Skip to content

chore(deps): bump the npm_and_yarn group across 4 directories with 10 updates - #2565

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-bd3c9aefb3
Open

chore(deps): bump the npm_and_yarn group across 4 directories with 10 updates#2565
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-bd3c9aefb3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
dompurify 3.4.11 3.4.13
hono 4.12.25 4.13.5
next 16.2.9 16.3.3
@hono/node-server 1.19.14 1.19.17
body-parser 1.20.4 1.20.8
brace-expansion 1.1.16 1.1.18
fast-uri 3.1.2 3.1.7
immutable 5.1.5 5.1.9
linkify-it 5.0.1 5.0.2
dompurify 3.4.11 3.4.13
hono 4.12.25 4.13.5

Bumps the npm_and_yarn group with 1 update in the /renderers/markdown/markdown-it directory: dompurify.
Bumps the npm_and_yarn group with 9 updates in the /samples/community directory:

Package From To
dompurify 3.4.11 3.4.15
hono 4.12.25 4.13.7
@hono/node-server 1.19.14 1.19.17
body-parser 2.2.2 2.3.0
brace-expansion 1.1.16 1.1.18
fast-uri 3.1.2 3.1.7
immutable 5.1.6 5.1.9
linkify-it 5.0.1 5.0.2
postcss 8.5.15 8.5.28

Bumps the npm_and_yarn group with 1 update in the /tools/composer directory: next.

Updates dompurify from 3.4.11 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates hono from 4.12.25 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
  • fix(client): skip undefined header and cookie values in honojs/hono#5244
  • fix(client): skip an undefined entry inside a query array in honojs/hono#5272
  • fix(client): skip an undefined entry inside a form array in honojs/hono#5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
  • fix(client): omit empty query delimiter in honojs/hono#5283
  • fix(request): drop stale content length for cloned FormData in honojs/hono#5282
  • fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
  • fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
  • fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits
  • 06880c4 4.13.5
  • 531e9c5 Merge commit from fork
  • 3a67f7f Merge commit from fork
  • 9c28d72 Merge commit from fork
  • 017000d 4.13.4
  • 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
  • 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
  • c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
  • 612b59c fix(request): drop stale content length for cloned FormData (#5282)
  • 73794bd fix(client): omit empty query delimiter (#5283)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates next from 16.2.9 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [backport] Scope app-entry export validation to files inside the app directory (#97357)
  • [backport] Fix catch-all index page being served for every other slug (#97416)
  • [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits
  • a9a1cb7 v16.3.3
  • 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
  • 3a15b4a [16.3.x] [next/image]: disable avif image optimization
  • 7378b51 Backport/docs fixes 16.3 (#97649)
  • 528c1cd [16.3.x] Stop generating error codes (#97780)
  • d0ac882 v16.3.2
  • 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
  • cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
  • 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
  • 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
  • Additional commits viewable in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates body-parser from 1.20.4 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

Changelog

Sourced from body-parser's changelog.

1.20.8

  • Same code base as 1.20.7. This was created to test the new release process.

1.20.7

  • deps: qs@~6.16.0

1.20.6

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit

1.20.5

  • refactor(json): simplify strict mode error string construction
  • fix: extended urlencoded parsing of arrays with >100 elements (#716)
  • deps: qs@~6.15.1
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Updates brace-expansion from 1.1.16 to 1.1.18

Commits

Updates fast-uri from 3.1.2 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • ae92a4c Merge commit from fork
  • 444ecda Merge commit from fork
  • Additional commits viewable in compare view

Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

internal

New Contributors

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

  • fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

4.3.9

5.1.7

  • fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
  • fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
  • [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

  • fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196
Commits
  • 329f7a6 5.1.9
  • 21fabd9 changelog
  • 009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
  • 5b65bfb fix(List): preserve undefined values when grown past 32 elements
  • 50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
  • 6496539 5.1.8
  • 808a83a Merge commit from fork
  • e51d49f perf(Map): index large hash-collision buckets for faster lookups
  • 25c58b0 fix typescript in tests
  • a1a1ee4 Merge commit from fork
  • Additional commits viewable in compare view

Updates linkify-it from 5.0.1 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

  • Fixed DoS in mailto: links (restrict user name to 64 chars).
  • Restricted user/pass part length in links.
Commits

Updates dompurify from 3.4.11 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates body-parser from 1.20.4 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

Changelog

Sourced from body-parser's changelog.

1.20.8

  • Same code base as 1.20.7. This was created to test the new release process.

