Skip to content

chore(deps)(deps): Bump the runtime-deps group with 13 updates - #275

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/runtime-deps-1c496f8b18
Open

chore(deps)(deps): Bump the runtime-deps group with 13 updates#275
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/runtime-deps-1c496f8b18

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the runtime-deps group with 13 updates:

Package From To
tsdown 0.22.12 0.22.14
@vercel/nft 1.10.2 1.11.0
@aws-sdk/client-s3 3.1087.0 3.1120.0
pg 8.22.0 8.23.0
tar 7.5.21 7.5.22
@prisma/management-api-sdk 1.60.0 1.70.0
jose 6.2.4 6.2.10
better-auth 1.6.24 1.7.2
nodemailer 9.0.3 9.0.6
hono 4.12.31 4.13.5
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
next 16.2.10 16.3.3

Updates tsdown from 0.22.12 to 0.22.14

Release notes

Sourced from tsdown's releases.

v0.22.14

   🚀 Features

  • Add CLI build concurrency option  -  by @​sxzz and Jeroen Zwartepoorte (8a14c)
    View changes on GitHub

v0.22.13

   🚀 Features

  • deps: Support neverBundle: true to externalize all dependencies  -  by @​sxzz (d30a7)

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • ff3bdbd chore: release v0.22.14
  • 8a14c35 feat: add CLI build concurrency option
  • 0525465 docs: add note about cjsDefault only applying to explicit entry modules
  • a3a3551 refactor: fix lint
  • 3dec506 refactor: use native Promise.withResolvers
  • e0266c1 docs: add tsdown users image
  • a733505 refactor: upgrade verkit, simplify version parse
  • e5fe2ca style: format
  • 3e1fc63 chore: release v0.22.13
  • a6c8734 chore: upgrade deps
  • Additional commits viewable in compare view

Updates @vercel/nft from 1.10.2 to 1.11.0

Release notes

Sourced from @​vercel/nft's releases.

1.11.0

1.11.0 (2026-08-18)

Features

  • resolve package import wildcard trailers (#604) (7d6e6e4)
Commits
  • 7d6e6e4 feat: resolve package import wildcard trailers (#604)
  • c997b4d chore: Updating vm2 package to latest version (#593)
  • 8cc0067 chore(deps): Bump the npm_and_yarn group across 1 directory with 3 updates (#...
  • 3528b76 chore: upgrade sharp to latest v0.35.3 (#594)
  • 282d1f3 chore(deps): Bump the npm_and_yarn group across 1 directory with 3 updates (#...
  • 4e32836 chore(ci): disable phantomjs-prebuilt postinstall that breaks CI installs (#597)
  • See full diff in compare view

Updates @aws-sdk/client-s3 from 3.1087.0 to 3.1120.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1120.0

3.1120.0(2026-08-27)

Documentation Changes
  • client-opensearch: Updating SDK and CLI documentation for AttachDataSource API. (d696fe76)
New Features
  • client-lambda-microvms: Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (72a8ff80)
  • client-codedeploy: Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (78d4f964)
  • client-cloudwatch-logs: Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (0e4d242b)
  • client-datazone: Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (3a74dc4b)
  • client-rds: Adding support for the full snapshot size, in bytes, of DB instance snapshots. (ab2f66f5)
  • client-ec2: EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (311b3b26)
  • client-cognito-identity-provider: Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (f661bebc)

For list of updated packages, view updated-packages.md in assets-3.1120.0.zip

v3.1119.0

3.1119.0(2026-08-26)

Chores
  • codegen: smithy-aws-typescript-codegen 0.53.0 (#8276) (dffb383b)
New Features
  • client-sagemaker: Amazon SageMaker AI now supports ml.g7 instances for model optimization. You can now run model optimization jobs on ml.g7 instances, in supported AWS Regions. (6d5e1066)
  • client-devops-agent: AWS DevOps Agent now supports trigger filter groups for Release Readiness Review, letting you control when the capability auto-triggers based on webhook events and target branches. (bc3d53d5)
  • client-license-manager-user-subscriptions: Released support for License Expiry field in ListProductSubscriptions API (454d7f7f)
  • client-ec2: Adds deleting state to possible VPC States. (43091d55)
  • client-network-firewall: Adding new status enum for Firewalls. (4cb21cb3)

