696 (9787d)

Respect diff config options in soft assertions " - by @sheremet-va in vitest-dev/vitest#8696 (7dc6d)

ast-collect: Recognize _vi_import prefix in static test discovery - by @Yejneshwar in vitest-dev/vitest#10129 (32546)

coverage: Descriptive error message when reports directory is removed during test run - by @DaveT1991 and @AriPerkkio in vitest-dev/vitest#10117 (14133)

snapshot: Increase default snapshot max output length - by @hi-ogawa and Codex in vitest-dev/vitest#10150 (21e66)

ui: Fix jsx/tsx syntax highlight - by @hi-ogawa in vitest-dev/vitest#10152 (f1b1f)

web-worker: Support MessagePort objects referenced inside postMessage data - by @whitphx and Claude Opus 4.6 (1M context) in vitest-dev/vitest#9927 and vitest-dev/vitest#10124 (7ad7d)

api: Make test-specification options writable - by @sheremet-va in vitest-dev/vitest#10154 (6abd5)

    View changes on GitHub

... (truncated)

Commits

e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
18af98c fix(browser): simplify orchestrator otel carrier (#10285)
3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
e399846 chore: release v4.1.5
7dc6d54 Revert "fix: respect diff config options in soft assertions (#8696)"
9787ded fix: respect diff config options in soft assertions (#8696)
325463a fix(ast-collect): recognize _vi_import prefix in static test discovery (#10...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates @mikro-orm/knex from 6.6.13 to 6.6.14

Release notes

Sourced from @mikro-orm/knex's releases.

v6.6.14

6.6.14 (2026-05-04)

Bug Fixes

core: avoid crash on STI subclass @ManyToOne override targeting same hierarchy (#7646) (1df1632), closes #7599 #7598

core: drop entity from persist/remove stacks in uow.unsetIdentity() (#7661) (8bc4c77), closes #7639

core: escape embedded quote characters in quoteIdentifier (#7654) (a1f005b)

core: escape JSON path keys in getSearchJsonPropertyKey (#7657) (1d0710c)

core: merge nested fields paths into explicit populate (#7664) (f73568a), closes #7605

core: recognize TypeScript's __esDecorate helper in decorator path lookup (#7665) (3b53296), closes #7584 #7583

core: respect hidden flag with populate: ['*'] in serialize() (#7660) (752c108), closes #7637

core: skip getter-only properties in assignDefaultValues (#7659) (ff65622), closes #7575

postgres: schema-qualify generated drop index statements (#7662) (d588a02), closes #7603

postgres: treat timetz / time with time zone as aliases in schema diff (#7663) (686d2f8), closes #7618

Changelog

Sourced from @mikro-orm/knex's changelog.

6.6.14 (2026-05-04)

Bug Fixes

core: avoid crash on STI subclass @ManyToOne override targeting same hierarchy (#7646) (1df1632), closes #7599 #7598

core: drop entity from persist/remove stacks in uow.unsetIdentity() (#7661) (8bc4c77), closes #7639

core: escape embedded quote characters in quoteIdentifier (#7654) (a1f005b)

core: escape JSON path keys in getSearchJsonPropertyKey (#7657) (1d0710c)

core: merge nested fields paths into explicit populate (#7664) (f73568a), closes #7605

core: recognize TypeScript's __esDecorate helper in decorator path lookup (#7665) (3b53296), closes #7584 #7583

core: respect hidden flag with populate: ['*'] in serialize() (#7660) (752c108), closes #7637

core: skip getter-only properties in assignDefaultValues (#7659) (ff65622), closes #7575

postgres: schema-qualify generated drop index statements (#7662) (d588a02), closes #7603

postgres: treat timetz / time with time zone as aliases in schema diff (#7663) (686d2f8), closes #7618

Commits

e9b32a2 chore(release): v6.6.14 [skip ci]
f73568a fix(core): merge nested fields paths into explicit populate (#7664)
686d2f8 fix(postgres): treat timetz / time with time zone as aliases in schema diff (...
3b53296 fix(core): recognize TypeScript's __esDecorate helper in decorator path looku...
d588a02 fix(postgres): schema-qualify generated drop index statements (#7662)
8bc4c77 fix(core): drop entity from persist/remove stacks in uow.unsetIdentity() (#7661)
ff65622 fix(core): skip getter-only properties in assignDefaultValues (#7659)
752c108 fix(core): respect hidden flag with populate: ['*'] in serialize() (#7660)
6693d34 chore(deps): update knex to v3.2.10 (6.x) (#7658)
1d0710c fix(core): escape JSON path keys in getSearchJsonPropertyKey (#7657)
Additional commits viewable in compare view

Updates qs from 6.14.2 to 6.15.2

Changelog

Sourced from qs's changelog.

