Skip to content

chore(deps-dev): bump the dependencies group with 17 updates#160

Merged
mroderick merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-bf6f609404
Jun 13, 2026
Merged

chore(deps-dev): bump the dependencies group with 17 updates#160
mroderick merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-bf6f609404

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 17 updates:

Package From To
@commitlint/cli 20.4.3 20.5.3
@commitlint/config-conventional 20.4.3 20.5.3
@cucumber/cucumber 12.7.0 12.9.0
@hono/node-server 1.19.11 1.19.14
better-sqlite3 12.6.2 12.10.0
eslint 10.0.3 10.4.1
fast-check 4.6.0 4.8.0
fastify 5.8.2 5.8.5
globals 17.4.0 17.6.0
hono 4.12.7 4.12.23
ioredis 5.10.0 5.11.1
mysql2 3.20.0 3.22.5
pg 8.20.0 8.21.0
prettier 3.8.1 3.8.3
sinon 21.0.3 21.1.2
tap 21.6.2 21.7.4
typescript 6.0.2 6.0.3

Updates @commitlint/cli from 20.4.3 to 20.5.3

Release notes

Sourced from @​commitlint/cli's releases.

v20.5.3

20.5.3 (2026-04-30)

Refactor

Docs

New Contributors

Full Changelog: conventional-changelog/commitlint@v20.5.2...v20.5.3

v20.5.2

20.5.2 (2026-04-25)

Just minor dep updates before the next breaking change

Chore & Docs

New Contributors

Full Changelog: conventional-changelog/commitlint@v20.5.1...v20.5.2

v20.5.1

20.5.1 (2026-03-31)

Bug Fixes

Reverts

... (truncated)

Changelog

Sourced from @​commitlint/cli's changelog.

20.5.3 (2026-04-30)

Note: Version bump only for package @​commitlint/cli

20.5.2 (2026-04-25)

Note: Version bump only for package @​commitlint/cli

20.5.0 (2026-03-15)

Bug Fixes

  • cli: validate that --cwd directory exists before execution (#4658) (cf80f75), closes #4595

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/cli

Commits

Updates @commitlint/config-conventional from 20.4.3 to 20.5.3

Release notes

Sourced from @​commitlint/config-conventional's releases.

v20.5.3

20.5.3 (2026-04-30)

Refactor

Docs

New Contributors

Full Changelog: conventional-changelog/commitlint@v20.5.2...v20.5.3

v20.5.2

20.5.2 (2026-04-25)

Just minor dep updates before the next breaking change

Chore & Docs

New Contributors

Full Changelog: conventional-changelog/commitlint@v20.5.1...v20.5.2

v20.5.1

20.5.1 (2026-03-31)

Bug Fixes

Reverts

... (truncated)

Changelog

Sourced from @​commitlint/config-conventional's changelog.

20.5.3 (2026-04-30)

Note: Version bump only for package @​commitlint/config-conventional

20.5.0 (2026-03-15)

Note: Version bump only for package @​commitlint/config-conventional

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/config-conventional

Commits

Updates @cucumber/cucumber from 12.7.0 to 12.9.0

Release notes

Sourced from @​cucumber/cucumber's releases.

v12.9.0

Added

  • Emit new publish:url event for plugins (#2808)

v12.8.3

Fixed

  • Handle thrown strings correctly (partial backport from #2708)
  • Include assertion info in stack trace (#2803)

v12.8.2

Changed

  • Various dependency updates

v12.8.1

Fixed

v12.8.0

Added

  • Support custom externalising option (#2780)
Changelog

Sourced from @​cucumber/cucumber's changelog.

[12.9.0] - 2026-05-15

Added

  • Emit new publish:url event for plugins (#2808)

[12.8.3] - 2026-05-09

Fixed

  • Handle thrown strings correctly (#2708)
  • Include assertion info in stack trace (#2803)

[12.8.2] - 2026-04-25

Changed

  • Various dependency updates

[12.8.1] - 2026-04-14

Fixed

[12.8.0] - 2026-04-12

Added

  • Support custom externalising option (#2780)
Commits

Updates @hono/node-server from 1.19.11 to 1.19.14

Release notes

Sourced from @​hono/node-server's releases.

v1.19.14

What's Changed

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

Commits

Updates better-sqlite3 from 12.6.2 to 12.10.0

Release notes

Sourced from better-sqlite3's releases.

v12.10.0

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.9.1...v12.10.0

v12.9.1

⚠️CAUTION: NOT A VIABLE RELEASE

Electron v39+ prebuilds are not building successfully at the moment. Stick to v12.9.0 for now.