1.20.7

  • deps: qs@~6.16.0

1.20.6

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit

1.20.5

  • refactor(json): simplify strict mode error string construction
  • fix: extended urlencoded parsing of arrays with >100 elements (#716)
  • deps: qs@~6.15.1
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Updates brace-expansion from 1.1.16 to 1.1.18

Commits

Updates dompurify from 3.4.11 to 3.4.13

Release notes

Sourced from Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 8, 2026
@github-project-automation github-project-automation Bot moved this to Todo in A2UI Sep 8, 2026
@dependabot dependabot Bot mentioned this pull request Sep 8, 2026
Closed
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-bd3c9aefb3 branch 8 times, most recently from c381e1d to f6f7135 Compare September 14, 2026 17:26
@dependabot
chore(deps): bump the npm_and_yarn group across 4 directories with 10…
6880405 
… updates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.13` |
| [hono](https://github.com/honojs/hono) | `4.12.25` | `4.13.5` |
| [next](https://github.com/vercel/next.js) | `16.2.9` | `16.3.3` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.4` | `1.20.8` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.18` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.7` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` |
| [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.1` | `5.0.2` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.13` |
| [hono](https://github.com/honojs/hono) | `4.12.25` | `4.13.5` |

Bumps the npm_and_yarn group with 1 update in the /renderers/markdown/markdown-it directory: [dompurify](https://github.com/cure53/DOMPurify).
Bumps the npm_and_yarn group with 9 updates in the /samples/community directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.15` |
| [hono](https://github.com/honojs/hono) | `4.12.25` | `4.13.7` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.18` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.7` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.1.6` | `5.1.9` |
| [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.1` | `5.0.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.28` |

Bumps the npm_and_yarn group with 1 update in the /tools/composer directory: [next](https://github.com/vercel/next.js).


Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `hono` from 4.12.25 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.5)

Updates `next` from 16.2.9 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.9...v16.3.3)

Updates `@hono/node-server` from 1.19.14 to 1.19.17
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v1.19.17)

Updates `body-parser` from 1.20.4 to 1.20.8
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.4...1.20.8)

Updates `brace-expansion` from 1.1.16 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18)

Updates `fast-uri` from 3.1.2 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.7)

Updates `immutable` from 5.1.5 to 5.1.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9)

Updates `linkify-it` from 5.0.1 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.1...5.0.2)

Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `@hono/node-server` from 1.19.14 to 1.19.17
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v1.19.17)

Updates `body-parser` from 1.20.4 to 1.20.8
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.4...1.20.8)

Updates `brace-expansion` from 1.1.16 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18)

Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `fast-uri` from 3.1.2 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.7)

Updates `hono` from 4.12.25 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.5)

Updates `immutable` from 5.1.5 to 5.1.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9)

Updates `linkify-it` from 5.0.1 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.1...5.0.2)

Updates `hono` from 4.12.25 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.5)

Updates `next` from 16.2.9 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.9...v16.3.3)

Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `dompurify` from 3.4.11 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `hono` from 4.12.25 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.5)

Updates `@hono/node-server` from 1.19.14 to 1.19.17
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v1.19.17)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.4...1.20.8)

Updates `brace-expansion` from 1.1.16 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18)

Updates `fast-uri` from 3.1.2 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.7)

Updates `immutable` from 5.1.6 to 5.1.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9)

Updates `linkify-it` from 5.0.1 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.1...5.0.2)

Updates `postcss` from 8.5.15 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.28)

Updates `dompurify` from 3.4.11 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `@hono/node-server` from 1.19.14 to 1.19.17
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v1.19.17)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.4...1.20.8)

Updates `brace-expansion` from 1.1.16 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18)

Updates `dompurify` from 3.4.11 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `fast-uri` from 3.1.2 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.7)

Updates `hono` from 4.12.25 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.5)

Updates `immutable` from 5.1.6 to 5.1.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9)

Updates `linkify-it` from 5.0.1 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.1...5.0.2)

Updates `postcss` from 8.5.15 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.28)

Updates `hono` from 4.12.25 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.5)

Updates `next` from 16.2.9 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.9...v16.3.3)

Updates `next` from 16.2.9 to 16.3.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.9...v16.3.3)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: indirect
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: indirect
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: indirect
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: indirect
- dependency-name: body-parser
  dependency-version: 1.20.8
  dependency-type: indirect
- dependency-name: body-parser
  dependency-version: 1.20.8
  dependency-type: indirect
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: indirect
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: indirect
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: indirect
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.3.3
  dependency-type: direct:production
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-bd3c9aefb3 branch from f6f7135 to 6880405 Compare September 14, 2026 17:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants