Bump the npm_and_yarn group across 12 directories with 16 updates by dependabot[bot] · Pull Request #3 · telus/cf-workers-for-platforms-template

dependabot · 2026-03-11T02:16:53Z

Bumps the npm_and_yarn group with 3 updates in the /openauth-template directory: wrangler, hono and undici.
Bumps the npm_and_yarn group with 7 updates in the /react-router-hono-fullstack-template directory:

Package	From	To
wrangler	`4.56.0`	`4.59.1`
hono	`4.11.1`	`4.12.7`
react-router	`7.9.6`	`7.12.0`
lodash	`4.17.21`	`4.17.23`
minimatch	`9.0.5`	`9.0.9`
rollup	`4.53.5`	`4.59.0`
undici	`5.29.0`	`7.18.2`

Bumps the npm_and_yarn group with 7 updates in the /react-router-postgres-ssr-template directory:

Package	From	To
wrangler	`4.56.0`	`4.59.1`
hono	`4.11.1`	`4.12.7`
react-router	`7.9.6`	`7.12.0`
lodash	`4.17.21`	`4.17.23`
minimatch	`9.0.5`	`9.0.9`
rollup	`4.53.5`	`4.59.0`
undici	`5.29.0`	`7.18.2`

Bumps the npm_and_yarn group with 5 updates in the /saas-admin-template directory:

Package	From	To
wrangler	`4.56.0`	`4.59.1`
devalue	`5.6.2`	`5.6.3`
diff	`5.2.0`	`5.2.2`
rollup	`4.55.1`	`4.59.0`
svgo	`4.0.0`	`4.0.1`

Bumps the npm_and_yarn group with 2 updates in the /text-to-image-template directory: wrangler and undici.
Bumps the npm_and_yarn group with 7 updates in the /to-do-list-kv-template directory:

Package	From	To
wrangler	`3.114.15`	`3.114.17`
vite	`5.4.14`	`5.4.21`
diff	`5.2.0`	`5.2.2`
lodash	`4.17.21`	`4.17.23`
minimatch	`9.0.5`	`9.0.9`
minimatch	`3.1.2`	`3.1.5`
qs	`6.14.0`	`6.14.2`
rollup	`4.53.5`	`4.59.0`

Bumps the npm_and_yarn group with 5 updates in the /vite-react-template directory:

Package	From	To
wrangler	`4.56.0`	`4.59.1`
hono	`4.11.1`	`4.12.7`
minimatch	`3.1.2`	`3.1.5`
minimatch	`9.0.5`	`9.0.9`
rollup	`4.53.5`	`4.59.0`
undici	`5.29.0`	`7.18.2`

Bumps the npm_and_yarn group with 2 updates in the /worker-publisher-template directory: wrangler and undici.
Bumps the npm_and_yarn group with 2 updates in the /workers-builds-notifications-template directory: wrangler and rollup.
Bumps the npm_and_yarn group with 3 updates in the /workers-for-platforms-template directory: wrangler, esbuild and hono.
Bumps the npm_and_yarn group with 3 updates in the /workflows-starter-template directory: wrangler, minimatch and rollup.
Bumps the npm_and_yarn group with 8 updates in the /x402-proxy-template directory:

Package	From	To
wrangler	`4.56.0`	`4.59.1`
hono	`4.11.1`	`4.12.7`
axios	`1.13.2`	`1.13.6`
bn.js	`5.2.2`	`5.2.3`
h3	`1.15.4`	`1.15.6`
lodash	`4.17.21`	`4.17.23`
minimatch	`3.1.2`	`3.1.5`
minimatch	`9.0.5`	`9.0.9`
undici	`5.29.0`	`7.18.2`

Updates wrangler from 4.56.0 to 4.59.1

Commits

37a8607 Version Packages (#11890)
99b1f32 fix: execute git commands in pages deploy safely (#11889)
e98c95a Version Packages (#11836)
ad65efa Add --check flag to wrangler types (#11852)
beb96af feat(unenv-preset): add support for native node:sqlite module (#11841)
b0e54b2 [wrangler] Add AI agent detection to analytics events (#11820)
2203af4 Add Node.js 24 and 25 compatibility to the test suites for Miniflare, Wrangle...
b6148ed chore(deps): bump the workerd-and-workers-types group with 2 updates (#11872)
0eb973d Do not warn user when using a redirected config that came from a config with ...
0f8d69d containers: users can set multiple tiers for constraints (#11755)
Additional commits viewable in compare view

Updates hono from 4.11.1 to 4.12.7

Release notes

Sourced from hono's releases.

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in honojs/hono#4758

fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in honojs/hono#4792

chore(builld): tsconfig project references by @BarryThePenguin in honojs/hono#4797

chore: add tsconfig.spec.json by @yusukebe in honojs/hono#4798

feat(jsx-renderer): support function-based options by @3w36zj6 in honojs/hono#4780

fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X by @t0waxx in honojs/hono#4782

New Contributors

@t0waxx made their first contribution in honojs/hono#4782

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

fix(request): return string | undefined from param() when path type is any by @andrewdamelio in honojs/hono#4723

fix(jwt): validate token format in decode and decodeHeader functions by @otoneko1102 in honojs/hono#4752

fix(jsx): Fix "Invalid state: Controller is already closed" by @gaearon in honojs/hono#4770

chore(eslint): upgrade @hono/eslint-config by @BarryThePenguin in honojs/hono#4781

New Contributors

@andrewdamelio made their first contribution in honojs/hono#4723

@otoneko1102 made their first contribution in honojs/hono#4752

@gaearon made their first contribution in honojs/hono#4770

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

... (truncated)

Commits

b0aba5b 4.12.7
1be3a53 ci: apply automated fixes
ef90225 Merge commit from fork
3f88636 4.12.6
53b66ae fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X (#4782)
58825a7 feat(jsx-renderer): support function-based options (#4780)
0e80acb chore: add tsconfig.spec.json (#4798)
d69deb8 chore(builld): tsconfig project references (#4797)
8217d9e fix(jsx): align link hoisting and dedupe with React 19 (#4792)
5086956 fix(accept): replace regex split to mitigate ReDoS (#4758)
Additional commits viewable in compare view

Updates undici from 5.29.0 to 7.18.2

Release notes

Sourced from undici's releases.

v7.18.2

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in nodejs/undici#4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

What's Changed

Test and Fix running without SSL by @mcollina in nodejs/undici#4727

docs: add security warning for strictContentLength option by @mcollina in nodejs/undici#4726

build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in nodejs/undici#4718

build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in nodejs/undici#4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

What's Changed

chore: extract infra and encoding methods by @Uzlopak in nodejs/undici#4523

ci: remove h2 by @Uzlopak in nodejs/undici#4534

ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in nodejs/undici#4535

ci: fix nightly shared library case by @Uzlopak in nodejs/undici#4543

test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in nodejs/undici#4528

docs: add Cache Interceptor example to README by @tawseefnabi in nodejs/undici#4393

test: remove node20 version check by @Uzlopak in nodejs/undici#4544

types: use MessagePort instance type in MessageEvent by @Renegade334 in nodejs/undici#4546

ci: set write permissions on job level by @Uzlopak in nodejs/undici#4537

lint: activate n/no-process-exit by @Uzlopak in nodejs/undici#4548

ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in nodejs/undici#4536

chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in nodejs/undici#4547

feat(H2): correct CONNECT behaviour by @metcoder95 in nodejs/undici#4541

test: fix plans by @Uzlopak in nodejs/undici#4550

feat: add runtime feature "detection" by @Uzlopak in nodejs/undici#4545

perf: use less promises in extractBody by @Uzlopak in nodejs/undici#4458

fix(proxy-agent): add missing return after callback-call by @Uzlopak in nodejs/undici#4553

fix: remove redundant line in retry-handler by @Uzlopak in nodejs/undici#4554

ci: add no-wasm-simd option by @Uzlopak in nodejs/undici#4533

fix: use lazyloaders for runtime feature detection by @Uzlopak in nodejs/undici#4557

fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in nodejs/undici#4556

... (truncated)

Commits

7e5cb2d Bumped v7.18.2 (#4730)
b04e3cb fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...
2bcb77b Bumped v7.18.1 (#4728)
58a12b7 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4719)
5fa2930 build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (#4718)
fbbe283 docs: add security warning for strictContentLength option (#4726)
ce12d9e fix: do not crash if Node.js is compiled without SSL (#4727)
ebe3e33 Bumped v7.18.0 (#4725)
4e9b88b fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
d560767 Bumped v7.17.0 (#4724)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates wrangler from 4.56.0 to 4.59.1

Commits

37a8607 Version Packages (#11890)
99b1f32 fix: execute git commands in pages deploy safely (#11889)
e98c95a Version Packages (#11836)
ad65efa Add --check flag to wrangler types (#11852)
beb96af feat(unenv-preset): add support for native node:sqlite module (#11841)
b0e54b2 [wrangler] Add AI agent detection to analytics events (#11820)
2203af4 Add Node.js 24 and 25 compatibility to the test suites for Miniflare, Wrangle...
b6148ed chore(deps): bump the workerd-and-workers-types group with 2 updates (#11872)
0eb973d Do not warn user when using a redirected config that came from a config with ...
0f8d69d containers: users can set multiple tiers for constraints (#11755)
Additional commits viewable in compare view

Updates hono from 4.11.1 to 4.12.7

Release notes

Sourced from hono's releases.

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in honojs/hono#4758

fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in honojs/hono#4792

chore(builld): tsconfig project references by @BarryThePenguin in honojs/hono#4797

chore: add tsconfig.spec.json by @yusukebe in honojs/hono#4798

feat(jsx-renderer): support function-based options by @3w36zj6 in honojs/hono#4780

fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X by @t0waxx in honojs/hono#4782

New Contributors

@t0waxx made their first contribution in honojs/hono#4782

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

fix(request): return string | undefined from param() when path type is any by @andrewdamelio in honojs/hono#4723

fix(jwt): validate token format in decode and decodeHeader functions by @otoneko1102 in honojs/hono#4752

fix(jsx): Fix "Invalid state: Controller is already closed" by @gaearon in honojs/hono#4770

chore(eslint): upgrade @hono/eslint-config by @BarryThePenguin in honojs/hono#4781

New Contributors

@andrewdamelio made their first contribution in honojs/hono#4723

@otoneko1102 made their first contribution in honojs/hono#4752

@gaearon made their first contribution in honojs/hono#4770

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

... (truncated)

Commits

b0aba5b 4.12.7
1be3a53 ci: apply automated fixes
ef90225 Merge commit from fork
3f88636 4.12.6
53b66ae fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X (#4782)
58825a7 feat(jsx-renderer): support function-based options (#4780)
0e80acb chore: add tsconfig.spec.json (#4798)
d69deb8 chore(builld): tsconfig project references (#4797)
8217d9e fix(jsx): align link hoisting and dedupe with React 19 (#4792)
5086956 fix(accept): replace regex split to mitigate ReDoS (#4758)
Additional commits viewable in compare view

Updates react-router from 7.9.6 to 7.12.0

Release notes

Sourced from react-router's releases.

v7.12.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7120

v7.11.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7110

v7.10.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7101

v7.10.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7100

Changelog

Sourced from react-router's changelog.