What's Changed

New Contributors

Full Changelog: WiseLibs/better-sqlite3@v12.9.0...v12.9.1

v12.9.0

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.8.0...v12.9.0

v12.8.0

What's Changed

New Contributors

Why SQLite v3.51.3 instead of v3.52.0

From the SQLite team:

Some important issues have been found with version 3.52.0. In order to give us time to deal with those issues, we plan to withdraw the 3.52.0 release. In its place, we will put up a new 3.51.3 patch release that includes a fix for the recently discovered WAL-reset bug as well as other patches. This will happen probably within about the next twelve hours.

Hence, if you were planning to upgrade to 3.52.0 tomorrow (Friday, 2026-03-14), perhaps it would be better to wait a day or so for 3.51.3.

At some point we will do version 3.52.1 which will hopefully resolve the issues that have arisen with the 3.52.0 release.

... (truncated)

Commits

Updates eslint from 10.0.3 to 10.4.1

Release notes

Sourced from eslint's releases.

v10.4.1

Bug Fixes

  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930) (Francesco Trotta)
  • d4ce898 fix: propagate failures from delegated commands (#20917) (Minh Vu)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916) (kuldeep kumar)
  • c5bc78b fix: false positive for reference in finally block (#20655) (Tanuj Kanti)
  • 27538c0 fix: add missing CodePath and CodePathSegment types (#20853) (Pixel998)

Documentation

  • 61b0add docs: remove deprecated rule from related rules of max-params (#20921) (Tanuj Kanti)
  • 305d5b9 docs: remove deprecated rules from related rules section (#20911) (Tanuj Kanti)
  • 49b0202 docs: fix display: none of ad (#20901) (Tanuj Kanti)
  • 9067f94 docs: switch build to Node.js 24 (#20893) (Milos Djermanovic)
  • c91b041 docs: Update README (GitHub Actions Bot)
  • e349265 docs: clarify semver strings in rule deprecation objects (#20885) (Milos Djermanovic)

Chores

  • b0e466b test: add data property to invalid tests cases for rules (#20924) (Tanuj Kanti)
  • f78838b test: add CodePath type coverage (#20904) (Pixel998)
  • 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20922) (Francesco Trotta)
  • 002942c ci: declare contents:read on update-readme workflow (#20919) (Arpit Jain)
  • 64bca24 chore: update ecosystem plugins (#20912) (ESLint Bot)
  • 6d7c832 chore: ignore fflate updates in renovate (#20908) (Pixel998)
  • b2c8638 ci: bump pnpm/action-setup from 6.0.7 to 6.0.8 (#20889) (dependabot[bot])
  • a9b8d7f chore: increase maxBuffer for ecosystem tests (#20881) (sethamus)
  • b702ead chore: update ecosystem update PR settings (#20884) (Pixel998)
  • 507f60e chore: update ecosystem plugins (#20882) (ESLint Bot)
  • 92f5c5b test: add unit test for message-count (#20878) (kuldeep kumar)
  • df32108 chore: add @​eslint/markdown and typescript-eslint ecosystem tests (#20837) (sethamus)
  • 327f91d chore: use includeIgnoreFile internally (#20876) (Kirk Waiblinger)
  • f0dc4bd chore: pin fflate@0.8.2 (#20877) (Milos Djermanovic)
  • 0f4bd25 ci: run Discord alert for ecosystem test failures (#20873) (Copilot)

v10.4.0

Features

  • 1a45ec5 feat: check sequence expressions in for-direction (#20701) (kuldeep kumar)
  • 450040b feat: add includeIgnoreFile() to eslint/config (#20735) (Kirk Waiblinger)

Bug Fixes

  • 544c0c3 fix: escape code path DOT labels in debug output (#20866) (Pixel998)
  • 6799431 fix: update dependency @​eslint/config-helpers to ^0.6.0 (#20850) (renovate[bot])
  • f078fef fix: handle non-array deprecated rule replacements (#20825) (xbinaryx)

Documentation

  • 7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869) (Pavel)
  • db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865) (Kirk Waiblinger)
  • 9084664 docs: Update README (GitHub Actions Bot)
  • 9cc7387 docs: Update README (GitHub Actions Bot)
  • 3d7b548 docs: Update README (GitHub Actions Bot)
  • 191ec3c docs: Update README (GitHub Actions Bot)

... (truncated)

Commits
  • 4a3d15a 10.4.1
  • 43e7e2b Build: changelog update for 10.4.1
  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930)
  • b0e466b test: add data property to invalid tests cases for rules (#20924)
  • d4ce898 fix: propagate failures from delegated commands (#20917)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916)
  • f78838b test: add CodePath type coverage (#20904)
  • 61b0add docs: remove deprecated rule from related rules of max-params (#20921)
  • 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20...
  • 002942c ci: declare contents:read on update-readme workflow (#20919)
  • Additional commits viewable in compare view

Updates fast-check from 4.6.0 to 4.8.0

Release notes

Sourced from fast-check's releases.

