chore(deps): bump the hyperframes group across 1 directory with 50 updates

[dependabot]

Bumps the hyperframes group with 50 updates in the /vendor/hyperframes directory:

Package	From	To
@types/node	22.19.7	26.6.5
happy-dom	20.14.6	21.0.3
knip	6.29.0	6.41.0
lefthook	2.1.6	2.2.2
oxfmt	0.63.0	0.73.0
tsx	4.23.5	4.23.15
yaml	2.9.0	2.9.1
@hono/node-server	1.19.11	2.1.5
esbuild	0.25.9	0.28.2
hono	4.12.12	4.13.13
onnxruntime-node	1.21.1	1.30.0
open	11.0.0	11.0.4
postcss	8.4.31	8.5.30
prettier	3.8.3	3.9.10
sharp	0.34.5	0.35.5
ignore	5.3.2	7.0.12
@types/adm-zip	0.5.8	0.6.0
vitest	4.1.12	5.0.5
@google/genai	1.52.0	2.30.0
@chenglou/pretext	0.0.5	1.0.0
@types/jsdom	28.0.3	30.0.0
@vitest/coverage-v8	4.1.12	5.0.5
jsdom	29.1.1	30.1.3
@webgpu/types	0.1.69	0.1.74
htmlparser2	8.0.2	12.0.0
acorn	8.16.0	8.19.0
postcss-selector-parser	7.1.1	7.1.6
@babel/parser	7.27.0	8.0.7
magic-string	0.30.21	1.4.3
recast	0.23.11	0.24.0
@codemirror/autocomplete	6.20.0	6.20.3
@codemirror/commands	6.10.2	6.11.1
@codemirror/lang-html	6.4.11	6.4.12
@codemirror/lang-javascript	6.2.4	6.2.5
@codemirror/lang-markdown	6.5.1	6.5.2
@codemirror/language	6.12.1	6.13.1
@codemirror/state	6.5.4	6.7.6
@codemirror/view	6.40.0	6.43.14
dompurify	3.4.13	3.4.17
lucide-react	0.577.0	1.58.0
marked	17.0.6	18.1.1
@base-ui/react	1.7.0	1.9.0
@lezer/highlight	1.2.3	1.2.5
@mcp-b/global	5.1.0	6.0.3
cn	0.2.4	0.4.0
dockview-react	8.3.1	8.5.1
@vitejs/plugin-react	4.7.0	6.1.2
vite	6.4.3	8.3.4
zustand	5.0.12	5.0.15
chokidar	4.0.3	5.0.0

Updates @types/node from 22.19.7 to 26.6.5

Commits

• See full diff in compare view

Updates happy-dom from 20.14.6 to 21.0.3

Release notes

Sourced from happy-dom's releases.

v21.0.3

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

👷‍♂️ Patch fixes

• Adds alias for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading

Commits

• 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
• 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
• f55c7e0 chore: Update security documentation (#2509)
• 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
• 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
• See full diff in compare view

Updates knip from 6.29.0 to 6.41.0

Release notes

Sourced from knip's releases.