For list of updated packages, view updated-packages.md in assets-3.1119.0.zip

v3.1118.0

3.1118.0(2026-08-25)

Documentation Changes
  • client-marketplace-metering: Updated documentation to clarify duplicate-billing prevention and BatchMeterUsage retry guidance (32231025)
New Features

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/client-s3

3.1119.0 (2026-08-26)

Note: Version bump only for package @​aws-sdk/client-s3

3.1118.0 (2026-08-25)

Note: Version bump only for package @​aws-sdk/client-s3

3.1117.0 (2026-08-24)

Note: Version bump only for package @​aws-sdk/client-s3

3.1116.0 (2026-08-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1115.0 (2026-08-20)

Note: Version bump only for package @​aws-sdk/client-s3

3.1114.0 (2026-08-19)

... (truncated)

Commits

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Commits

Updates tar from 7.5.21 to 7.5.22

Commits

Updates @prisma/management-api-sdk from 1.60.0 to 1.70.0

Commits

Updates jose from 6.2.4 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits
  • 3eab152 chore(release): 6.2.10
  • 021abf4 refactor(jws): specialize compact processing
  • a998927 refactor(jwe): specialize compact processing
  • eedb124 refactor(jose): share binary input validation
  • 52ba159 refactor(jwt): share producer claim state
  • 85e30ed refactor(jose): share compact token processing internals
  • 0bd81d2 test(jose): cover hidden critical-header options
  • 9cf7876 test(jose): reject callable object impostors
  • f23cafd test(jose): preserve resolved key data properties
  • 1ee6f61 refactor(jwe): consolidate CBC decryption failures
  • Additional commits viewable in compare view

Updates better-auth from 1.6.24 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

  • Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
  • Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
  • Added warnings for invalid signed session data in the cookie cache. (#10934)
  • Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
  • Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
  • Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
  • Improved getTestInstance performance with a faster default password hasher. (#10879)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

  • Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
  • Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
  • Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

  • Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
  • Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
  • Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

  • Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
  • Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

  • #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

  • #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

  • #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

  • #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

  • #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

  • #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

  • #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

  • #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

  • #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

  • #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

  • Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

    • @​better-auth/core@​1.7.2
    • @​better-auth/kysely-adapter@​1.7.2
    • @​better-auth/drizzle-adapter@​1.7.2
    • @​better-auth/memory-adapter@​1.7.2
    • @​better-auth/mongo-adapter@​1.7.2
    • @​better-auth/prisma-adapter@​1.7.2
    • @​better-auth/telemetry@​1.7.2

1.7.1

Patch Changes

  • #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

    getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

    auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

    A required field whose database column is still nullable logs a warning instead of blocking the migration.

    A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

  • Updated dependencies []:

    • @​better-auth/core@​1.7.1
    • @​better-auth/drizzle-adapter@​1.7.1

... (truncated)

Commits
  • ba12fcd chore: release v1.7.2 (#10870)
  • 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
  • c8dcfa5 fix(origin-check): validate null origins using fetch metadata (#10959)
  • e1d4011 fix(logger): respect configured logger in auth request context (#10939)
  • 557e19b refactor(context): clarify auth endpoint context access (#10938)
  • b4ad5a1 refactor: centralize placeholder email generation (#10982)
  • fced1a5 fix(origin-check): improve relative callback URL validation (#10979)
  • f6891a2 fix(origin-check): allow tilde in relative callback URLs (#10041)
  • ce8a3ab fix(admin): ban without a duration should clear the previous expiration (#10823)
  • a021eaf fix(client): a client with more plugins fits a narrower client type again (#1...
  • Additional commits viewable in compare view

Updates nodemailer from 9.0.3 to 9.0.6

Release notes

Sourced from nodemailer's releases.

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)

v9.0.5

9.0.5 (2026-08-07)

Bug Fixes

  • ci: retrigger the workflows dropped during the Actions outage (85d16c1)
  • mailer: escape specials in List-* header comments (#1842) (75913bb)
  • mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
  • mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
  • mime: encode DEL in header parameters and List-* comments (cf69430)
  • mime: keep control chars out of the remaining header positions (5ed9d26)
  • mime: normalize an address parsed out of a string as well (63685f7)
  • mime: normalize an address so header and envelope agree (a9343b4)
  • mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)
Changelog

Sourced from nodemailer's changelog.

9.0.6 (2026-08-27)

Bug Fixes

  • addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
  • harden copies of user supplied keys and URL fetching (2f667f4)

9.0.5 (2026-08-07)

Bug Fixes

  • ci: retrigger the workflows dropped during the Actions outage (85d16c1)
  • mailer: escape specials in List-* header comments (#1842) (75913bb)
  • mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
  • mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
  • mime: encode DEL in header parameters and List-* comments (cf69430)
  • mime: keep control chars out of the remaining header positions (5ed9d26)
  • mime: normalize an address parsed out of a string as well (63685f7)
  • mime: normalize an address so header and envelope agree (a9343b4)
  • mime: stop a header key callback and the dkim tags from injecting (b7d772e)

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)
Commits
  • 4e467a8 chore(master): release 9.0.6 (#1844)
  • e989a22 fix(addressparser): recover the addr-spec from an angle-addr holding whitespace
  • 7237b91 chore(deps): update dev dependencies
  • 34bc3d8 docs: reframe the EmailEngine README mentions
  • 2f667f4 fix: harden copies of user supplied keys and URL fetching
  • 742cff9 chore(master): release 9.0.5 (#1843)
  • 524f0af chore: apply prettier to the punycode decode loop
  • 63685f7 fix(mime): normalize an address parsed out of a string as well
  • d899213 test: cover the custom envelope path of every transport
  • c4daee0 chore(ci): trigger the workflows now that the Actions outage is over
  • Additional commits viewable in compare view

Updates hono from 4.12.31 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
  • fix(client): skip undefined header and cookie values in honojs/hono#5244
  • fix(client): skip an undefined entry inside a query array in honojs/hono#5272
  • fix(client): skip an undefined entry inside a form array in honojs/hono#5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
  • fix(client): omit empty query delimiter in honojs/hono#5283
  • fix(request): drop stale content length for cloned FormData in honojs/hono#5282
  • fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
  • fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
  • fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

@dependabot
chore(deps)(deps): Bump the runtime-deps group with 13 updates
b662110 
Bumps the runtime-deps group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [tsdown](https://github.com/rolldown/tsdown) | `0.22.12` | `0.22.14` |
| [@vercel/nft](https://github.com/vercel/nft) | `1.10.2` | `1.11.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1087.0` | `3.1120.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.21` | `7.5.22` |
| [@prisma/management-api-sdk](https://github.com/prisma/pdp-control-plane/tree/HEAD/packages/management-api-sdk) | `1.60.0` | `1.70.0` |
| [jose](https://github.com/panva/jose) | `6.2.4` | `6.2.10` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.24` | `1.7.2` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `9.0.3` | `9.0.6` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.5` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [next](https://github.com/vercel/next.js) | `16.2.10` | `16.3.3` |


Updates `tsdown` from 0.22.12 to 0.22.14
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.22.12...v0.22.14)

Updates `@vercel/nft` from 1.10.2 to 1.11.0
- [Release notes](https://github.com/vercel/nft/releases)
- [Commits](vercel/nft@1.10.2...1.11.0)

Updates `@aws-sdk/client-s3` from 3.1087.0 to 3.1120.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1120.0/clients/client-s3)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `tar` from 7.5.21 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.21...v7.5.22)

Updates `@prisma/management-api-sdk` from 1.60.0 to 1.70.0
- [Commits](https://github.com/prisma/pdp-control-plane/commits/HEAD/packages/management-api-sdk)

Updates `jose` from 6.2.4 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.4...v6.2.10)

Updates `better-auth` from 1.6.24 to 1.7.2
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.7.2/packages/better-auth)

Updates `nodemailer` from 9.0.3 to 9.0.6
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v9.0.3...v9.0.6)

Updates `hono` from 4.12.31 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.31...v4.13.5)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `next` from 16.2.10 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.10...v16.3.3)

---
updated-dependencies:
- dependency-name: tsdown
  dependency-version: 0.22.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: "@vercel/nft"
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1120.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: "@prisma/management-api-sdk"
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: better-auth
  dependency-version: 1.7.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: nodemailer
  dependency-version: 9.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-deps
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@pkg-pr-new

pkg-pr-new Bot commented Sep 7, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@prisma/composer@275

npm i https://pkg.pr.new/@prisma/composer-cli@275

npm i https://pkg.pr.new/@prisma/composer-prisma-cloud@275

commit: b662110

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants