Skip to content

chore(deps): bump the npm_and_yarn group across 9 directories with 13 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/packages/web/npm_and_yarn-b025b40b85
Open

chore(deps): bump the npm_and_yarn group across 9 directories with 13 updates#1
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/packages/web/npm_and_yarn-b025b40b85

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 2 updates in the /packages/web directory: @astrojs/cloudflare and astro.
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: dompurify.
Bumps the npm_and_yarn group with 1 update in the /packages/sdk/js directory: @hey-api/openapi-ts.
Bumps the npm_and_yarn group with 4 updates in the /packages/opencode directory: @ai-sdk/provider-utils, @hono/node-server, minimatch and @babel/core.
Bumps the npm_and_yarn group with 1 update in the /packages/enterprise directory: nitro.
Bumps the npm_and_yarn group with 1 update in the /packages/desktop-electron directory: electron.
Bumps the npm_and_yarn group with 1 update in the /packages/console/core directory: mysql2.
Bumps the npm_and_yarn group with 2 updates in the /packages/console/app directory: nitro and wrangler.
Bumps the npm_and_yarn group with 13 updates in the / directory:

Package From To
@astrojs/cloudflare 12.6.3 13.1.10
astro 5.7.13 7.2.8
dompurify 3.3.1 3.4.13
@hey-api/openapi-ts 0.90.10 0.97.3
@ai-sdk/provider-utils 4.0.23 4.0.33
@hono/node-server 1.19.11 1.19.15
minimatch 10.0.3 10.2.3
@babel/core 7.28.4 7.29.6
nitro 3.0.1-alpha.1 3.0.1-alpha.2
electron 40.4.1 41.10.3
mysql2 3.14.4 3.23.1
wrangler 4.50.0 4.59.1
turbo 2.8.13 2.9.14

Updates @astrojs/cloudflare from 12.6.3 to 13.1.10

Changelog

Sourced from @​astrojs/cloudflare's changelog.

13.1.10

Patch Changes

  • #16320 a43eb4b Thanks @​matthewp! - Uses redirect: 'manual' for remote image fetches in the Cloudflare binding image transform, consistent with all other image fetch paths

  • #16307 a81dd3e Thanks @​matthewp! - Surfaces console.log and console.warn output from workerd during prerendering

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

13.1.9

Patch Changes

  • #16210 e030bd0 Thanks @​matthewp! - Fixes .svelte files in node_modules failing with Unknown file extension ".svelte" when using the Cloudflare adapter with prerenderEnvironment: 'node'

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

13.1.8

Patch Changes

  • #16225 756e7be Thanks @​travisbreaks! - Fixes ERR_MULTIPLE_CONSUMERS error when using Cloudflare Queues with prerendered pages. The prerender worker config callback now excludes queues.consumers from the entry worker config, since the prerender worker only renders static HTML and should not register as a queue consumer. Queue producers (bindings) are preserved.

  • #16192 79d86b8 Thanks @​alexanderniebuhr! - Removes an unused function re-export from the /info package path

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

13.1.7

Patch Changes

  • Updated dependencies [814406d]:
    • @​astrojs/underscore-redirects@​1.0.3

13.1.6

Patch Changes

  • #16151 4978165 Thanks @​matthewp! - Fixes a dev-mode crash loop in the Cloudflare adapter when using Starlight by excluding @astrojs/starlight from SSR dependency optimization

13.1.5

Patch Changes

  • #16109 c887b4a Thanks @​matthewp! - Fix HMR crash when editing content collection files caused by Vite's SSR transform colliding with zod v4's meta export

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​astrojs/cloudflare since your current version.


Updates astro from 5.7.13 to 7.2.8

Release notes

Sourced from astro's releases.

[email protected]

Patch Changes

[email protected]

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

[email protected]

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

[email protected]

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

... (truncated)

Changelog

Sourced from astro's changelog.

5.17.1

Patch Changes

  • #15334 d715f1f Thanks @​florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API only

    Removes the getFontBuffer() helper function exported from astro:assets when using the experimental Fonts API

    This experimental feature introduced in v15.6.13 ended up causing significant memory usage during build. This feature has been removed and will be reintroduced after further exploration and testing.