7.12.0

Minor Changes

Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the react-router.config.ts config allowedActionOrigins field. (#14708)

Patch Changes

Fix generatePath when used with suffixed params (i.e., "/books/:id.json") (#14269)

Export UNSAFE_createMemoryHistory and UNSAFE_createHashHistory alongside UNSAFE_createBrowserHistory for consistency. These are not intended to be used for new apps but intended to help apps usiong unstable_HistoryRouter migrate from v6->v7 so they can adopt the newer APIs. (#14663)

Escape HTML in scroll restoration keys (#14705)

Validate redirect locations (#14706)

[UNSTABLE] Pass <Scripts nonce> value through to the underlying importmap script tag when using future.unstable_subResourceIntegrity (#14675)

[UNSTABLE] Add a new future.unstable_trailingSlashAwareDataRequests flag to provide consistent behavior of request.pathname inside middleware, loader, and action functions on document and data requests when a trailing slash is present in the browser URL. (#14644)

Currently, your HTTP and request pathnames would be as follows for /a/b/c and /a/b/c/

URL /a/b/c HTTP pathname request pathname`

Document /a/b/c /a/b/c ✅

Data /a/b/c.data /a/b/c ✅

URL /a/b/c/ HTTP pathname request pathname`

Document /a/b/c/ /a/b/c/ ✅

Data /a/b/c.data /a/b/c ⚠️

With this flag enabled, these pathnames will be made consistent though a new _.data format for client-side .data requests:

URL /a/b/c HTTP pathname request pathname`

Document /a/b/c /a/b/c ✅

Data /a/b/c.data /a/b/c ✅

URL /a/b/c/ HTTP pathname request pathname`

Document /a/b/c/ /a/b/c/ ✅

Data /a/b/c/_.data ⬅️ /a/b/c/ ✅

This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.

Enabling this flag also changes the format of client side .data requests from /_root.data to /_.data when navigating to / to align with the new format. This does not impact the request pathname which is still / in all cases.

Preserve clientLoader.hydrate=true when using <HydratedRouter unstable_instrumentations> (#14674)

... (truncated)

Commits

26653a6 chore: Update version for release (#14712)
7ac2346 chore: Update version for release (pre) (#14709)
75b1ef5 Add origin checks for UI route submissions (#14708)
c05ef93 Validate redirect locations (#14706)
c89c32c Escape HTML in scroll restoration keys (#14705)
cbcbf30 fix: pass nonce to importmap script when using subResourceIntegrity (#14675)
30f6c1d fix(react-router): handle parameters with static suffixes in generatePath (#1...
7f140e0 Handle data requests with trailing slash consistently (#14644)
1954af6 Preserve hydrate property on client loaders during instrumentation (#14674)
5ce5cd4 chore: format
Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.17.23

Commits

dec55b7 Bump main to v4.17.23 (#6088)
19c9251 fix: setCacheHas JSDoc return type should be boolean (#6071)
b5e6729 jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)
edadd45 Prevent prototype pollution on baseUnset function
4879a7a doc: fix autoLink function, conversion of source links (#6056)
9648f69 chore: remove yarn.lock file (#6053)
dfa407d ci: remove legacy configuration files (#6052)
156e196 feat: add renovate setup (#6039)
933e106 ci: add pipeline for Bun (#6023)
072a807 docs: update links related to Open JS Foundation (#5968)
Additional commits viewable in compare view

Updates minimatch from 9.0.5 to 9.0.9

Commits

8a10e47 9.0.9
c6f1806 brace-expansion@2
446cfa3 9.0.8
8fa151a docs: add warning about ReDoS
71b78a2 fix partial matching of globstar patterns
2de496f 9.0.7
0d4616d limit nested extglob recursion, flatten extglobs
7117ef3 9.0.6
2418458 update deps, do not checkin dist
1d1f531 update deps
Additional commits viewable in compare view

Updates rollup from 4.53.5 to 4.59.0

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

#6275: Validate bundle stays within output dir (@lukastaegert)

v4.58.0

4.58.0

2026-02-20

Features

Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

#6256: docs: document PreRenderedChunk properties including isDynamicEntry and isImplicitEntry (@njg7194, @lukastaegert)

#6259: docs: Correct typo and improve sentence structure in docs for output.experimentalMinChunkSize (@millerick, @lukastaegert)

#6260: fix(deps): update rust crate swc_compiler_base to v47 (@renovate[bot], @lukastaegert)

