build(deps): Bump the dependencies group with 7 updates by dependabot[bot] · Pull Request #10 · nmerget/trupu

dependabot · 2026-05-20T06:12:09Z

Bumps the dependencies group with 7 updates:

Package	From	To
eslint	`10.3.0`	`10.4.0`
typescript-eslint	`8.59.3`	`8.59.4`
astro	`6.3.1`	`6.3.5`
@hono/node-server	`2.0.2`	`2.0.3`
hono	`4.12.18`	`4.12.21`
@types/node	`25.7.0`	`25.9.1`
tsx	`4.21.0`	`4.22.3`

Updates eslint from 10.3.0 to 10.4.0

Release notes

Sourced from eslint's releases.

v10.4.0

Features

1a45ec5 feat: check sequence expressions in for-direction (#20701) (kuldeep kumar)

450040b feat: add includeIgnoreFile() to eslint/config (#20735) (Kirk Waiblinger)

Bug Fixes

544c0c3 fix: escape code path DOT labels in debug output (#20866) (Pixel998)

6799431 fix: update dependency @eslint/config-helpers to ^0.6.0 (#20850) (renovate[bot])

f078fef fix: handle non-array deprecated rule replacements (#20825) (xbinaryx)

Documentation

7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869) (Pavel)

db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865) (Kirk Waiblinger)

9084664 docs: Update README (GitHub Actions Bot)

9cc7387 docs: Update README (GitHub Actions Bot)

3d7b548 docs: Update README (GitHub Actions Bot)

191ec3c docs: Update README (GitHub Actions Bot)

Chores

6616856 chore: upgrade knip to v6 (#20875) (Pixel998)

d13b084 ci: ensure auto-created PRs run CI (#20860) (lumir)

e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862) (dependabot[bot])

d84393d test: add unit tests for SuppressionsService.applySuppressions() (#20863) (kuldeep kumar)

24db8cb test: add tests for SuppressionsService.save() (#20802) (kuldeep kumar)

2ef0549 chore: update ecosystem plugins (#20857) (github-actions[bot])

a429791 ci: remove eslint-webpack-plugin types integration test (#20668) (Milos Djermanovic)

9e37386 chore: replace recast with range approach in code-sample-minimizer (#20682) (Copilot)

0dd1f9f test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#20845) (Francesco Trotta)

9da3c7b refactor: remove deprecated meta.language and migrate meta.dialects (#20716) (Pixel998)

2099ed1 refactor: add meta.defaultOptions to more rules, enable linting (#20800) (xbinaryx)

f1dfbc9 chore: update ecosystem plugins (#20836) (github-actions[bot])

c759413 ci: bump pnpm/action-setup from 6.0.3 to 6.0.5 (#20843) (dependabot[bot])

5b817d6 test: add unit tests for lib/shared/ast-utils (#20838) (kuldeep kumar)

1c13ae3 test: add unit tests for lib/shared/severity (#20835) (kuldeep kumar)

Commits

452c401 10.4.0
b6417e8 Build: changelog update for 10.4.0
6616856 chore: upgrade knip to v6 (#20875)
d13b084 ci: ensure auto-created PRs run CI (#20860)
7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869)
e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862)
544c0c3 fix: escape code path DOT labels in debug output (#20866)
db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865)
d84393d test: add unit tests for SuppressionsService.applySuppressions() (#20863)
9084664 docs: Update README
Additional commits viewable in compare view

Updates typescript-eslint from 8.59.3 to 8.59.4

Release notes

Sourced from typescript-eslint's releases.

v8.59.4

8.59.4 (2026-05-18)

🩹 Fixes

eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#12294)

project-service: throw error cause in getParsedConfigFileFromTSServer (#12321)

typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

Evyatar Daud @StyleShit

Kirk Waiblinger @kirkwaiblinger

lumir

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.59.4 (2026-05-18)

🩹 Fixes

typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

ca6ca14 chore(release): publish 8.59.4
4b927c6 fix(typescript-eslint): export Compatible* types from typescript-eslint to re...
See full diff in compare view

Updates astro from 6.3.1 to 6.3.5

Release notes

Sourced from astro's releases.

astro@6.3.5

Patch Changes

#16771 07c8805 Thanks @ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).

#16593 50924ce Thanks @yanthomasdev! - Improves error messages with more consistent and correct writing.