Release 6.41.0

• Add Flue plugin (#2124) (c52737d45ff008d6d96d4c2d4182048a2aa64602) - thanks @​LuisFigueroaG!
• Match all React Native config file extensions (#2125) (898fdffb37ae0bdb3d2653038eb10c2e01edf983) - thanks @​LuisFigueroaG!
• Consolidate fixture guidance and extend plugin guidelines (37a4ca04645f71f599e9b530676543f9893bd641)
• Add AI contribution policy (b15f0fbb090ea0427240880da2bec602c11cea50)
• Use files from tsconfig references with --use-tsconfig-files (#2126) (9618185eafb0c5cb365035f89e9d66718642338a) - thanks @​kaanisthatyou!
• Compile gitignore walk patterns once (resolve #2127) (09c80299779fa5abe133ee8f82051c25870007b8)
• Drop readdir order dependent case from gitignore walk test (ab3da8ff95a05a0fbfba6873b64559017d038aa7)
• fix: recognize binaries from absent optional dependencies (#2120) (d908556eaa98bf9637a2744d2de089bab31b8dbc) - thanks @​DreamLongYT!
• Apply a directory's .gitignore before walking its subdirectories (9560c07862d4c72dc956371b9a77e049d83ed4a9)
• Apply nested .gitignore files to workspace globs (23d35421dd67c405254f2f8bcbc09b18d224e338)
• Update gitignore matcher and walk notes (499f85f4544457dc7c51c4a7612fea69773ef3dd)
• Keep the cwd out of glob patterns and matchers (#2107) (1e82fb807c88cc46951f2028214569f9a2eb0061) - thanks @​kaanisthatyou!
• Support function configs in Rsbuild plugin (#2122) (38071db87e9023e5dd61173ce32f9020a1a5d7ff) - thanks @​bytedoe!
• Separate Expo Router plugin; remove expo-router entry points from Expo plugin (#2128) (ad541764ca7d3c062236661677d1d66d5275122f) - thanks @​jjjjonathan!
• Link Expo config discovery source and fold expo6 fixture into expo-router (2ddeca50956790b10580e835df50bc980cce961d)
• Update dependencies (c9f79148f7165314a7b3c801eff926d1d0d6b060)
• Migrate shell script parsing to unbash v5 (4942cca05303410120a007a5bb23b0c2da725da1)
• Handle updated Formatly result types (ca9e8315e003dae69646f7500fa98ab9ed403b92)
• Preserve TypeScript 5.0 compatibility in shell AST filters (957ac7bbd654f6d3d0c4dc4eab2f4aa133ff0b4b)
• Point timerify crashes to the Node.js version that fixes them (0c235de096fd3361eb918d1290241fa32a62f089)
• Copy importer identifier sets into the reverse index (2860d678a87dddb5ad56299119fb6e108ceffa12)
• Clear the resolver cache at the start of a run (10b5bb82ecd03c88b68ace58a7aea23d188cc5f1)

Release 6.40.0

• Resolve local and scope-only extends in commitlint plugin (#2079) (e667552d4e7122094565d3ad9ae407acfc0ac684) - thanks @​giaBaoJS!
• Clarify worktree guides and plugin review preparation (dd02baf020d23af1d47c44c1a726a61014b270bd)
• Document stale cache results and workarounds (#2078) (3573749a5d5bbee6305f207cc7d1b72c200c8c9b)
• Exclude test files from package entries in production mode (resolve #2082) (b86f45f9d38d4b83baad98e43983e08910e00c78) - thanks @​jonathanong!
• Resolve Serverless file variables in plugins and functions (resolve #2074) (99cac789694ea8d76cd38184d2d7c95f34315224) - thanks @​SwastikTripathi!
• Preserve locally referenced namespace members (resolve #2070) (f0f36df766cd74ad7ae03fbf8940bdeb792439be) - thanks @​MFA-G!
• fix: add the commitlint-plugin prefix to Commitlint plugin names (#2096) (3decd35ff0a4220c7cd2c9142dc69c89794b3927) - thanks @​devYRPauli!
• fix: match .mjs config files in the simple-git-hooks plugin (#2097) (79a87d92396c2444ae4ef3c780c0d2e18cd73e4c) - thanks @​devYRPauli!
• fix: match capacitor.config.js in the Capacitor plugin (#2098) (4a5ec96d818117a7f2eafa027e3b707bc97573a8) - thanks @​devYRPauli!
• fix(typescript): ArrayExpression (#2099) (#2100) (87fea9f201c2fd864eafa31bdad68910a8a177ba) - thanks @​DreamLongYT!
• Preserve development entry pattern groups (7c229f4e1918075d801ed3b046fa022b1d3bcc41)
• Resolve null package exports to the files they hide (resolve #2084, close #2085) (5bd46260feb60b957c2631bc72375ef192e441e0)
• Pin InvokeAI ecosystem test (4e0a3432eb35e3f628f6d3b7fcd14b942de343d0)
• fix(utils): add jsx extension to source mapping (#2087) (eaa353b5fc30c2f12cdf2c29e6dd68e0d0950062) - thanks @​DreamLongYT!
• fix(serverless-framework): handle explicit extensions in handler paths (#2091) (e9393965be7563640921e3f20c946fcb9132e1cb) - thanks @​DreamLongYT!
• Annotate published manifest return type (d95a8310a0d0dca8f23d8dd3f83e7b0a1909d038)
• Add Jasmine plugin (#2105) (9ed14911d5c5752aef36878ab3d515c35d1ac6bc) - thanks @​SulimanAbdulrazzaq!
• fix: resolve workspace exports with fallback arrays (#2088) (49c2aaeaba4544f25cc02c19d5da5152a8ef68c3) - thanks @​DreamLongYT!
• fix(postcss): ignore disabled plugins in object configs (#2092) (b84fdf8a8ee676ee45f4313009ebfe969d034a88) - thanks @​DreamLongYT!
• Resolve webServer commands in Playwright plugin (#2110) (1af96bce36b0d0d07791de100c7f2ea5672a478c) - thanks @​everton-dgn!
• Cache config file inputs per plugin (#2109) (01cb43267ca5dc03a2cbcba0a19fd891d4ed1f37) - thanks @​everton-dgn!
• fix: include custom compiler extensions in source path mapping (#2090) (dc3a47e2d810808314454b8f5c23070f136d15d3) - thanks @​DreamLongYT!
• Don't let a self-closing swallow the next (#2113) (989fdadde0a068d1d1c52e26a8327b99c5de0668) - thanks @​maniflopi!
• fix(oxlint): resolve lint from loaded Vite config (#2108) (6d44e532ed6320cdf4f4c3253b26e155c4d26ba7) - thanks @​everton-dgn!
• fix: resolve Jest module names without the jest-* prefix (#2095) (a5f4cfbff7f263a0ea8d5461a3f9216cbef38602) - thanks @​devYRPauli!