    If you were relying on this function, you can replicate the previous behavior manually:

    • On prerendered routes, read the file using node:fs
    • On server rendered routes, fetch files using URLs from fontData and context.url

5.17.0

Minor Changes

  • #14932 b19d816 Thanks @​patrickarlt! - Adds support for returning a Promise from the parser() option of the file() loader

    This enables you to run asynchronous code such as fetching remote data or using async parsers when loading files with the Content Layer API.

    For example:

    import { defineCollection } from 'astro:content';
import { file } from 'astro/loaders';
const blog = defineCollection({
loader: file('src/data/blog.json', {
parser: async (text) => {
const data = JSON.parse(text);
  // Perform async operations like fetching additional data
  const enrichedData = await fetch(`https://api.example.com/enrich`, {
    method: 'POST',
    body: JSON.stringify(data),
  }).then((res) =&gt; res.json());
return enrichedData;
},

}),
});
export const collections = { blog };

    See the parser() reference documentation for more information.

  • #15171 f220726 Thanks @​mark-ignacio! - Adds a new, optional kernel configuration option to select a resize algorithm in the Sharp image service

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.


Updates dompurify from 3.3.1 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

  • Cleaned up the repository root, renamed some and removed unneeded files
  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
  • Bumped several dependencies where possible

DOMPurify 3.4.7

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @hey-api/openapi-ts from 0.90.10 to 0.97.3

Release notes

Sourced from @​hey-api/openapi-ts's releases.

@​hey-api/openapi-ts@​0.95.0

Minor Changes

Validator request schemas

Valibot plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "valibot",
    },
    {
      name: "valibot",
      requests: {
        shouldExtract: true,
      },
    },
  ],
};

Removed plugin.getSymbol() function

This function has been removed. You can use plugin.querySymbol() instead. It accepts the same arguments and returns the same result.

Validator request schemas

Zod plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "zod",
</tr></table>

... (truncated)

Changelog

Sourced from @​hey-api/openapi-ts's changelog.

0.97.3

Patch Changes

Updated Dependencies:

  • @​hey-api/shared@​0.4.5
  • @​hey-api/codegen-core@​0.8.2

0.97.2

Patch Changes

... (truncated)

Commits

Updates @ai-sdk/provider-utils from 4.0.23 to 4.0.33

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

4.0.33

Patch Changes

  • b30e43a: Limit JSON response body reads in response handlers to prevent unbounded memory use.

4.0.32

Patch Changes

  • Updated dependencies [f19334d]
    • @​ai-sdk/provider@​3.0.12

4.0.31

Patch Changes

  • 1b40ac7: Publish all packages under the @ai-v6 dist tag.
  • Updated dependencies [1b40ac7]
    • @​ai-sdk/provider@​3.0.11

4.0.30

Patch Changes

  • 779f5cd: fix(provider-utils): cancel response body on download rejection to prevent socket leak

    When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.

4.0.29

Patch Changes

  • bfa5864: fix: only send provider credentials to same-origin response-supplied URLs

    Several provider clients followed a URL taken from the provider's API response (a polling/status URL or a final media URL such as polling_url, urls.get, result_url, result.sample, or video.uri) and reused the authenticated headers — or appended ?key=<API_KEY> — on that request. Because the host of the response-supplied URL was never validated, the long-lived API key was sent to whatever host the response named (a CDN in the benign case, or an attacker-chosen host if the provider response was tampered with), allowing credential exfiltration.

    A new isSameOrigin helper is added to @ai-sdk/provider-utils, and the affected fetches in @ai-sdk/black-forest-labs, @ai-sdk/fireworks, @ai-sdk/replicate, @ai-sdk/gladia, @ai-sdk/fal, and @ai-sdk/google now attach credentials only when the followed URL is same-origin with the provider's configured API origin. Requests to a foreign origin are made without the credential.

  • f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses

    validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:

    • A fully-qualified hostname with a trailing dot (e.g. localhost., myhost.local.) skipped the localhost/.local blocklist.
    • IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.
    • Redirects were validated only after fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
    • Several reserved/internal address ranges were not blocked: CGNAT (100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).

    The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ai-sdk/provider-utils since your current version.