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

[Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters

[Deps] update @ljharb/eslint-config

[Dev Deps] update @ljharb/eslint-config, iconv-lite

[Tests] increase coverage

6.15.0

[New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)

[Fix] duplicates option should not apply to bracket notation keys (#514)

Commits

9aca407 v6.15.2
5e33d33 [Dev Deps] update @ljharb/eslint-config
21f80b3 [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + `e...
a0a81ea [Fix] stringify: use configured delimiter after charsetSentinel
e3062f7 [Fix] stringify: apply formatter to encoded key under strictNullHandling
0c180a4 [Fix] stringify: skip null/undefined filter-array entries instead of crashi...
3a8b94a [Tests] add regression tests for keys containing percent-encoded bracket text
96755ab [readme] fix grammar
a419ce5 [Fix] parse: handle nested bracket groups and add regression tests
3f5e1c5 v6.15.1
Additional commits viewable in compare view

Updates ip-address from 10.1.0 to 10.2.0

Commits

80fccaa 10.2.0
abaeb4d Type Address4.addressMinusSuffix as non-nilable (closes #143)
2878c29 Preserve subnet prefix through Address6.to4() (closes #123) (#203)
586666e Reject trailing junk in Address6.fromURL (closes #158) (#202)
80bc76e Validate static factories instead of silently overflowing (#201)
98927be Clarify isValid() accepts CIDRs with host bits set (#81)
a0eb073 Fix getScope() and broaden getType() classification (closes #122) (#200)
ec52105 Add networkForm() for CIDR network-address strings (#199)
a9443a7 Add isMapped4() predicate for IPv4-mapped IPv6 addresses (closes #62) (#198)
f01d742 Add address-property predicates (private, ULA, loopback, link-local, etc.) (#...
Additional commits viewable in compare view

Updates fast-uri from 3.1.0 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

Fix for GHSA-q3j6-qgpj-74h6

What's Changed

build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in fastify/fast-uri#148

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in fastify/fast-uri#149

chore(.npmrc): ignore scripts by @Fdawgs in fastify/fast-uri#150

build(deps-dev): remove @fastify/pre-commit by @Fdawgs in fastify/fast-uri#151

build(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in fastify/fast-uri#152

ci(ci): add concurrency config by @Fdawgs in fastify/fast-uri#153

build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in fastify/fast-uri#154

build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in fastify/fast-uri#156

chore(license): standardise license notice by @Fdawgs in fastify/fast-uri#159

style: remove trailing whitespace by @Fdawgs in fastify/fast-uri#161

ci: remove unused github files by @Tony133 in fastify/fast-uri#162

chore: update readme by @Tony133 in fastify/fast-uri#164

build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#165

build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#166

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in fastify/fast-uri#167

ci: add lock-threads workflow by @Fdawgs in fastify/fast-uri#169

New Contributors

@Tony133 made their first contribution in fastify/fast-uri#162

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

Commits

919dd8e Bumped v3.1.2
c65ba57 fixup: linting
6c86c17 Merge commit from fork
a95158a Handle malformed fragment decoding without throwing (#171)
cea547c Bumped v3.1.1
876ce79 Merge commit from fork
dcdf690 ci: add lock-threads workflow (#169)
c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
9b4c6dc build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)
85d09a9 build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
Additional commits viewable in compare view

Updates fast-xml-builder from 1.1.5 to 1.2.0

Changelog

Sourced from fast-xml-builder's changelog.

1.2.0 (2026-05-08)

Add support for sanitizeName option

Support xml-naming for validating and sanitizing tag and attribute names

1.1.9 (2026-05-06)

fix: format output for preserve order when indent by is set to empty string

1.1.8 (2026-05-05)

fix: skip text property for PI tags

improve typings

1.1.7 (2026--05-04)

fix security issues when attribute value contains quotes

1.1.6 (2026--05-04)

fix security issues related to comment

skip comment with null value

1.1.5 (2026-04-17)

fix security issues related to comment and cdata

1.1.4 (2026-03-16)

support maxNestedTags option

1.1.3 (2026-03-13)

declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

1.1.2 (2026-03-11)

fix typings

1.1.1 (2026-03-11)

upgrade path-expression-matcher to 1.1.3

1.1.0 (2026-03-10)

Integrate path-expression-matcher

Commits

a9a905b for release
42680e8 support name sanitization
8b00185 release info
8a08f17 allow indentation to be empty string
7fc5dec update docs
c241b6a improve documentation
15d5668 update for release
9877485 fix: skip text property for PI tags
311a221 fix #5 typing import issues
e8fc5b1 update for releast
Additional commits viewable in compare view