... (truncated)

Commits

• 13d7f21 Release knip@6.41.0
• 10b5bb8 Clear the resolver cache at the start of a run
• 2860d67 Copy importer identifier sets into the reverse index
• 0c235de Point timerify crashes to the Node.js version that fixes them
• 957ac7b Preserve TypeScript 5.0 compatibility in shell AST filters
• ca9e831 Handle updated Formatly result types
• 4942cca Migrate shell script parsing to unbash v5
• c9f7914 Update dependencies
• 2ddeca5 Link Expo config discovery source and fold expo6 fixture into expo-router
• ad54176 Separate Expo Router plugin; remove expo-router entry points from Expo plugin...
• Additional commits viewable in compare view

Updates lefthook from 2.1.6 to 2.2.2

Release notes

Sourced from lefthook's releases.

v2.2.2

Changelog

• 4aeffd72a6e3ea846c2054cffd6294c943fd7fbb fix: cleanup only current stash hash (#1597)
• db62412c82ddac71cf536e60e50edb2826624870 packaging: add support for android (#1591)
• e3fa81b1f01881829ef95e37211da7923a4fd6df refactor(filter): simplify mimetype matching (#1596)

v2.2.1

Changelog

• 6dd11f61f54595935746f9e0814c16844fc6d31b feat: support php composer (#1583)
• c702ccf154bb180107ba5f790518c161d9ce111d fix: generate different patch names when in a worktree (#1582)
• 486fdd317d29f815821ce2450d42e3a49b066eb0 refactor: cache paths in wrapper (#1570)

v2.2.0

Changelog

• 46c65b3871dd96c81624f413b24b3d273b41a4e5 deps: October 2026 (#1571)
• 37f17131b605cf0f64c29252ebfe94610368f769 fix: don't write an install-time lefthook path into AI hook configs (#1544)
• cc9969c2e2198aafff8accc63ee1aee30e9a2aa4 fix: ignore trailing NUL in --files-from-stdin (#1574)
• 57fee374b70c18e17ada20e09a336142d6d8899f fix: pass --output path to git diff as a single argument (#1581)

v2.1.17

Changelog

• 8d8073d427fac49cc982919f5280b295645d196d fix: diff push files against the merge base with the default branch (#1565)
• c12bccd193f43a8419038787bd83b12fe3a4470c fix: don't hash submodules when checking fail_on_changes (#1566)
• 03225efde40226b14459e901707fbd988d62fcc0 refactor: naming of helpers (#1568)
• 66746ace996c72ac31b3cb4a70af85607568baf4 refactor: working with git (#1564)

v2.1.16

Changelog

• 3ee04318fd06d56a70cc9c90dc8385b19918f520 ci: refactor publishing scripts (#1559)
• 91407e537b2fa36539506963a33e582dca394798 deps: bump mod and text deps to resolve CVEs (#1560)
• be6f0ae8793533449cb9a07a253fa9a381e82206 fix: preserve unrelated unstaged changes on conflict (#1483)
• cf4ef1e19baf0581871f69b40914d64c94ff19d7 fix: test staging fixed files with partially staged

v2.1.15

Changelog

• 2388dde2b31dc9a782e967764046b41b404cece9 feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#1547)
• 49260b57c2a56bc4d65d09395458bb3ce3c63311 fix(lfs): do not pipe stdin into post-checkout git-lfs hook (#1523)
• 38bc1c6cef3192a36002d0dcc37973416249c07e fix: quote paths in the generated hook shim (#1509)
• 0892f5f256ebe162485492af5ca14c2ced45586f fix: remove color blending (#1558)
• f1de41cd5cd6a6c5e0179c65e00d5ed6d90078c2 fix: resolve push-files fallback against the remote-tracking ref (#1485)
• 07ce565bcc73465bc18fb36561b935ee2a53eab6 fix: sanitize slashes in remote ref when building the checkout dir name (#1486)
• c465ca8ef4fc9ee0695aa4a9530fc404ed838b7a test(cmd): regression for valid fish shell completion output (#1527)

v2.1.14

Changelog

v2.1.12

Changelog

• b8350fde604197b2422adfc4ae0af080725822b9 ci: fix npm publishing by bumping Node to 24 (#1508)
• 9fb290d786a0e122fe113b1b49a45bbd0ffa7d28 fix: LEFTHOOK_OUTPUT precedence (#1506)

... (truncated)

Changelog

Sourced from lefthook's changelog.

2.2.2

• fix: cleanup only current stash hash (#1597) by @​mrexox
• refactor: simplify mimetype matching (#1596) by @​scop
• packaging: add support for android (#1591) by @​mrexox

2.2.1

• feat: support php composer (#1583) by @​mrexox
• fix: generate different patch names when in a worktree (#1582) by @​mrexox
• refactor: cache paths in wrapper (#1570) by @​mrexox

2.2.0

• fix: don't write an install-time lefthook path into AI hook configs (#1544) by @​anandghegde
• docs: publish JSON schema at lefthook.dev/schema.json (#1579) by @​BUTTERFINGERS7498
• fix: pass --output path to git diff as a single argument (#1581) by @​cpruijsen
• fix: ignore trailing NUL in --files-from-stdin (#1574) by @​jasonwbarnett
• deps: October 2026 (#1571) by @​mrexox

2.1.7

• fix: don't hash submodules when checking fail_on_changes (#1566) by @​tiagovilasboas
• refactor: naming of helpers (#1568) by @​mrexox
• fix: diff push files against the merge base with the default branch (#1565) by @​mrexox
• refactor: working with git (#1564) by @​mrexox
• docs: add protect-branch example to docs (#1563) by @​vim89

2.1.16

• fix: test staging fixed files with partially staged by @​mrexox
• fix: preserve unrelated unstaged changes on conflict (#1483) by @​Sakshamm-Goyal
• deps: bump mod and text deps to resolve CVEs (#1560) by @​devindavies
• ci: refactor publishing scripts (#1559) by @​mrexox

2.1.15

• fix: do not pipe stdin into post-checkout git-lfs hook (#1523) by @​rwinkelman
• fix: remove color blending (#1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#1485) by @​hamodywe
• test: regression for valid fish shell completion output (#1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#1547) by @​Yash121l

2.1.13/2.1.14 (2026-09-14)

• fix: error when --job/--command matches nothing (#1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#1536) by @​chiliec

... (truncated)

Commits

• eb4e504 2.2.2: keep backups for worktree flows and release android NPM package
• 4aeffd7 fix: cleanup only current stash hash (#1597)
• e3fa81b refactor(filter): simplify mimetype matching (#1596)
• db62412 packaging: add support for android (#1591)
• 60c1ddd 2.2.1: support concurrent work in worktrees and release PHP package
• 6dd11f6 feat: support php composer (#1583)
• c702ccf fix: generate different patch names when in a worktree (#1582)
• 486fdd3 refactor: cache paths in wrapper (#1570)
• 125cd28 2.2.0: new Go version and git worktree fixes
• 37f1713 fix: don't write an install-time lefthook path into AI hook configs (#1544)
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (2.1.6) was attested. Review the package versions before updating.

Updates oxfmt from 0.63.0 to 0.73.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.73.0

💥 BREAKING CHANGES

• 1ef2888 oxfmt: [BREAKING] Improve --migrate prettier (#27444) (leaysgur)
• c2e6d5f formatter_toml: [BREAKING] Add oxc_formatter_toml crate wrapping oxc-toml (#27365) (leaysgur)

🚀 Features

• ce4e8dc oxfmt: Support overrides[].parser -> associations[].language migration (#27475) (leaysgur)
• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 77f8156 oxfmt/lsp: Show root config errors to LSP client (#26014) (Sysix)
• c1adce3 oxfmt/lsp: Support astro language (#27388) (leaysgur)
• 4f024a1 oxfmt: Support astro plugin in --migrate prettier (#27387) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

🐛 Bug Fixes

• 76ec31b formatter_css: Support css-in-js placeholders in property names and conditions (#27640) (leaysgur)
• 99bb268 formatter_css: Keep css-in-js placeholder as media type (#27639) (leaysgur)
• 372849e formatter: Fix crash on css-in-js comment containing interpolation (#27638) (leaysgur)
• da692b8 formatter: Wrap export default class|function consistently (#27628) (leaysgur)
• 21dee96 formatter: Keep parens around TSInstantiationExpression before ! and export (#27626) (leaysgur)
• b6eb914 oxfmt: Normalize symlink targets in CLI snapshots (#27498) (camc314)
• 5dae56f oxfmt/lsp: Return error on config resolving error (#26003) (Sysix)
• 676cc60 formatter/jsdoc: Preserve paragraphs by checking @description tag width (#27439) (leaysgur)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• db360de oxfmt: Load svelte plugin for svelte-in-mdx-in-md (#27369) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)
• d730fdd formatter_core: Leave blank frontmatter without dispatcher (#27359) (leaysgur)

📚 Documentation

• 4a28c91 formatter_css: Clarify missed-semicolon-accepted divergence (#27433) (leaysgur)
• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)
• 37b3c48 formatter_markdown: Fix DIVERGENCES.md examples and slug to match behavior (#27358) (leaysgur)

oxfmt v0.72.0

💥 BREAKING CHANGES

• e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

• b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

• 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
• 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)

... (truncated)

Changelog

Sourced from oxfmt's changelog.

[0.73.0] - 2026-10-13

🚀 Features

• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

📚 Documentation

• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• a495e82 feat(oxfmt): support associations config to specify language over filepath ...
• 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
• 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
• 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• f158bff chore(deps): update npm packages (#26865)
• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• Additional commits viewable in compare view

Updates tsx from 4.23.5 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

Updates @hono/node-server from 1.19.11 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

• ci: add autofix.ci by @​yusukebe in honojs/node-server#392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in honojs/node-server#390
• chore: add better benchmarks by @​BlankParticle in honojs/node-server#391
• docs(readme): update the benchmark by @​yusukebe in honojs/node-server#394
• test(request): accept asynchronous body read errors by @​usualoma in honojs/node-server#403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378

... (truncated)

Commits

• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• d57ed9b 2.1.4
• 92b014c chore: allow hono v5 as a peer dependency (#406)
• 720ac78 2.1.3
• 9821792 Merge commit from fork
• 35bca95 2.1.2
• 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
• fe7467c test(request): accept asynchronous body read errors (#403)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

Updates esbuild from 0.25.9 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Au...

  Description has been truncated