#6261: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6262: Avoid unnecessary cloning of the code string (@lukastaegert)

#6263: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)

#6265: chore(deps): lock file maintenance (@renovate[bot])

#6267: fix(deps): update minor/patch updates (@renovate[bot])

#6268: chore(deps): update dependency eslint-plugin-unicorn to v63 (@renovate[bot], @lukastaegert)

#6269: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6270: chore(deps): lock file maintenance (@renovate[bot])

#6272: forward NO_SIDE_EFFECTS annotations to function expressions in variable declarations (@lukastaegert)

v4.57.1

4.57.1

2026-01-30

Bug Fixes

Fix heap corruption issue in Windows (#6251)

Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

#6251: fix: Isolate and cache process.report.getReport() calls in a child process for robust environment detection (@alan-agius4, @lukastaegert)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.59.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

#6275: Validate bundle stays within output dir (@lukastaegert)

4.58.0

2026-02-20

Features

Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

#6256: docs: document PreRenderedChunk properties including isDynamicEntry and isImplicitEntry (@njg7194, @lukastaegert)

#6259: docs: Correct typo and improve sentence structure in docs for output.experimentalMinChunkSize (@millerick, @lukastaegert)

#6260: fix(deps): update rust crate swc_compiler_base to v47 (@renovate[bot], @lukastaegert)

#6261: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6262: Avoid unnecessary cloning of the code string (@lukastaegert)

#6263: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)

#6265: chore(deps): lock file maintenance (@renovate[bot])

#6267: fix(deps): update minor/patch updates (@renovate[bot])

#6268: chore(deps): update dependency eslint-plugin-unicorn to v63 (@renovate[bot], @lukastaegert)

#6269: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6270: chore(deps): lock file maintenance (@renovate[bot])

#6272: forward NO_SIDE_EFFECTS annotations to function expressions in variable declarations (@lukastaegert)

4.57.1

2026-01-30

Bug Fixes

Fix heap corruption issue in Windows (#6251)

Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

#6251: fix: Isolate and cache process.report.getReport() calls in a child process for robust environment detection (@alan-agius4, @lukastaegert)

#6252: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6253: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6254: Fully include dynamic imports in a try-catch (@lukastaegert)

... (truncated)

Commits

ae84695 4.59.0
b39616e Update audit-resolve
c60770d Validate bundle stays within output dir (#6275)
33f39c1 4.58.0
b61c408 forward NO_SIDE_EFFECTS annotations to function expressions in variable decla...
7f00689 Extend agent instructions
e7b2b85 chore(deps): lock file maintenance (#6270)
2aa5da9 fix(deps): update minor/patch updates (#6267)
4319837 chore(deps): update dependency lru-cache to v11 (#6269)
c3b6b4b chore(deps): update dependency eslint-plugin-unicorn to v63 (#6268)
Additional commits viewable in compare view

Updates undici from 5.29.0 to 7.18.2

Release notes

Sourced from undici's releases.

v7.18.2

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in nodejs/undici#4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

What's Changed

Test and Fix running without SSL by @mcollina in nodejs/undici#4727

docs: add security warning for strictContentLength option by @mcollina in nodejs/undici#4726

build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in nodejs/undici#4718

build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in nodejs/undici#4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

What's Changed

chore: extract infra and encoding methods by @Uzlopak in nodejs/undici#4523

ci: remove h2 by @Uzlopak in nodejs/undici#4534

ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in nodejs/undici#4535

ci: fix nightly shared library case by @Uzlopak in nodejs/undici#4543

test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in nodejs/undici#4528

docs: add Cache Interceptor example to README by @tawseefnabi in nodejs/undici#4393Description has been truncated

Bumps the npm_and_yarn group with 3 updates in the /openauth-template directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler), [hono](https://github.com/honojs/hono) and [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 7 updates in the /react-router-hono-fullstack-template directory: | Package | From | To | | --- | --- | --- | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.56.0` | `4.59.1` | | [hono](https://github.com/honojs/hono) | `4.11.1` | `4.12.7` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.9.6` | `7.12.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` | | [rollup](https://github.com/rollup/rollup) | `4.53.5` | `4.59.0` | | [undici](https://github.com/nodejs/undici) | `5.29.0` | `7.18.2` | Bumps the npm_and_yarn group with 7 updates in the /react-router-postgres-ssr-template directory: | Package | From | To | | --- | --- | --- | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.56.0` | `4.59.1` | | [hono](https://github.com/honojs/hono) | `4.11.1` | `4.12.7` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.9.6` | `7.12.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` | | [rollup](https://github.com/rollup/rollup) | `4.53.5` | `4.59.0` | | [undici](https://github.com/nodejs/undici) | `5.29.0` | `7.18.2` | Bumps the npm_and_yarn group with 5 updates in the /saas-admin-template directory: | Package | From | To | | --- | --- | --- | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.56.0` | `4.59.1` | | [devalue](https://github.com/sveltejs/devalue) | `5.6.2` | `5.6.3` | | [diff](https://github.com/kpdecker/jsdiff) | `5.2.0` | `5.2.2` | | [rollup](https://github.com/rollup/rollup) | `4.55.1` | `4.59.0` | | [svgo](https://github.com/svg/svgo) | `4.0.0` | `4.0.1` | Bumps the npm_and_yarn group with 2 updates in the /text-to-image-template directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) and [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 7 updates in the /to-do-list-kv-template directory: | Package | From | To | | --- | --- | --- | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `3.114.15` | `3.114.17` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.14` | `5.4.21` | | [diff](https://github.com/kpdecker/jsdiff) | `5.2.0` | `5.2.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.14.2` | | [rollup](https://github.com/rollup/rollup) | `4.53.5` | `4.59.0` | Bumps the npm_and_yarn group with 5 updates in the /vite-react-template directory: | Package | From | To | | --- | --- | --- | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.56.0` | `4.59.1` | | [hono](https://github.com/honojs/hono) | `4.11.1` | `4.12.7` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` | | [rollup](https://github.com/rollup/rollup) | `4.53.5` | `4.59.0` | | [undici](https://github.com/nodejs/undici) | `5.29.0` | `7.18.2` | Bumps the npm_and_yarn group with 2 updates in the /worker-publisher-template directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) and [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 2 updates in the /workers-builds-notifications-template directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) and [rollup](https://github.com/rollup/rollup). Bumps the npm_and_yarn group with 3 updates in the /workers-for-platforms-template directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler), [esbuild](https://github.com/evanw/esbuild) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 3 updates in the /workflows-starter-template directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler), [minimatch](https://github.com/isaacs/minimatch) and [rollup](https://github.com/rollup/rollup). Bumps the npm_and_yarn group with 8 updates in the /x402-proxy-template directory: | Package | From | To | | --- | --- | --- | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.56.0` | `4.59.1` | | [hono](https://github.com/honojs/hono) | `4.11.1` | `4.12.7` | | [axios](https://github.com/axios/axios) | `1.13.2` | `1.13.6` | | [bn.js](https://github.com/indutny/bn.js) | `5.2.2` | `5.2.3` | | [h3](https://github.com/h3js/h3) | `1.15.4` | `1.15.6` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` | | [undici](https://github.com/nodejs/undici) | `5.29.0` | `7.18.2` | Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `hono` from 4.11.1 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.1...v4.12.7) Updates `undici` from 5.29.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.18.2) Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `hono` from 4.11.1 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.1...v4.12.7) Updates `react-router` from 7.9.6 to 7.12.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `rollup` from 4.53.5 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.53.5...v4.59.0) Updates `undici` from 5.29.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.18.2) Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `hono` from 4.11.1 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.1...v4.12.7) Updates `react-router` from 7.9.6 to 7.12.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `rollup` from 4.53.5 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.53.5...v4.59.0) Updates `undici` from 5.29.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.18.2) Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `devalue` from 5.6.2 to 5.6.3 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.6.2...v5.6.3) Updates `diff` from 5.2.0 to 5.2.2 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `rollup` from 4.55.1 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.53.5...v4.59.0) Updates `svgo` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.0...v4.0.1) Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `undici` from 5.29.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.18.2) Updates `wrangler` from 3.114.15 to 3.114.17 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `vite` from 5.4.14 to 5.4.21 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `diff` from 5.2.0 to 5.2.2 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `qs` from 6.14.0 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.2) Updates `rollup` from 4.53.5 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.53.5...v4.59.0) Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `hono` from 4.11.1 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.1...v4.12.7) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `rollup` from 4.53.5 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.53.5...v4.59.0) Updates `undici` from 5.29.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.18.2) Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `undici` from 5.29.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.18.2) Updates `wrangler` from 4.58.0 to 4.72.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `rollup` from 4.55.1 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.53.5...v4.59.0) Updates `wrangler` from 3.114.16 to 3.114.17 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `esbuild` from 0.17.6 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.17.6...v0.27.3) Updates `hono` from 4.11.3 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.1...v4.12.7) Updates `wrangler` from 4.56.0 to 4.72.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `rollup` from 4.53.5 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.53.5...v4.59.0) Updates `wrangler` from 4.56.0 to 4.59.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.59.1/packages/wrangler) Updates `hono` from 4.11.1 to 4.12.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.1...v4.12.7) Updates `axios` from 1.13.2 to 1.13.6 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.2...v1.13.6) Updates `bn.js` from 5.2.2 to 5.2.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.2...v5.2.3) Updates `h3` from 1.15.4 to 1.15.6 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/v1.15.6/CHANGELOG.md) - [Commits](h3js/h3@v1.15.4...v1.15.6) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `undici` from 5.29.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.18.2) --- updated-dependencies: - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.12.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.12.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.6.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 5.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 3.114.17 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 5.4.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 5.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.72.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 3.114.17 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.72.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 4.59.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 5.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: h3 dependency-version: 1.15.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 12 directories with 16 updates#3

Bump the npm_and_yarn group across 12 directories with 16 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/openauth-template/npm_and_yarn-34234306bf

dependabot Bot commented on behalf of github Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

URL `/a/b/c`	HTTP pathname	`request` pathname`
Document	`/a/b/c`	`/a/b/c` ✅
Data	`/a/b/c.data`	`/a/b/c` ✅

URL `/a/b/c/`	HTTP pathname	`request` pathname`
Document	`/a/b/c/`	`/a/b/c/` ✅
Data	`/a/b/c.data`	`/a/b/c` ⚠️

Conversation

dependabot Bot commented on behalf of github Mar 11, 2026

v4.12.7

Security hardening

v4.12.6

What's Changed

New Contributors

v4.12.5

What's Changed

New Contributors

v4.12.4

Security fixes

SSE Control Field Injection

Cookie Attribute Injection in setCookie()

v7.18.2

⚠️ Security Release

What's Changed

v7.18.1

What's Changed

v7.18.0

What's Changed

v7.17.0

What's Changed

v4.12.7

Security hardening

v4.12.6

What's Changed

New Contributors

v4.12.5

What's Changed

New Contributors

v4.12.4

Security fixes

SSE Control Field Injection

Cookie Attribute Injection in setCookie()

v7.12.0

v7.11.0

v7.10.1

v7.10.0

7.12.0

Minor Changes

Patch Changes

v4.59.0

4.59.0

Features

Pull Requests

v4.58.0

4.58.0

Features

Pull Requests

v4.57.1

4.57.1

Bug Fixes

Pull Requests

4.59.0

Features

Pull Requests

4.58.0

Features

Pull Requests

4.57.1

Bug Fixes

Pull Requests

v7.18.2

⚠️ Security Release

What's Changed

v7.18.1

What's Changed

v7.18.0

What's Changed

v7.17.0

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

Cookie Attribute Injection in `setCookie()`

Cookie Attribute Injection in `setCookie()`