Updates hono from 4.12.15 to 4.12.24

Release notes

Sourced from hono's releases.

v4.12.24

What's Changed

docs(contribution): simplifyAI Usage Policy by @yusukebe in honojs/hono#4972

chore: remove @types/glob by @rtritto in honojs/hono#4978

fix(bearer-auth): mention verifyToken in missing-options error message by @tan7vir in honojs/hono#4987

refactor(language): Test/improve tests on languages middleware by @iNeoO in honojs/hono#4980

fix(utils/ipaddr): expand "::" to eight zero groups by @youcefzemmar in honojs/hono#4973

fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @Mohammad-Faiz-Cloud-Engineer in honojs/hono#4982

refactor(timing): Test/add test for middleware timing by @iNeoO in honojs/hono#4991

fix(utils/ipaddr): render the unspecified address binary as "::" by @sarathfrancis90 in honojs/hono#4998

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

What's Changed

fix(serve-static): normalize all backslashes in file paths, not just the first in honojs/hono#4962

feat(context): export the Context class publicly by @BlankParticle in honojs/hono#4543

docs(contribution): add AI Usage Policy by @yusukebe in honojs/hono#4970

feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @na-trium-144 in honojs/hono#4961

fix(utils/ipaddr): do not compress a single 0 group to :: by @yusukebe in honojs/hono#4971

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

What's Changed

chore: update vitest to v4 and cleanups by @BlankParticle in honojs/hono#4952

fix(mime): specify charset parameter per MIME type instead of mechanical detection by @renatograsso10 in honojs/hono#4912

fix(compress): respect Accept-Encoding when encoding option is set by @LeSingh1 in honojs/hono#4951

fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @ATOM00blue in honojs/hono#4955

feat: add msgpack as a compressible content type by @na-trium-144 in honojs/hono#4957

New Contributors

@renatograsso10 made their first contribution in honojs/hono#4912

@LeSingh1 made their first contribution in honojs/hono#4951

@ATOM00blue made their first contribution in honojs/hono#4955

@na-trium-144 made their first contribution in honojs/hono#4957

Full Changelog: honojs/hono@v4.12.21...v4.12.22

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

... (truncated)

Commits

5fdde5a 4.12.24
c78932d fix(utils/ipaddr): render the unspecified address binary as "::" (#4998)
5ef800e refactor(timing): Test/add test for middleware timing (#4991)
d743bb7 fix: clean up config files trailing comma, stale excludes, typesVersions gaps...
d22ff9c fix(utils/ipaddr): expand "::" to eight zero groups (#4973)
8e2cccc refactor(language): Test/improve tests on languages middleware (#4980)
413d3cb fix(bearer-auth): mention verifyToken in missing-options error message (#4987)
2cbeadd chore: remove @types/glob (#4978)
9051d3e docs(contribution): simplifyAI Usage Policy (#4972)
83bfb3b 4.12.23
Additional commits viewable in compare view

Updates protobufjs from 7.5.6 to 7.6.2

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

Backport consistency and correctness fixes (#2294) (a92f72e)

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

Backport misc utility hardening (#2280) (8a45c13)

Treat fixed64 as unsigned in converters (#2266) (479dfdc)

protobufjs: v7.6.0

7.6.0 (2026-05-18)

Features

Support BigInt conversions (7.x) (#2258) (f769242)

protobufjs: v7.5.9

7.5.9 (2026-05-17)

Bug Fixes

Backport bundler-safe optional module lookups (#2254) (0853a62)

protobufjs: v7.5.8

7.5.8 (2026-05-12)

Bug Fixes

Backport parser hardening to 7.x (#2245) (54b593f)

protobufjs: v7.5.7

7.5.7 (2026-05-09)

Bug Fixes

Restore first-match namespace lookup (#2236) (cc7d595)

Changelog

Sourced from protobufjs's changelog.

7.6.2 (2026-05-30)

Bug Fixes

Backport consistency and correctness fixes (#2294) (a92f72e)

7.6.1 (2026-05-22)

Bug Fixes

Backport misc utility hardening (#2280) (8a45c13)

Treat fixed64 as unsigned in converters (#2266) (479dfdc)

7.6.0 (2026-05-18)

Features

Support BigInt conversions (7.x) (#2258) (f769242)

7.5.9 (2026-05-17)

Bug Fixes

Backport bundler-safe optional module lookups (#2254) (0853a62)

7.5.8 (2026-05-12)

Bug Fixes

Backport parser hardening to 7.x (#2245) (54b593f)

7.5.7 (2026-05-09)

Bug Fixes

Restore first-match namespace lookup (#2236) (cc7d595)