New arbitrary to chain in a loop fashion

[Code][Diff]

Features

  • (PR#6678) Add chainUntil arbitrary for iterative chaining

Fixes

  • (PR#6965) Bug: Restore ability not to use skipLibCheck
  • (PR#6877) CI: Lowercase discussion_category_name to "announcements"
  • (PR#6878) CI: Scope permissions of clean-caches
  • (PR#6880) CI: Add PR-authoring guidance for Claude
  • (PR#6887) CI: Delete CLAUDE.md
  • (PR#6888) CI: Use tilde ranges for security dependency overrides
  • (PR#6891) CI: Disable Renovate updates on pnpm overrides
  • (PR#6899) CI: Scope Claude hooks to $CLAUDE_PROJECT_DIR
  • (PR#6905) CI: Enable pnpm global virtual store
  • (PR#6933) CI: Pin pnpm in npm install commands
  • (PR#6932) CI: Grant discussions: write to release jobs
  • (PR#6935) CI: Skip PR template check for dubzzz
  • (PR#6937) CI: Mirror the repo to tangled
  • (PR#6938) CI: Add missing runs-on for tangled
  • (PR#6889) Doc: Add release notes for fast-check 4.7.0
  • (PR#6900) Doc: Fix broken API reference links
  • (PR#6844) Doc: Extract manual setup guide into dedicated page
  • (PR#6845) Doc: Add index pages for documentation sections
  • (PR#6918) Doc: Fix Documentation link to point to first doc page
  • (PR#6939) Doc: Link to Tangled mirror of fast-check
  • (PR#6934) Test: Tolerate \p{...} value drift in docs tests
  • (PR#6951) Test: Fix poisoning tests for latest Node

Unicode property support in stringMatching

[Code][Diff]

Features

  • (PR#6866) Reversible json arbitrary
  • (PR#6868) Parse \p{} and \P{} in stringMatching
  • (PR#6870) Support for \p{UnicodeProperty} in stringMatching
  • (PR#6871) Support negated unicode properties in stringMatching

Fixes

  • (PR#6710) CI: Pass explicit string to make_latest
  • (PR#6714) CI: Remove unused vite dependency from multiple packages
  • (PR#6780) CI: Silent zizmor issues (as they used to be)

... (truncated)

Changelog

Sourced from fast-check's changelog.

4.8.0

New arbitrary to chain in a loop fashion [Code][Diff]

Features

  • (PR#6678) Add chainUntil arbitrary for iterative chaining

Fixes

  • (PR#6965) Bug: Restore ability not to use skipLibCheck
  • (PR#6877) CI: Lowercase discussion_category_name to "announcements"
  • (PR#6878) CI: Scope permissions of clean-caches
  • (PR#6880) CI: Add PR-authoring guidance for Claude
  • (PR#6887) CI: Delete CLAUDE.md
  • (PR#6888) CI: Use tilde ranges for security dependency overrides
  • (PR#6891) CI: Disable Renovate updates on pnpm overrides
  • (PR#6899) CI: Scope Claude hooks to $CLAUDE_PROJECT_DIR
  • (PR#6905) CI: Enable pnpm global virtual store
  • (PR#6933) CI: Pin pnpm in npm install commands
  • (PR#6932) CI: Grant discussions: write to release jobs
  • (PR#6935) CI: Skip PR template check for dubzzz
  • (PR#6937) CI: Mirror the repo to tangled
  • (PR#6938) CI: Add missing runs-on for tangled
  • (PR#6889) Doc: Add release notes for fast-check 4.7.0
  • (PR#6900) Doc: Fix broken API reference links
  • (PR#6844) Doc: Extract manual setup guide into dedicated page
  • (PR#6845) Doc: Add index pages for documentation sections
  • (PR#6918) Doc: Fix Documentation link to point to first doc page
  • (PR#6939) Doc: Link to Tangled mirror of fast-check
  • (PR#6934) Test: Tolerate \p{...} value drift in docs tests
  • (PR#6951) Test: Fix poisoning tests for latest Node

4.7.0

Unicode property support in stringMatching [Code][Diff]

Features

  • (PR#6866) Reversible json arbitrary
  • (PR#6868) Parse \p{} and \P{} in stringMatching
  • (PR#6870) Support for \p{UnicodeProperty} in stringMatching
  • (PR#6871) Support negated unicode properties in stringMatching

Fixes

... (truncated)

Commits
  • c0da76f 🔖 Update CHANGELOG.md for fast-check@4.8.0, @​fast-check/ava@​3.0.1 (#6967)
  • df6f4c1 🐛 Restore ability not to use skipLibCheck (#6965)
  • af612c5 ⬆️ Update dependency @​types/node to ^24.12.3 (#6952)
  • 917dda4 ✅ Fix poisoning tests for latest Node (#6951)
  • acb5c6f ✅ Tolerate \p{...} value drift in docs tests (#6934)
  • 26cab19 ✨ Add chainUntil arbitrary for iterative chaining (#6678)
  • 16f65f6 ⬆️ Update dependency oxlint to ^1.60.0 (#6856)
  • 0a8ce9a ⬆️ Update dependency @​microsoft/api-extractor to ^7.58.7 (#6898)
  • debb9b6 📝 Fix broken API reference links (#6900)
  • 642e651 ⬆️ Update dependency typescript to ~6.0.3 (#6886)
  • Additional commits viewable in compare view

Updates fastify from 5.8.2 to 5.8.5

Release notes

Sourced from fastify's releases.

v5.8.5

⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.4...v5.8.5

v5.8.4

Full Changelog: fastify/fastify@v5.8.3...v5.8.4

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

... (truncated)

Commits
  • 3983cce Bumped v5.8.5
  • 3ce3ae6 Merge commit from fork
  • b06a196 docs(ecosystem): add @​pompelmi/fastify-plugin (#6610)
  • 909c5d5 chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 (#6630)
  • 4db21a3 chore: Bump borp from 0.21.0 to 1.0.0 (#6633)
  • 0f4e544 chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 (#6632)
  • 33a2fcd chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 (#6629)
  • fd35d82 ci: reduce cron schedules from daily/weekly to monthly (#6623)

Bumps the dependencies group with 17 updates:

| Package | From | To |
| --- | --- | --- |
| [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `20.4.3` | `20.5.3` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `20.4.3` | `20.5.3` |
| [@cucumber/cucumber](https://github.com/cucumber/cucumber-js) | `12.7.0` | `12.9.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.11` | `1.19.14` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.6.2` | `12.10.0` |
| [eslint](https://github.com/eslint/eslint) | `10.0.3` | `10.4.1` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.6.0` | `4.8.0` |
| [fastify](https://github.com/fastify/fastify) | `5.8.2` | `5.8.5` |
| [globals](https://github.com/sindresorhus/globals) | `17.4.0` | `17.6.0` |
| [hono](https://github.com/honojs/hono) | `4.12.7` | `4.12.23` |
| [ioredis](https://github.com/luin/ioredis) | `5.10.0` | `5.11.1` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.20.0` | `3.22.5` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.21.0` |
| [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` |
| [sinon](https://github.com/sinonjs/sinon) | `21.0.3` | `21.1.2` |
| [tap](https://github.com/tapjs/tapjs) | `21.6.2` | `21.7.4` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.2` | `6.0.3` |


Updates `@commitlint/cli` from 20.4.3 to 20.5.3
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.5.3/@commitlint/cli)

Updates `@commitlint/config-conventional` from 20.4.3 to 20.5.3
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.5.3/@commitlint/config-conventional)

Updates `@cucumber/cucumber` from 12.7.0 to 12.9.0
- [Release notes](https://github.com/cucumber/cucumber-js/releases)
- [Changelog](https://github.com/cucumber/cucumber-js/blob/main/CHANGELOG.md)
- [Commits](cucumber/cucumber-js@v12.7.0...v12.9.0)

Updates `@hono/node-server` from 1.19.11 to 1.19.14
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.11...v1.19.14)

Updates `better-sqlite3` from 12.6.2 to 12.10.0
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v12.6.2...v12.10.0)

Updates `eslint` from 10.0.3 to 10.4.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.0.3...v10.4.1)

Updates `fast-check` from 4.6.0 to 4.8.0
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.8.0/packages/fast-check)

Updates `fastify` from 5.8.2 to 5.8.5
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.2...v5.8.5)

Updates `globals` from 17.4.0 to 17.6.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.4.0...v17.6.0)

Updates `hono` from 4.12.7 to 4.12.23
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.7...v4.12.23)

Updates `ioredis` from 5.10.0 to 5.11.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.10.0...v5.11.1)

Updates `mysql2` from 3.20.0 to 3.22.5
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.20.0...v3.22.5)

Updates `pg` from 8.20.0 to 8.21.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.21.0/packages/pg)

Updates `prettier` from 3.8.1 to 3.8.3
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.1...3.8.3)

Updates `sinon` from 21.0.3 to 21.1.2
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](sinonjs/sinon@v21.0.3...v21.1.2)

Updates `tap` from 21.6.2 to 21.7.4
- [Release notes](https://github.com/tapjs/tapjs/releases)
- [Commits](https://github.com/tapjs/tapjs/compare/tap@21.6.2...tap@21.7.4)

Updates `typescript` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.2...v6.0.3)

---
updated-dependencies:
- dependency-name: "@commitlint/cli"
  dependency-version: 20.5.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 20.5.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@cucumber/cucumber"
  dependency-version: 12.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: better-sqlite3
  dependency-version: 12.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: fast-check
  dependency-version: 4.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: fastify
  dependency-version: 5.8.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: globals
  dependency-version: 17.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: hono
  dependency-version: 4.12.23
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ioredis
  dependency-version: 5.11.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mysql2
  dependency-version: 3.22.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pg
  dependency-version: 8.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.8.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: sinon
  dependency-version: 21.1.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: tap
  dependency-version: 21.7.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 13, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 13, 2026

Copy link
Copy Markdown

Deploying idempot-js with  Cloudflare Pages  Cloudflare Pages

Latest commit: 822b6eb
Status: ✅  Deploy successful!
Preview URL: https://c9dd5df0.idempot-js.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-depe.idempot-js.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 13, 2026
@mroderick

Copy link
Copy Markdown
Contributor

Dependency Upgrade Review: 17 Updates

Risk Assessment

Dependency Old New Risk Notes
@commitlint/cli 20.4.1 20.5.3 Low Dev tooling
@commitlint/config-conventional 20.4.1 20.5.3 Low Dev tooling
@cucumber/cucumber 12.7.0 12.9.0 Low Minor features; publish:url event, bug fixes
@hono/node-server 1.19.9 1.19.14 Low Security fix (GHSA-92pp-h63x-v22m), request draining fix
better-sqlite3 12.6.2 12.10.0 Low SQLite 3.53.1, Node v26 support, percentile functions
eslint 10.0.3 10.4.1 Low Bug fixes, new includeIgnoreFile() feature
fast-check 4.6.0 4.8.0 Low chainUntil added (not used); skipLibCheck fix
fastify 5.8.2 5.8.5 Medium Security fixes: CVE-2026-33806, CVE-2026-3635
globals 17.4.0 17.6.0 Low Node.js globals updates
hono 4.12.7 4.12.23 Low Minor patches
ioredis 5.10.0 5.11.1 Low Minor patches
mysql2 3.20.0 3.22.5 Low Minor patches
pg 8.18.0 8.21.0 Low Minor patches
prettier 3.8.1 3.8.3 Low Bug fixes
sinon 21.0.0 21.1.2 Low Bug fixes
tap 21.5.0 21.7.4 Low Bug fixes
typescript 6.0.2 6.0.3 Low Bug fixes

Usage Analysis

  • sinon: Used via sinon.fake, sinon.replace, sinon.restore — core stable APIs unaffected.
  • fastify: Used in integration tests via standard Fastify() constructor. No breaking changes.
  • fast-check: Used in property-based tests (fc.assert, fc.property, fc.integer, etc.). New chainUntil feature not used. skipLibCheck fix is beneficial.
  • better-sqlite3: Used via import Database from "better-sqlite3" — standard constructor unaffected.
  • @hono/node-server: Used via serve() in examples and tests — stable core API.
  • @cucumber/cucumber: Used for spec compliance tests — new features unused.
  • pg: Used via Pool constructor — standard API.
  • mysql2: Used as mysql2/promise connection pool — standard API.
  • ioredis: Used via Redis constructor — standard API.

Compatibility

Compatible — All updates are patch/minor bumps. No breaking changes affect the APIs this codebase uses.

Security Notes

  • fastify: CVE-2026-33806 and CVE-2026-3635 are fixed in v5.8.5 — these should be merged promptly.
  • @hono/node-server: Security fix in v1.19.13 for serve-static middleware bypass.

Test Coverage

All CI checks pass (Node.js 22, Node.js 24, Bun, Deno, Lint, Cucumber, Link Checker, etc.). No test coverage gaps identified.

Confidence

High — All updates are minor/patch bumps with no breaking changes in used APIs. Security fixes are the primary motivation.

Recommendation

Approve and merge. The fastify security fixes justify this being merged promptly.

@mroderick
mroderick merged commit 35a6133 into main Jun 13, 2026
12 checks passed
@mroderick
mroderick deleted the dependabot/npm_and_yarn/dependencies-bf6f609404 branch June 13, 2026 16:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant