Skip to content

fix(deps): update minor updates (minor) - #1093

Merged
prisis merged 1 commit into
mainfrom
renovate/minor-updates
Aug 10, 2026
Merged

fix(deps): update minor updates (minor)#1093
prisis merged 1 commit into
mainfrom
renovate/minor-updates

Conversation

@renovate

@renovate renovate Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@actions/http-client>undici (source) 8.7.0 → 8.10.0 age confidence
@anolilab/eslint-config (source) 28.0.2 → 28.1.2 age confidence
@e18e/eslint-plugin 0.5.1 → 0.8.0 age confidence
@eslint-react/eslint-plugin (source) 5.17.3 → 5.18.3 age confidence
@eslint/config-inspector 3.1.1 → 3.2.0 age confidence
@hono/node-server@<2.0.5 >=2.0.12 → >=2.1.0 age confidence
@textlint/ast-node-types 15.7.1 → 15.8.0 age confidence
@textlint/types (source) 15.7.1 → 15.8.0 age confidence
axios@<1.18.0 (source) >=1.18.1 → >=1.19.0 age confidence
axios@>=1.0.0 <=1.13.4 (source) [>=1.18.1 → >=1.19.0](https://renovatebot.com/diffs/npm/axios@>=1.0.0 <=1.13.4/1.18.1/1.19.0) age confidence
globals 17.7.0 → 17.9.0 age confidence
hono@<4.12.27 (source) >=4.12.34 → >=4.13.1 age confidence
ip-address@<=10.1.0 >=10.2.2 → >=10.4.0 age confidence
jsonc-eslint-parser 3.1.0 → 3.2.0 age confidence
lint-staged 17.1.1 → 17.3.0 age confidence
oxfmt (source) 0.59.0 → 0.62.0 age confidence
pnpm (source) 11.15.1 → 11.20.0 age confidence
undici@<6.23.0 (source) >=6.27.0 → >=6.28.0 age confidence
undici@<6.24.0 (source) >=6.27.0 → >=6.28.0 age confidence
undici@>=7.0.0 <7.28.0 (source) [7.28.0 → 7.29.0](https://renovatebot.com/diffs/npm/undici@>=7.0.0 <7.28.0/7.28.0/7.29.0) age confidence
undici@>=8.0.0 <8.5.0 (source) [8.7.0 → 8.10.0](https://renovatebot.com/diffs/npm/undici@>=8.0.0 <8.5.0/8.7.0/8.10.0) age confidence

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

nodejs/undici (@​actions/http-client>undici)

v8.10.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

v8.9.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.7.0...v8.8.0

anolilab/javascript-style-guide (@​anolilab/eslint-config)

v28.1.2

Compare Source

v28.1.1

Compare Source

v28.1.0

Compare Source

e18e/eslint-plugin (@​e18e/eslint-plugin)

v0.8.0

Compare Source

What's Changed

  • fix(prefer-array-to-sorted): handle null Oxlint annotations by @​webpro in #​144
  • test: map oxlint fixtures to rule configs by @​webpro in #​145
  • chore(deps): bump module-replacements from 3.0.0 to 3.1.0 in the production-dependencies group by @​dependabot[bot] in #​147
  • chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group by @​dependabot[bot] in #​146
  • fix(prefer-array-at): guard against more assignment cases where .at(-1) would be illegal by @​TkDodo in #​149
  • fix: handle parenthesised targets in some rules by @​43081j in #​150

New Contributors

Full Changelog: e18e/eslint-plugin@0.6.0...0.8.0

v0.6.0

Compare Source

What's Changed

  • chore(deps-dev): bump the development-dependencies group with 7 updates by @​dependabot[bot] in #​126
  • chore(deps): bump semver from 7.8.2 to 7.8.4 in the production-dependencies group by @​dependabot[bot] in #​125
  • chore(deps-dev): bump the development-dependencies group with 7 updates by @​dependabot[bot] in #​130
  • chore(deps): bump semver from 7.8.4 to 7.8.5 in the production-dependencies group by @​dependabot[bot] in #​129
  • chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @​dependabot[bot] in #​128
  • fix(prefer-array-to-sorted): skip non-array iterable spreads by @​webpro in #​134
  • feat(prefer-charcode-at-in-loop): add rule by @​webpro in #​138
  • feat(prefer-slice-over-split-index): add rule by @​webpro in #​137
  • chore(deps-dev): bump the development-dependencies group with 7 updates by @​dependabot[bot] in #​140
  • feat(prefer-throw-if-no-entry): add rule by @​webpro in #​139
  • fix(prefer-flatmap-over-map-flat): drop blank fixer line by @​webpro in #​136
  • fix(prefer-spread-syntax): skip non-array concat receivers by @​webpro in #​135
  • chore(deps-dev): bump the development-dependencies group with 8 updates by @​dependabot[bot] in #​142
  • chore(deps): bump module-replacements from 3.0.0-beta.8 to 3.0.0 in the production-dependencies group by @​dependabot[bot] in #​141
  • chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-actions group by @​dependabot[bot] in #​143

Full Changelog: e18e/eslint-plugin@0.5.1...0.6.0

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.18.3

Compare Source

🐞 Fixes
  • react-x/no-nested-component-definitions: narrowed the with* HOC detection in the fallback name resolution to well-known wrappers only (react-router v5's withRouter, Formik's withFormik, and recompose's withProps, withState, withHandlers, and withLifecycle) — custom HOCs following the with* naming convention are no longer treated as component wrappers. (#​1929)
🏗️ Internal
  • Bumped typescript-eslint to 8.66.0 and next to 16.3.0.

Full Changelog: Rel1cx/eslint-react@v5.18.2...v5.18.3

v5.18.2

Compare Source

🐞 Fixes
  • react-x/no-nested-component-definitions: fixed a regression where nested components wrapped in useCallback (e.g. const C = useCallback(() => <div />, []);) were no longer reported — the rule now resolves the component name through well-known component wrappers (memo, forwardRef, useCallback, observer, react-redux's connect, Relay's create*Container helpers, Apollo's graphql, and with* HOCs, including curried forms like connect(...)(Component)) up to the enclosing variable declarator, and no longer misreports array method callbacks (flatMap, forEach, reduce, etc.) in list rendering patterns. (#​1928, closes #​1927)
🏗️ Internal
  • Bumped effect to 3.22.1, eslint-plugin-jsdoc to 63.3.3, textlint to 15.8.0, js-yaml to 4.3.1, axios to 1.19.0, nx to 23.1.1, vite to 8.2.0, @vitejs/plugin-react to 6.0.5, fumadocs to 16.14.0, fumadocs-mdx to 15.2.2, preact to 10.29.8, globals to 17.9.0, lucide-react to 1.28.0, @types/react to 19.2.18, @types/react-dom to 19.2.4, and pnpm to 11.20.0.

Full Changelog: Rel1cx/eslint-react@v5.18.1...v5.18.2

v5.18.1

Compare Source

📝 Documentation
  • Documented the additionalRefHooks shared setting in the affected rule docs.
🏗️ Internal
  • @eslint-react/ast: added Traverse.findEnclosingTryBlock, extracted from react-x/error-boundaries.
  • Replaced @eslint/compat with @eslint/config-helpers.
  • Bumped eslint to 10.8.0, eslint-plugin-jsdoc to 63.3.2, tsdown to 0.22.14, next to 16.2.12, fumadocs to 16.13.0, postcss to 8.5.25, and pnpm to 11.18.0.

Full Changelog: Rel1cx/eslint-react@v5.18.0...v5.18.1

v5.18.0

Compare Source

✨ New
  • @eslint-react/core: added isUseRefLikeCall and a new additionalRefHooks setting for declaring custom ref-creating hooks; the following rules now recognize them: (#​1922, closes #​1904)
    • react-x/refs
    • react-x/immutability
    • react-x/set-state-in-effect
    • react-naming-convention/ref-name
    • react-debug/is-from-ref
📝 Documentation
  • Updated rule docs to match current rule sources. (#​1920)
🏗️ Internal
  • @local/testkit: simplified internals.
  • react-x: extracted a shared createImplicitPropListener helper used by no-implicit-children, no-implicit-key, and no-implicit-ref. (#​1923)
  • Bumped tsdown to 0.22.13, typescript-eslint to 8.65.0, eslint-plugin-jsdoc to 63.2.0, import-integrity-lint to 1.2.0, react to 19.2.8, next to 16.2.11, and postcss to 8.5.21.
  • Replaced vite-node with nub for running workspace scripts. (#​1919)
  • Unified JSDoc comment style of exported APIs in @eslint-react/ast and @eslint-react/core.

Full Changelog: Rel1cx/eslint-react@v5.17.3...v5.18.0

eslint/config-inspector (@​eslint/config-inspector)

v3.2.0

Compare Source

Features
honojs/node-server (@​hono/node-server@<2.0.5)

v2.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

textlint/textlint (@​textlint/ast-node-types)

v15.8.0

Compare Source

What's Changed

Feature
Documentation
Refactoring
CI
Dependency Updates

New Contributors

Full Changelog: textlint/textlint@v15.7.1...v15.8.0

axios/axios (axios@<1.18.0)

v1.19.0

Compare Source

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

sindresorhus/globals (globals)

v17.9.0

Compare Source

v17.8.0

Compare Source

honojs/hono (hono@<4.12.27)

v4.13.1

Compare Source

v4.13.0

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
ping — GET / 165.83 ns 163.99 ns 1.01x
query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
json — GET /user 528.99 ns 422.44 ns 1.25x
body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

  • perf(context): iterate the header record with for..in #​5118
  • perf(url): replace regex tests with indexOf #​5121
  • perf(context): skip Headers creation when there are no headers to merge #​5122
  • perf(urls): refactor tryDecodeURIComponent #​5158
  • perf(request): allocate #validatedData lazily #​5175
  • perf(request): probe the body cache without allocating #​5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @​usualoma and @​Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @​usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @​usualoma!

Other improvements

  • hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @​akahoshi1421!
  • The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @​arhxam!
  • JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @​ashunar0!
  • JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @​natsuki-engr!
  • The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @​arhxam!

All changes

Full Changelog: honojs/hono@v4.12.34...v4.13.0

Thank you to all contributors!

beaugunderson/ip-address (ip-address@<=10.1.0)

v10.4.0

Compare Source

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the c: dependencies Pull requests that adds/updates a dependency label Aug 10, 2026
@renovate
renovate Bot requested a review from prisis as a code owner August 10, 2026 10:46
@renovate renovate Bot added the c: dependencies Pull requests that adds/updates a dependency label Aug 10, 2026
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Thank you for following the naming conventions! 🙏

@renovate
fix(deps): update minor updates
dd31756 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
@renovate
renovate Bot force-pushed the renovate/minor-updates branch from 39f0b89 to dd31756 Compare August 10, 2026 10:52
@socket-security

socket-security Bot commented Aug 10, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​e18e/​eslint-plugin@​0.8.07710010093100
Addedglobals@​17.9.01001008696100
Addedoxfmt@​0.62.0861008896100
Addedjsonc-eslint-parser@​3.2.010010010090100
Added@​eslint/​config-inspector@​3.2.09910010095100
Added@​eslint-react/​eslint-plugin@​5.18.39910010096100
Addedlint-staged@​17.3.010010010097100

View full report

@prisis
prisis merged commit b7cddb1 into main Aug 10, 2026
22 of 23 checks passed
@prisis
prisis deleted the renovate/minor-updates branch August 10, 2026 11:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@prisis prisis Awaiting requested review from prisis prisis is a code owner

Assignees

No one assigned

Labels

c: dependencies Pull requests that adds/updates a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@prisis