Skip to content

chore(deps): bump the dependencies group across 1 directory with 19 updates - #5764

Merged
bjohansebas merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a4ec5073ba
Oct 17, 2026
Merged

chore(deps): bump the dependencies group across 1 directory with 19 updates#5764
bjohansebas merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a4ec5073ba

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 19 updates in the / directory:

Package From To
@types/ws 8.18.1 8.18.2
express 5.2.1 5.3.0
launch-editor 2.14.1 2.14.2
@babel/core 8.0.6 8.0.7
@babel/preset-env 8.0.6 8.0.7
@hono/node-server 2.1.1 2.1.5
@types/node 26.6.3 26.6.5
acorn 8.18.0 8.19.0
cspell 10.3.5 10.4.0
eslint-config-webpack 4.14.0 4.15.0
execa 10.0.1 10.1.1
hono 4.13.10 4.13.13
jsdom 30.1.1 30.1.2
marked 18.0.14 18.1.1
memfs 4.79.0 4.80.0
prettier 3.9.9 3.9.10
puppeteer 25.12.0 25.13.0
readable-stream 4.7.0 4.8.0
supertest 7.3.0 7.3.1

Updates @types/ws from 8.18.1 to 8.18.2

Commits

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates launch-editor from 2.14.1 to 2.14.2

Commits
  • b533489 v2.14.2
  • f13cd83 fix: check file existence after path resolution (#157)
  • f6e6701 fix: ensure filenames passed to editors are not considered as flags (#156)
  • 3c2f9bf fix: reject paths containing % on windows (#155)
  • ecdfce1 refactor: extract constructWindowsLaunchCommand (#154)
  • 24d5d84 fix: correctly show error when the third parameter is not passed (#153)
  • 7bae9bc refactor: merge statements
  • 571fe00 chore(deps): update actions/setup-node action to v7 (#149)
  • d8ed423 chore(deps): update actions/checkout action to v7 (#148)
  • 75b3e6c fix(deps): update all non-major dependencies (#146)
  • Additional commits viewable in compare view

Updates @babel/core from 8.0.6 to 8.0.7

Release notes

Sourced from @​babel/core's releases.

v8.0.7 (2026-10-07)

Thanks @​brunoborta, @​CINC0S, @​hoobnn, and @​jpradelle for your first PRs!

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3

Committers: 11

Changelog

Sourced from @​babel/core's changelog.

v8.0.7 (2026-10-07)

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
Commits

Updates @babel/preset-env from 8.0.6 to 8.0.7

Release notes

Sourced from @​babel/preset-env's releases.

v8.0.7 (2026-10-07)

Thanks @​brunoborta, @​CINC0S, @​hoobnn, and @​jpradelle for your first PRs!

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3

Committers: 11

Changelog

Sourced from @​babel/preset-env's changelog.

v8.0.7 (2026-10-07)

🐛 Bug Fix

  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
    • #18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
    • #18265 Return false for #x in on static private fields before initialization (@​hoobnn)
  • babel-traverse
    • #18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
    • #18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
  • Other
  • babel-core

🏠 Internal

  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
Commits

Updates @hono/node-server from 2.1.1 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • d57ed9b 2.1.4
  • 92b014c chore: allow hono v5 as a peer dependency (#406)
  • 720ac78 2.1.3
  • 9821792 Merge commit from fork
  • 35bca95 2.1.2
  • 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
  • fe7467c test(request): accept asynchronous body read errors (#403)
  • Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.5

Commits

Updates acorn from 8.18.0 to 8.19.0

Commits
  • 0e0ece7 Mark version 8.19.0
  • c912cf2 Disallow additional subscripts before arrow in async arrow functions
  • f180fd7 Add Unicode v18 support (#1458)
  • ab47d42 Update test case for unexpected identifier character (#1456)
  • f53ee5f Add a contributing.md file
  • 5bd50cd Compare expression end instead of identity in parseSubscripts
  • efd7a21 Delete trailing space
  • e79ec9e Adjust dubious handling of doubleProto tracking in parseMaybeAssign
  • 93e8b90 Upgrade some dependencies with known issues
  • f065b20 Upgrade github actions to get rid of warning
  • Additional commits viewable in compare view