Updates @hono/node-server from 1.19.11 to 1.19.15

Release notes

Sourced from @​hono/node-server's releases.

v1.19.14

What's Changed

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

Commits

Updates minimatch from 10.0.3 to 10.2.3

Changelog

Sourced from minimatch's changelog.

change log

10.2

  • Add braceExpandMax option

10.1

  • Add magicalBraces option for escape
  • Fix makeRe when partial: true is set.
  • Fix makeRe when pattern ends in a final ** path part.

10.0

  • Require node 20 or 22 and higher

9.0

  • No default export, only named exports.

8.0

  • Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions
  • Bump required Node.js version

7.4

  • Add escape() method
  • Add unescape() method
  • Add Minimatch.hasMagic() method

7.3

  • Add support for posix character classes in a unicode-aware way.

7.2

  • Add windowsNoMagicRoot option

7.1

  • Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits

Updates @babel/core from 7.28.4 to 7.29.6

Release notes

Sourced from @​babel/core's releases.

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

📝 Documentation

... (truncated)

Commits

@dependabot
chore(deps): bump the npm_and_yarn group across 9 directories with 13…
b1bcd5f 
… updates

Bumps the npm_and_yarn group with 2 updates in the /packages/web directory: [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: [dompurify](https://github.com/cure53/DOMPurify).
Bumps the npm_and_yarn group with 1 update in the /packages/sdk/js directory: [@hey-api/openapi-ts](https://github.com/hey-api/hey-api/tree/HEAD/packages/openapi-ts).
Bumps the npm_and_yarn group with 4 updates in the /packages/opencode directory: [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils), [@hono/node-server](https://github.com/honojs/node-server), [minimatch](https://github.com/isaacs/minimatch) and [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core).
Bumps the npm_and_yarn group with 1 update in the /packages/enterprise directory: [nitro](https://github.com/nitrojs/nitro).
Bumps the npm_and_yarn group with 1 update in the /packages/desktop-electron directory: [electron](https://github.com/electron/electron).
Bumps the npm_and_yarn group with 1 update in the /packages/console/core directory: [mysql2](https://github.com/sidorares/node-mysql2).
Bumps the npm_and_yarn group with 2 updates in the /packages/console/app directory: [nitro](https://github.com/nitrojs/nitro) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler).
Bumps the npm_and_yarn group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `12.6.3` | `13.1.10` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.7.13` | `7.2.8` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.13` |
| [@hey-api/openapi-ts](https://github.com/hey-api/hey-api/tree/HEAD/packages/openapi-ts) | `0.90.10` | `0.97.3` |
| [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) | `4.0.23` | `4.0.33` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.11` | `1.19.15` |
| [minimatch](https://github.com/isaacs/minimatch) | `10.0.3` | `10.2.3` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.28.4` | `7.29.6` |
| [nitro](https://github.com/nitrojs/nitro) | `3.0.1-alpha.1` | `3.0.1-alpha.2` |
| [electron](https://github.com/electron/electron) | `40.4.1` | `41.10.3` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.14.4` | `3.23.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.50.0` | `4.59.1` |
| [turbo](https://github.com/vercel/turborepo) | `2.8.13` | `2.9.14` |



Updates `@astrojs/cloudflare` from 12.6.3 to 13.1.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/cloudflare)

Updates `astro` from 5.7.13 to 7.2.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG-v5.md)
- [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro)

Updates `dompurify` from 3.3.1 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.1...3.4.13)

Updates `@hey-api/openapi-ts` from 0.90.10 to 0.97.3
- [Release notes](https://github.com/hey-api/hey-api/releases)
- [Changelog](https://github.com/hey-api/hey-api/blob/main/packages/openapi-ts/CHANGELOG.md)
- [Commits](https://github.com/hey-api/hey-api/commits/@hey-api/[email protected]/packages/openapi-ts)

Updates `@ai-sdk/provider-utils` from 4.0.23 to 4.0.33
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/[email protected]/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/[email protected]/packages/provider-utils)

Updates `@hono/node-server` from 1.19.11 to 1.19.15
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](https://github.com/honojs/node-server/commits)

Updates `minimatch` from 10.0.3 to 10.2.3
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.3...v10.2.3)

Updates `@babel/core` from 7.28.4 to 7.29.6
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core)

