chore(deps)(deps): bump the bun-minor-and-patch group across 1 directory with 35 updates

[dependabot]

Bumps the bun-minor-and-patch group with 35 updates in the / directory:

Package	From	To
eslint	10.2.0	10.11.0
eslint-plugin-react-refresh	0.5.3	0.5.7
typescript-eslint	8.62.0	8.70.1
@agendajs/mongo-backend	4.0.2	4.0.3
agenda	6.2.5	6.2.6
cron-parser	5.6.1	5.10.1
hono	4.12.27	4.13.9
jszip	3.10.1	3.10.2
mongodb	7.4.0	7.6.0
posthog-node	5.38.6	5.53.0
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.5
bun-types	1.3.14	1.4.2
mongodb-memory-server	11.2.0	11.3.0
@hookform/resolvers	5.4.0	5.9.1
@tanstack/react-query	5.101.2	5.103.2
@xyflow/react	12.11.1	12.12.0
highlight.js	11.11.1	11.12.0
i18next	26.3.3	26.4.2
posthog-js	1.395.0	1.434.13
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
react-hook-form	7.80.0	7.88.0
react-i18next	17.0.8	17.0.15
react-router-dom	7.18.0	7.18.4
recharts	3.9.0	3.10.1
zustand	5.0.14	5.0.15
@tailwindcss/vite	4.3.1	4.3.3
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
@vitejs/plugin-react	6.0.3	6.1.1
tailwindcss	4.3.1	4.3.3
vite	8.1.0	8.3.1

Updates eslint from 10.2.0 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits

• 3c0b7c6 10.11.0
• 321f0a7 Build: changelog update for 10.11.0
• 520dd77 perf: Implement fast paths in critical areas (#21210)
• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
• 24310e3 chore: update ecosystem plugins (#21324)
• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
• Additional commits viewable in compare view

Updates eslint-plugin-react-refresh from 0.5.3 to 0.5.7

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

v0.5.6

• Support re-exporting namespace components (fixes #116)

v0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

v0.5.4

• Add instant to allowExportNames in Next config #112

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

0.5.6

• Support re-exporting namespace components (fixes #116)

0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

0.5.4

• Add instant to allowExportNames in Next config #112

Commits

• fd40d83 Add allowCompoundComponents option [publish] (#117)
• 620568a Support re-exporting namespace components (fixes #116) [publish]
• 65c3172 [publish] v0.5.5
• 8411020 Bump deps
• c28fa15 Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly ...
• 554c764 [publish] add contentType and size to allowExportNames in Next config (#115)
• e316617 [publish] Add instant to allowExportNames in Next config (#112)
• See full diff in compare view

Updates typescript-eslint from 8.62.0 to 8.70.1

Release notes

Sourced from typescript-eslint's releases.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)
• typescript-estree: require string literal import attribute values (#12894)
• website: prevent playground from breaking down after opening link with the .js file type (#12777)

❤️ Thank You

• Amin @​amiin-dev
• Brad Zacher @​bradzacher
• Cameron
• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Grit @​Grit03
• Hugo @​hugop95
• Josh Goldberg ✨
• Michael Naumov @​mnaoumov
• Mikhail Baev @​baevm
• Om Rawat
• overlookmotel
• Sanath @​sansynx
• Shinji
• stoicism @​stoicism02
• Vinccool96
• Younsang Na @​nayounsang
• 김채영 @​cchaeyoung
• 송재욱

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.70.1 (2026-09-21)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

🚀 Features

• typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

• Claude Sonnet 5
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨

... (truncated)

Commits

• 23d38ce chore(release): publish 8.70.1
• eb42d9b chore: cleanup and fix Nx dependencies and missing tasks (#12897)
• 8c80531 chore: fix typos in comments and docs (#12846)
• b6b86a1 chore: migrate to nx 23.2.0 (#12843)
• 7ee7608 chore(release): publish 8.70.0
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• 9a6e546 chore(release): publish 8.69.0
• 8f4e00a chore(release): publish 8.68.0
• 55f6d5d chore: enable source maps (#12677)
• 20a261f chore(release): publish 8.67.0
• Additional commits viewable in compare view

Updates @agendajs/mongo-backend from 4.0.2 to 4.0.3

Release notes

Sourced from @​agendajs/mongo-backend's releases.

@​agendajs/mongo-backend@​4.0.3

Patch Changes

• 4823fa7: Map startDate, endDate and skipDays from MongoDB documents to job objects so date constraints on repeating jobs survive a reload from the database (previously a repeating job with an endDate would keep running forever after its first execution)
• c419abe: Follow-up to #1783: restore defensive new Date() coercion for date fields in saveJobState so untyped callers passing ISO strings cannot persist strings in date fields, and remove the internal OptionalKeysToNullable helper type from the public exports
• cb27747: Push skip/limit to the database in queryJobs when no state filter is requested, instead of loading the entire matching collection into memory. Prevents out-of-memory on large collections (#1713, #1712).
• 1edf8bc: Conform to the MongoDB Stable API: replace the distinct command in getDistinctJobNames() with a $group aggregation, so the backend works with clients configured with apiStrict: true
• ea7c773: Reject server-side-evaluation operators ($where, $function, $expr, $accumulator) in unique() constraints. They have no use in a uniqueness key and could allow query injection when the key is built from untrusted input. Ordinary equality and comparison constraints are unchanged.
• 3708f9a: Extended the saved Job type to have explicit null values instead of undefined and stopped relying on the MongoDb driver "ignoreUndefined" flag to set them
• Updated dependencies [3369032]
• Updated dependencies [a072e7b]
• Updated dependencies [d90be16]
• Updated dependencies [42d17a3]
• Updated dependencies [2b6c926]
• Updated dependencies [08b1e22]
• Updated dependencies [24e7591]
• Updated dependencies [fd01a64]
  • agenda@6.2.6

Commits

• fd90c62 Version Packages (#1717)
• a930ab1 fix(test): send fork child error message over IPC instead of empty object (#1...
• ca44630 Update README.md (#1711)
• d90be16 fix(agenda): schedule @​Every jobs registered after agenda is ready (#1726)
• cb27747 fix(mongo-backend): paginate queryJobs at the database (#1755)
• 08b1e22 fix(agenda): treat numeric repeatInterval as milliseconds (#1754)
• 3369032 reset backoff failCount on success (#1727)
• 2b6c926 fix(agenda): correct processing queue insertion order (#1725)
• 42d17a3 fix(agenda): unlock future-dated job freed by the processor (#1750)
• a072e7b do not skip a cron occurrence when nextRunAt is ahead of the next tick (#1743)
• Additional commits viewable in compare view

Updates agenda from 6.2.5 to 6.2.6

Release notes

Sourced from agenda's releases.

agenda@6.2.6

Patch Changes

• 3369032: Reset a job's backoff retry counter after a successful run. A recurring job that exhausted its retries earlier in its lifetime kept the old failCount, so a later failure was treated as already out of retries and stopped retrying.
• a072e7b: Fix recurring cron jobs skipping a valid occurrence. computeFromInterval compared the next cron tick against the stored nextRunAt, so when nextRunAt was further in the future than the next tick after lastRunAt, it bumped past and skipped the legitimate occurrence. It now only re-rolls when the tick is not strictly after lastRunAt.
• d90be16: Fix @Every jobs registered after the agenda was already ready never being scheduled. The scheduler relied on a one-shot ready event that had already fired, so it now uses the ready promise, which stays resolved.
• 42d17a3: Release the database lock when the processor frees a job whose nextRunAt is too far in the future. Previously such a job, when picked up via the expired-lock recovery path (for example a recurring job left locked by a crashed worker), was removed from the local locked list but never unlocked in the database, so it was re-locked on every scan and never reached its run time.
• 2b6c926: Fix processing queue order. JobProcessingQueue.insert placed the highest-priority (or earliest nextRunAt) job in the slot that runs last, because the queue is read from the end. Jobs queued in the same tick now run in the correct priority order.
• 08b1e22: Treat a numeric (or purely-numeric string) repeatInterval as milliseconds in computeFromInterval, so recurring jobs scheduled with agenda.every(5000, 'job') keep running on backends that persist the interval as a string.
• 24e7591: Fix start() race where concurrent calls leaked a second JobProcessor and connected the notification channel twice
• fd01a64: stop() no longer unlocks jobs that are still running, preventing duplicate concurrent execution of the same job occurrence on another instance during rolling restarts. Only jobs that are locked locally but have not started running are unlocked; running jobs keep their database lock until they complete (or lockLifetime expires if the process dies).

Commits

• fd90c62 Version Packages (#1717)
• a930ab1 fix(test): send fork child error message over IPC instead of empty object (#1...
• ca44630 Update README.md (#1711)
• d90be16 fix(agenda): schedule @​Every jobs registered after agenda is ready (#1726)
• cb27747 fix(mongo-backend): paginate queryJobs at the database (#1755)
• 08b1e22 fix(agenda): treat numeric repeatInterval as milliseconds (#1754)
• 3369032 reset backoff failCount on success (#1727)
• 2b6c926 fix(agenda): correct processing queue insertion order (#1725)
• 42d17a3 fix(agenda): unlock future-dated job freed by the processor (#1750)
• a072e7b do not skip a cron occurrence when nextRunAt is ahead of the next tick (#1743)
• Additional commits viewable in compare view

Updates cron-parser from 5.6.1 to 5.10.1

Release notes

Sourced from cron-parser's releases.

v5.10.1

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

• fix: pad short expressions from the leading field slot by @​harrisiirak in harrisiirak/cron-parser#443

Full Changelog: harrisiirak/cron-parser@v5.9.0...v5.10.0

v5.9.0

What's Changed

• fix: keep explicit range bounds when stringifying stepped fields (#279) by @​harrisiirak in harrisiirak/cron-parser#440
• fix: compensate DST transitions wider than one hour by @​aniket-3001 in harrisiirak/cron-parser#435
• fix: keep a hashed step wider than its range from emptying the field by @​Jaybhade in harrisiirak/cron-parser#437

New Contributors

• @​aniket-3001 made their first contribution in harrisiirak/cron-parser#435
• @​Jaybhade made their first contribution in harrisiirak/cron-parser#437

Full Changelog: harrisiirak/cron-parser@v5.8.1...v5.9.0

v5.8.1

What's Changed

• ci: automate releases by @​harrisiirak in harrisiirak/cron-parser#439

Full Changelog: harrisiirak/cron-parser@v5.8.0...v5.8.1

v5.8.0

What's Changed

• chore: report coverage and benchmark on every PR commit by @​harrisiirak in harrisiirak/cron-parser#430
• docs: document benchmark environment variables by @​harrisiirak in harrisiirak/cron-parser#431
• docs: add security policy and code of conduct by @​harrisiirak in harrisiirak/cron-parser#432
• fix: drop day of month values the month does not have by @​harrisiirak in harrisiirak/cron-parser#433
• fix: keep day fields that cover their whole range out of the wildcard form by @​harrisiirak in harrisiirak/cron-parser#434
• fix: round the current date to whole seconds so occurrences on the end date are returned by @​harrisiirak in harrisiirak/cron-parser#436
• fix: keep a day-of-week step from adding Sunday when it never reaches 7 by @​spokodev in harrisiirak/cron-parser#438

Full Changelog: harrisiirak/cron-parser@v5.7.0...v5.8.0

v5.7.0

What's Changed

• fix: enforce iteration loop limit so unsatisfiable expressions throw instead of returning a bogus date by @​spokodev in harrisiirak/cron-parser#415

... (truncated)

Changelog

Sourced from cron-parser's changelog.

v5.10.1 - 2026-09-12

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

v5.10.0 - 2026-08-14

What's Changed

• fix: pad short expressions from the leading field slot by @​harrisiirak in harrisiirak/cron-parser#443

Full Changelog: harrisiirak/cron-parser@v5.9.0...v5.10.0

v5.9.0 - 2026-08-13

What's Changed

• fix: keep explicit range bounds when stringifying stepped fields (#279) by @​harrisiirak in harrisiirak/cron-parser#440
• fix: compensate DST transitions wider than one hour by @​aniket-3001 in harrisiirak/cron-parser#435
• fix: keep a hashed step wider than its range from emptying the field by @​Jaybhade in harrisiirak/cron-parser#437

New Contributors

• @​aniket-3001 made their first contribution in harrisiirak/cron-parser#435
• @​Jaybhade made their first contribution in harrisiirak/cron-parser#437

Full Changelog: harrisiirak/cron-parser@v5.8.1...v5.9.0

v5.8.1 - 2026-08-09

What's Changed

• ci: automate releases by @​harrisiirak in harrisiirak/cron-parser#439

Full Changelog: harrisiirak/cron-parser@v5.8.0...v5.8.1

v5.8.0 - 2026-08-09

What's Changed

• chore: report coverage and benchmark on every PR commit by @​harrisiirak in harrisiirak/cron-parser#430
• docs: document benchmark environment variables by @​harrisiirak in harrisiirak/cron-parser#431
• docs: add security policy and code of conduct by @​harrisiirak in harrisiirak/cron-parser#432
• fix: drop day of month values the month does not have by @​harrisiirak in harrisiirak/cron-parser#433
• fix: keep day fields that cover their whole range out of the wildcard form by @​harrisiirak in harrisiirak/cron-parser#434
• fix: round the current date to whole seconds so occurrences on the end date are returned by @​harrisiirak in harrisiirak/cron-parser#436
• fix: keep a day-of-week step from adding Sunday when it never reaches 7 by @​spokodev in harrisiirak/cron-parser#438

... (truncated)

Commits

• 5b08cdf chore: bump version
• 1d5867c chore: update dev deps
• 95bac55 fix: bound field value expansion at parse time (#450)
• 7b3a0ad chore: add more funding sources to FUNDING.yml
• fc5ca7b chore: add Patreon username for funding support
• 03444a8 chore: update dev deps
• 4fd8809 fix: reject duplicate zero values in field validation (#445)
• 609feef chore: bump version
• 0bf36c8 fix: pad short expressions from the leading field slot (#443)
• 85f3644 fix: anchor the worktree ignore patterns to the project root
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cron-parser since your current version.

Updates hono from 4.12.27 to 4.13.9

Release notes

Sourced from hono's releases.

v4.13.9

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380
• fix(accepts): match media types and language tags case-insensitively in honojs/hono#5376
• fix(linear-router): don't match an empty path segment as a param in honojs/hono#5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in honojs/hono#5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in honojs/hono#5379
• fix(aws-lambda): treat binary +xml archive media types as binary in honojs/hono#5424
• fix(aws-lambda): preserve empty query parameters in honojs/hono#5292
• fix(lambda-edge): sync content type detection with aws-lambda in honojs/hono#5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in honojs/hono#5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

What's Changed

• docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343
• perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340
• fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351
• fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311
• fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349
• fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357
• fix(request): keep the request media type when reusing a cached body in honojs/hono#5366
• docs(combine): fix except() JSDoc param and add missing @​returns in honojs/hono#5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

... (truncated)

Commits

• 7c3b0df 4.13.9
• 6cadf75 fix(lambda-edge): fail with a descriptive error on a malformed event (#5358)
• de310ac fix(lambda-edge): sync content type detection with aws-lambda (#5426)
• 28e8572 fix(aws-lambda): preserve empty query parameters (#5292)
• 0d86899 fix(aws-lambda): treat binary +xml archive media types as binary (#5424)
• 52febbc fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url (

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.