Commits

ec90ef9 chore: release protobufjs-v7.x (#2295)
a92f72e fix: Backport consistency and correctness fixes (#2294)
f0b50d2 chore: release protobufjs-v7.x (#2268)
8a45c13 fix: Backport misc utility hardening (#2280)
479dfdc fix: Treat fixed64 as unsigned in converters (#2266)
e30c334 chore: release protobufjs-v7.x (#2260)
f769242 feat: Support BigInt conversions (7.x) (#2258)
ab3862d chore: release protobufjs-v7.x (#2255)
0853a62 fix: Backport bundler-safe optional module lookups (#2254)
d7035f9 chore: release protobufjs-v7.x (#2248)
Additional commits viewable in compare view

Updates ws from 8.20.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});
The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

bca91ad [dist] 8.21.0
2b2abd4 [security] Limit retained message parts
78eabe2 [security] Add latest vulnerability to SECURITY.md
5d9b316 [dist] 8.20.1
c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
ce2a3d6 [ci] Test on node 26
58e45b8 [ci] Do not test on node 25
5f26c24 [ci] Run the lint step on node 24
See full diff in compare view

Updates vitest from 3.2.4 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in v...
Description has been truncated

Bumps the npm_and_yarn group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.1.8` | | [@mikro-orm/knex](https://github.com/mikro-orm/mikro-orm) | `6.6.13` | `6.6.14` | | [qs](https://github.com/ljharb/qs) | `6.14.2` | `6.15.2` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.2.0` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.5` | `1.2.0` | | [hono](https://github.com/honojs/hono) | `4.12.15` | `4.12.24` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.6` | `7.6.2` | | [ws](https://github.com/websockets/ws) | `8.20.0` | `8.21.0` | Updates `vitest` from 3.2.4 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest) Updates `@mikro-orm/knex` from 6.6.13 to 6.6.14 - [Release notes](https://github.com/mikro-orm/mikro-orm/releases) - [Changelog](https://github.com/mikro-orm/mikro-orm/blob/v6.6.14/CHANGELOG.md) - [Commits](mikro-orm/mikro-orm@v6.6.13...v6.6.14) Updates `qs` from 6.14.2 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.2...v6.15.2) Updates `ip-address` from 10.1.0 to 10.2.0 - [Commits](beaugunderson/ip-address@v10.1.0...v10.2.0) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `fast-xml-builder` from 1.1.5 to 1.2.0 - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-builder@v1.1.5...v1.2.0) Updates `hono` from 4.12.15 to 4.12.24 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.15...v4.12.24) Updates `protobufjs` from 7.5.6 to 7.6.2 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.2/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.6...protobufjs-v7.6.2) Updates `ws` from 8.20.0 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.0...8.21.0) Updates `vitest` from 3.2.4 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.8 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@mikro-orm/knex" dependency-version: 6.6.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.24 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.6.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.8 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 9, 2026

github-actions Bot assigned Varun-S10 Jun 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Bump the npm_and_yarn group across 1 directory with 9 updates#428

chore: Bump the npm_and_yarn group across 1 directory with 9 updates#428
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c1fbfd6ee6

dependabot Bot commented on behalf of github Jun 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jun 9, 2026

v4.1.8

🐞 Bug Fixes

View changes on GitHub

v4.1.7

🐞 Bug Fixes

View changes on GitHub

v4.1.6

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v4.1.5

🚀 Experimental Features

🐞 Bug Fixes

View changes on GitHub

v6.6.14

6.6.14 (2026-05-04)

Bug Fixes

6.6.14 (2026-05-04)

Bug Fixes

6.15.2

6.15.1

6.15.0

v3.1.2

⚠️ Security Release

What's Changed

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

v4.12.24

What's Changed

v4.12.23

What's Changed

v4.12.22

What's Changed

New Contributors

v4.12.21

Security fixes

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

IP Restriction bypasses static deny rules for non-canonical IPv6

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

protobufjs: v7.6.0

7.6.0 (2026-05-18)

Features

protobufjs: v7.5.9

7.5.9 (2026-05-17)

Bug Fixes

protobufjs: v7.5.8

7.5.8 (2026-05-12)

Bug Fixes

protobufjs: v7.5.7

7.5.7 (2026-05-09)

Bug Fixes

7.6.2 (2026-05-30)

Bug Fixes

7.6.1 (2026-05-22)

Bug Fixes

7.6.0 (2026-05-18)

Features

7.5.9 (2026-05-17)

Bug Fixes

7.5.8 (2026-05-12)

Bug Fixes

7.5.7 (2026-05-09)

Bug Fixes

8.21.0

Features

Bug fixes

8.20.1

v4.1.8

🐞 Bug Fixes

View changes on GitHub

v4.1.7