#16757 5d661cd Thanks @astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

astro@6.3.4

Patch Changes
#16723 0f10bfe Thanks @matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file
export default defineConfig({
  experimental: {
    advancedRouting: {
      fetchFile: 'fetch.ts',
    },
  },
});
#16723 0f10bfe Thanks @matthewp! - Fixes Hono cache() middleware to follow the standard wrapper pattern
#16723 0f10bfe Thanks @matthewp! - Adds App.Providers interface for typing custom context providers on Astro and ctx
declare namespace App {
  interface Providers {
    oauth: import('./lib/oauth').OAuthSession;
  }
}
#16723 0f10bfe Thanks @matthewp! - Adds FetchState.response property, set automatically after pages() or middleware() completes
const response = await middleware(state, (s) => pages(s));
console.log(state.response === response); // true
#16723 0f10bfe Thanks @matthewp! - Adds Fetchable type export for typing the advanced routing entrypoint

... (truncated)

Changelog

Sourced from astro's changelog.

6.3.5

Patch Changes

#16771 07c8805 Thanks @ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).

#16593 50924ce Thanks @yanthomasdev! - Improves error messages with more consistent and correct writing.

#16757 5d661cd Thanks @astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

6.3.4

Patch Changes
#16723 0f10bfe Thanks @matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file
export default defineConfig({
  experimental: {
    advancedRouting: {
      fetchFile: 'fetch.ts',
    },
  },
});
#16723 0f10bfe Thanks @matthewp! - Fixes Hono cache() middleware to follow the standard wrapper pattern
#16723 0f10bfe Thanks @matthewp! - Adds App.Providers interface for typing custom context providers on Astro and ctx
declare namespace App {
  interface Providers {
    oauth: import('./lib/oauth').OAuthSession;
  }
}
#16723 0f10bfe Thanks @matthewp! - Adds FetchState.response property, set automatically after pages() or middleware() completes
const response = await middleware(state, (s) => pages(s));
console.log(state.response === response); // true
#16723 0f10bfe Thanks @matthewp! - Adds Fetchable type export for typing the advanced routing entrypoint

... (truncated)

Commits

5b4122e [ci] release (#16772)
5d661cd Fix dev server serving stale content for files outside project root (#16757)
be5ad21 [ci] format
50924ce Overhaul errors for consistency and correctness (#16593)
23c0bda [ci] format
07c8805 fix: position prop with CSP (#16771)
45b7fa9 [ci] release (#16742)
67a1016 [ci] format
0f10bfe feat: advanced routing types and config gaps (#16723)
904d19a Fix actions and server islands in dev mode with prerendered catch-all routes ...
Additional commits viewable in compare view

Updates @hono/node-server from 2.0.2 to 2.0.3

Release notes

Sourced from @hono/node-server's releases.

v2.0.3

What's Changed

chore(ci): update GitHub Actions versions by @BlankParticle in honojs/node-server#352

docs: Align the ServeStaticOptions comment with the current spec by @kakkokari-gtyih in honojs/node-server#356

fix: preserve headers mutated after raw Response construction by @abdulmunimjemal in honojs/node-server#357

New Contributors

@kakkokari-gtyih made their first contribution in honojs/node-server#356

@abdulmunimjemal made their first contribution in honojs/node-server#357

Full Changelog: honojs/node-server@v2.0.2...v2.0.3

Commits

9d87987 2.0.3
9463250 fix: preserve headers mutated after raw Response construction (#357)
cee5e81 docs: Align the ServeStaticOption command with the current specification (#...
4aa0650 chore(ci): update GitHub Actions versions (#352)
See full diff in compare view

Updates hono from 4.12.18 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

fix(route): preserve the base path of the mounted route() app by @usualoma in honojs/hono#4942

fix(jsx): widen jsx and jsxFn children to Child[] by @ashunar0 in honojs/hono#4947

New Contributors

@ashunar0 made their first contribution in honojs/hono#4947

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

ci: pin GitHub Actions to SHAs by @yusukebe in honojs/hono#4932

fix(serveStatic): make options parameter optional in all adapters by @mixelburg in honojs/hono#4934

fix(cookie): return the first cookie when there are multiple cookies with the same name by @usualoma in honojs/hono#4922

feat(bearer-auth): make bearerAuth generic for typed context in verifyToken by @justinnais in honojs/hono#4913

feat(cache): key cache entries by configured vary headers by @usualoma in honojs/hono#4915

feat(request): add bytes() by @yusukebe in honojs/hono#4921

fix(stream): upgrade @hono/node-server to v2 and fix abort handling by @yusukebe in honojs/hono#4940