Updates cspell from 10.3.5 to 10.4.0

Release notes

Sourced from cspell's releases.

v10.4.0

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"
  • --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
  • CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
  • API: globSymlinks in the lint options.
  • It can't be set in a configuration file.
  • Files are reported by the path through the link. A file reached by two paths is checked under both.
  • It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.
  • The design decisions are recorded in docs/ADRs/glob-symlinks/.
  • Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

Set COLUMNS to pick the output width:

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.4.0 (2026-10-14)

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"
  • --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
  • CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
  • API: globSymlinks in the lint options.
  • It can't be set in a configuration file.
  • Files are reported by the path through the link. A file reached by two paths is checked under both.
  • It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.
  • The design decisions are recorded in docs/ADRs/glob-symlinks/.
  • Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

... (truncated)

Commits
  • 7e2bbb5 v10.4.0
  • d2dce3f chore: Prepare Release v10.4.0 (auto-deploy) (#9380)
  • a1509fe chore: Fix the README build after the inject-markdown 6 upgrade (#9429)
  • ab3ae04 fix: Workflow Bot -- Update Dictionaries (main) (#9405)
  • 55c0fbd fix: Show hidden lint options and issue template help in cspell --help (#9387)
  • 628768a v10.4.0-alpha.1
  • 998957b chore: Prepare Release v10.4.0-alpha.1 (auto-deploy) (#9378)
  • 4c287f5 fix: Deprecate cspell-lib/rpc; import from @cspell/rpc (#9376)
  • 7be53ce chore: Prepare Release v10.4.0-alpha.0 (auto-deploy) (#9332)
  • e3b5887 chore: Update README.md (#9368)
  • Additional commits viewable in compare view

Updates eslint-config-webpack from 4.14.0 to 4.15.0

Release notes

Sourced from eslint-config-webpack's releases.

v4.15.0

Minor Changes

  • Move prettier/prettier out of the recommended configs into the opt-in stylistic/prettier config; run Prettier on its own instead. (by @​alexander-akait in #212)

Patch Changes

  • Turn off jsdoc rules that TypeScript already reports: require-param-type, require-param-name, require-property-name and implements-on-classes. (by @​alexander-akait in #211)

  • Turn off jsdoc/require-next-type, jsdoc/require-throws-type and jsdoc/require-yields-type. (by @​alexander-akait in #210)

  • Check jsdoc/no-restricted-syntax with one combined selector, so it lints faster. (by @​alexander-akait in #208)

Changelog

Sourced from eslint-config-webpack's changelog.

4.15.0

Minor Changes

  • Move prettier/prettier out of the recommended configs into the opt-in stylistic/prettier config; run Prettier on its own instead. (by @​alexander-akait in #212)

Patch Changes

  • Turn off jsdoc rules that TypeScript already reports: require-param-type, require-param-name, require-property-name and implements-on-classes. (by @​alexander-akait in #211)

  • Turn off jsdoc/require-next-type, jsdoc/require-throws-type and jsdoc/require-yields-type. (by @​alexander-akait in #210)

  • Check jsdoc/no-restricted-syntax with one combined selector, so it lints faster. (by @​alexander-akait in #208)

Commits
  • a67ea3a chore(release): new release (#209)
  • 8e7805c feat(stylistic): move prettier/prettier into an opt-in stylistic/prettier con...
  • 8464b5f perf(jsdoc): turn off require-param-type and explain the disabled type rules ...
  • a7db55d fix(jsdoc): turn off require-next-type, require-throws-type and require-yield...
  • dff9d5e perf(jsdoc): check no-restricted-syntax with one combined selector (#208)
  • 16a18a9 chore(deps): bump codecov/codecov-action in the dependencies group (#206)
  • 397f027 chore(deps): bump the dependencies group across 1 directory with 2 updates (#...
  • See full diff in compare view