Updates `nitro` from 3.0.1-alpha.1 to 3.0.1-alpha.2
- [Release notes](https://github.com/nitrojs/nitro/releases)
- [Changelog](https://github.com/nitrojs/nitro/blob/main/changelog.config.ts)
- [Commits](nitrojs/nitro@v3.0.1-alpha.1...v3.0.1-alpha.2)

Updates `electron` from 40.4.1 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v40.4.1...v41.10.3)

Updates `mysql2` from 3.14.4 to 3.23.1
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.14.4...v3.23.1)

Updates `nitro` from 3.0.1-alpha.1 to 3.0.1-alpha.2
- [Release notes](https://github.com/nitrojs/nitro/releases)
- [Changelog](https://github.com/nitrojs/nitro/blob/main/changelog.config.ts)
- [Commits](nitrojs/nitro@v3.0.1-alpha.1...v3.0.1-alpha.2)

Updates `wrangler` from 4.50.0 to 4.59.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/[email protected]/packages/wrangler)

Updates `@astrojs/cloudflare` from 12.6.3 to 13.1.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/cloudflare)

Updates `astro` from 5.7.13 to 7.2.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG-v5.md)
- [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro)

Updates `dompurify` from 3.3.1 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.1...3.4.13)

Updates `@hey-api/openapi-ts` from 0.90.10 to 0.97.3
- [Release notes](https://github.com/hey-api/hey-api/releases)
- [Changelog](https://github.com/hey-api/hey-api/blob/main/packages/openapi-ts/CHANGELOG.md)
- [Commits](https://github.com/hey-api/hey-api/commits/@hey-api/[email protected]/packages/openapi-ts)

Updates `@ai-sdk/provider-utils` from 4.0.23 to 4.0.33
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/[email protected]/packages/provider-utils/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/[email protected]/packages/provider-utils)

Updates `@hono/node-server` from 1.19.11 to 1.19.15
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](https://github.com/honojs/node-server/commits)

Updates `minimatch` from 10.0.3 to 10.2.3
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v10.0.3...v10.2.3)

Updates `@babel/core` from 7.28.4 to 7.29.6
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core)

Updates `nitro` from 3.0.1-alpha.1 to 3.0.1-alpha.2
- [Release notes](https://github.com/nitrojs/nitro/releases)
- [Changelog](https://github.com/nitrojs/nitro/blob/main/changelog.config.ts)
- [Commits](nitrojs/nitro@v3.0.1-alpha.1...v3.0.1-alpha.2)

Updates `electron` from 40.4.1 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v40.4.1...v41.10.3)

Updates `mysql2` from 3.14.4 to 3.23.1
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.14.4...v3.23.1)

Updates `wrangler` from 4.50.0 to 4.59.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/[email protected]/packages/wrangler)

Updates `turbo` from 2.8.13 to 2.9.14
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.8.13...v2.9.14)

---
updated-dependencies:
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 13.1.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.2.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hey-api/openapi-ts"
  dependency-version: 0.97.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@ai-sdk/provider-utils"
  dependency-version: 4.0.33
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.15
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 10.2.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: nitro
  dependency-version: 3.0.1-alpha.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 41.10.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: mysql2
  dependency-version: 3.23.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: nitro
  dependency-version: 3.0.1-alpha.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: wrangler
  dependency-version: 4.59.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 13.1.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.2.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hey-api/openapi-ts"
  dependency-version: 0.97.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@ai-sdk/provider-utils"
  dependency-version: 4.0.33
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.15
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 10.2.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: nitro
  dependency-version: 3.0.1-alpha.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 41.10.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: mysql2
  dependency-version: 3.23.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: wrangler
  dependency-version: 4.59.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: turbo
  dependency-version: 2.9.14
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 20, 2026
@github-actions

github-actions Bot commented Sep 20, 2026

Copy link
Copy Markdown

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

  • PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

@github-actions

github-actions Bot commented Sep 20, 2026

Copy link
Copy Markdown

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

  1. Open an issue describing the bug/feature (if one doesn't exist)
  2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code needs:compliance needs:issue

Projects

None yet

Milestone

No milestone

Development

See More

Successfully merging this pull request may close these issues.

0 participants