Updates execa from 10.0.1 to 10.1.1

Release notes

Sourced from execa's releases.

v10.1.1

  • Fix execaNode() and the node option missing IPC in their types 2633abb
  • Fix escapedCommand and verbose quoting arguments when using the shell option b2c3a54
  • Fix wrong-typed options and arguments being silently ignored or coerced b57d643
  • Fix the verbose option printing colors when stderr is not a terminal a2eda67
  • Fix stdin iterables and input transforms edge cases 6925cc3
  • Fix IPC edge cases 5f80cde
  • Fix .pipe() and stream conversion edge cases d3ec10d
  • Fix template strings, parseCommandString() and execaNode() edge cases fb92da1
  • Fix invalid timeout and forceKillAfterDelay values d9a5689
  • Fix errors, early errors and result.all edge cases c4262ff

sindresorhus/execa@v10.1.0...v10.1.1

v10.1.0

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

  • extendEnv: false without the env option no longer inherits process.env, per docs 67acf60
  • Windows: Arguments of .cmd and .bat files are now escaped like Rust does, which fixes batch files reading %~1 (#1261) 93bddc4
  • Invalid stdio values, such as negative file descriptors, now throw c6bd387
  • Using the same file as input and output now throws, even when the paths are written differently 587045a
  • Synchronous methods now enforce per-file-descriptor maxBuffer values 9547e51
  • Synchronous methods now throw on the signal option, like asynchronous methods 59de065
  • Synchronous methods now write the raw output bytes to files, like asynchronous methods af6264a

Fixes

  • Fix subprocess.kill() signaling the current process group when the subprocess failed to spawn 5464d43
  • Fix crashes when spawning fails with EMFILE/ENFILE (#1262), or when a file targ...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@changeset-bot

changeset-bot Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 9127cf4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedlaunch-editor@​2.14.1 ⏵ 2.14.299 +110070 +190100
Updated@​types/​ws@​8.18.1 ⏵ 8.18.2100 +110073 +185100
Updated@​babel/​preset-env@​8.0.6 ⏵ 8.0.7961007595 -1100
Updated@​babel/​core@​8.0.6 ⏵ 8.0.799 +110079 +195 +1100
Updatedmarked@​18.0.14 ⏵ 18.1.1100 +1100100 +19880
Updated@​types/​node@​26.6.3 ⏵ 26.6.510010081 +195 -1100
Updatedreadable-stream@​4.7.0 ⏵ 4.8.09910010088100
Updatedacorn@​8.18.0 ⏵ 8.19.0100 +1100100 +189100
Updatedexeca@​10.0.1 ⏵ 10.1.198100100 +192 +3100
Updatedpuppeteer@​25.12.0 ⏵ 25.13.0921009397 +2100
Updatedmemfs@​4.79.0 ⏵ 4.80.0991009395100
Updatedexpress@​5.2.1 ⏵ 5.3.097 +110010094 +2100
Updatedsupertest@​7.3.0 ⏵ 7.3.199 +1100100 +194 +4100
Updatedeslint-config-webpack@​4.14.0 ⏵ 4.15.095 +410010099 +1100
Updatedhono@​4.13.10 ⏵ 4.13.13100 +110097 +195 -1100
Updated@​hono/​node-server@​2.1.1 ⏵ 2.1.5100 +110010095100
Updatedcspell@​10.3.5 ⏵ 10.4.098 +110010096 +1100
Updatedprettier@​3.9.9 ⏵ 3.9.10981009798 -1100
Updatedjsdom@​30.1.1 ⏵ 30.1.29810010098 +3100

View full report

@dependabot
chore(deps): bump the dependencies group across 1 directory with 19 u…
9127cf4 
…pdates

Bumps the dependencies group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [launch-editor](https://github.com/vitejs/launch-editor) | `2.14.1` | `2.14.2` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `8.0.6` | `8.0.7` |
| [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) | `8.0.6` | `8.0.7` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.1` | `2.1.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.3` | `26.6.5` |
| [acorn](https://github.com/acornjs/acorn) | `8.18.0` | `8.19.0` |
| [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.3.5` | `10.4.0` |
| [eslint-config-webpack](https://github.com/webpack/eslint-config-webpack) | `4.14.0` | `4.15.0` |
| [execa](https://github.com/sindresorhus/execa) | `10.0.1` | `10.1.1` |
| [hono](https://github.com/honojs/hono) | `4.13.10` | `4.13.13` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.1` | `30.1.2` |
| [marked](https://github.com/markedjs/marked) | `18.0.14` | `18.1.1` |
| [memfs](https://github.com/streamich/memfs) | `4.79.0` | `4.80.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `25.12.0` | `25.13.0` |
| [readable-stream](https://github.com/nodejs/readable-stream) | `4.7.0` | `4.8.0` |
| [supertest](https://github.com/ladjs/supertest) | `7.3.0` | `7.3.1` |



Updates `@types/ws` from 8.18.1 to 8.18.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `launch-editor` from 2.14.1 to 2.14.2
- [Commits](vitejs/launch-editor@v2.14.1...v2.14.2)

Updates `@babel/core` from 8.0.6 to 8.0.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.7/packages/babel-core)

Updates `@babel/preset-env` from 8.0.6 to 8.0.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.7/packages/babel-preset-env)

Updates `@hono/node-server` from 2.1.1 to 2.1.5
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.5)

Updates `@types/node` from 26.6.3 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `acorn` from 8.18.0 to 8.19.0
- [Commits](acornjs/acorn@8.18.0...8.19.0)

Updates `cspell` from 10.3.5 to 10.4.0
- [Release notes](https://github.com/streetsidesoftware/cspell/releases)
- [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md)
- [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.4.0/packages/cspell)

Updates `eslint-config-webpack` from 4.14.0 to 4.15.0
- [Release notes](https://github.com/webpack/eslint-config-webpack/releases)
- [Changelog](https://github.com/webpack/eslint-config-webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/eslint-config-webpack@v4.14.0...v4.15.0)

Updates `execa` from 10.0.1 to 10.1.1
- [Release notes](https://github.com/sindresorhus/execa/releases)
- [Commits](sindresorhus/execa@v10.0.1...v10.1.1)

Updates `hono` from 4.13.10 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.10...v4.13.13)

Updates `jsdom` from 30.1.1 to 30.1.2
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.1...v30.1.2)

Updates `marked` from 18.0.14 to 18.1.1
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.14...v18.1.1)

Updates `memfs` from 4.79.0 to 4.80.0
- [Release notes](https://github.com/streamich/memfs/releases)
- [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md)
- [Commits](streamich/memfs@v4.79.0...v4.80.0)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

Updates `puppeteer` from 25.12.0 to 25.13.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v25.12.0...puppeteer-v25.13.0)

Updates `readable-stream` from 4.7.0 to 4.8.0
- [Release notes](https://github.com/nodejs/readable-stream/releases)
- [Commits](nodejs/readable-stream@v4.7.0...v4.8.0)

Updates `supertest` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/ladjs/supertest/releases)
- [Commits](forwardemail/supertest@v7.3.0...v7.3.1)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 8.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@babel/preset-env"
  dependency-version: 8.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/ws"
  dependency-version: 8.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: acorn
  dependency-version: 8.19.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: cspell
  dependency-version: 10.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: eslint-config-webpack
  dependency-version: 4.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: execa
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: jsdom
  dependency-version: 30.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: launch-editor
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: marked
  dependency-version: 18.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: memfs
  dependency-version: 4.80.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: puppeteer
  dependency-version: 25.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: readable-stream
  dependency-version: 4.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: supertest
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-a4ec5073ba branch from 68dc1b6 to 9127cf4 Compare October 17, 2026 14:13
@bjohansebas
bjohansebas merged commit be1ca90 into main Oct 17, 2026
15 checks passed
@bjohansebas
bjohansebas deleted the dependabot/npm_and_yarn/dependencies-a4ec5073ba branch October 17, 2026 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bjohansebas