New Contributors

@justinnais made their first contribution in honojs/hono#4913

Full Changelog: honojs/hono@v4.12.18...v4.12.19

Commits

a83ddb8 4.12.21
6cbb025 Merge commit from fork
c831020 Merge commit from fork
905aedb Merge commit from fork
5463db2 Merge commit from fork
c657a39 4.12.20
eb2d0c2 fix(jsx): widen jsx and jsxFn children to Child[] (#4947)
dcabbec fix(route): preserve the base path of the mounted route() app (#4942)
7e62bcd 4.12.19
e2f252a fix(stream): upgrade @hono/node-server to v2 and fix abort handling (#4940)
Additional commits viewable in compare view

Updates @types/node from 25.7.0 to 25.9.1

Commits

See full diff in compare view

Updates tsx from 4.21.0 to 4.22.3

Release notes

Sourced from tsx's releases.

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

decode typed loader source (dce02fc)

preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

npm package (@latest dist-tag)

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

preserve CJS JSON require in ESM hooks (35b700b)

preserve named exports from CommonJS TypeScript (11de737)

support module.exports require(esm) interop (cf8f199)

This release is also available on:

npm package (@latest dist-tag)

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

resolve tsconfig path aliases containing a colon (#780) (6979f28)

This release is also available on:

npm package (@latest dist-tag)

v4.22.0

4.22.0 (2026-05-14)

Features

upgrade esbuild to 0.28 (#789) (b29f6ee)

This release is also available on:

npm package (@latest dist-tag)

... (truncated)

Commits

dce02fc fix: decode typed loader source
68f72f3 fix: preserve entrypoint with TypeScript preload hooks
69455cf test: cover package exports for ambiguous ESM reexports
35b700b fix: preserve CJS JSON require in ESM hooks
ef807db chore: update testing dependencies
3917090 test: document compatibility test taxonomy
de8113f refactor: centralize Node capability facts
c1f62db test: consolidate tsconfig path edge coverage
4e08174 test: consolidate loader hook coverage
674bb30 test: consolidate tsImport commonjs mts coverage
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 7 updates: | Package | From | To | | --- | --- | --- | | [eslint](https://github.com/eslint/eslint) | `10.3.0` | `10.4.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.59.3` | `8.59.4` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.1` | `6.3.5` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.0.2` | `2.0.3` | | [hono](https://github.com/honojs/hono) | `4.12.18` | `4.12.21` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.7.0` | `25.9.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.3` | Updates `eslint` from 10.3.0 to 10.4.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.3.0...v10.4.0) Updates `typescript-eslint` from 8.59.3 to 8.59.4 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.4/packages/typescript-eslint) Updates `astro` from 6.3.1 to 6.3.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.3.5/packages/astro) Updates `@hono/node-server` from 2.0.2 to 2.0.3 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.0.2...v2.0.3) Updates `hono` from 4.12.18 to 4.12.21 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.21) Updates `@types/node` from 25.7.0 to 25.9.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `tsx` from 4.21.0 to 4.22.3 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.22.3) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: typescript-eslint dependency-version: 8.59.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: astro dependency-version: 6.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@hono/node-server" dependency-version: 2.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: hono dependency-version: 4.12.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 25.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: tsx dependency-version: 4.22.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-27T03:47:21Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 20, 2026

github-actions Bot enabled auto-merge (squash) May 20, 2026 06:12

dependabot Bot closed this May 27, 2026

auto-merge was automatically disabled May 27, 2026 03:47
Pull request was closed

dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-571b036482 branch May 27, 2026 03:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump the dependencies group with 7 updates#10

build(deps): Bump the dependencies group with 7 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-571b036482

dependabot Bot commented on behalf of github May 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.4.0

Features

Bug Fixes

Documentation

Chores

v8.59.4

8.59.4 (2026-05-18)

🩹 Fixes

❤️ Thank You

8.59.4 (2026-05-18)

🩹 Fixes

❤️ Thank You

astro@6.3.5

Patch Changes

astro@6.3.4

Patch Changes

6.3.5

Patch Changes

6.3.4

Patch Changes

v2.0.3

What's Changed

New Contributors

v4.12.21

Security fixes

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

IP Restriction bypasses static deny rules for non-canonical IPv6

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

JWT middleware accepts any Authorization scheme, not only Bearer

v4.12.20

What's Changed

New Contributors

v4.12.19

What's Changed

New Contributors

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

v4.22.0

4.22.0 (2026-05-14)

Features

Uh oh!

dependabot Bot commented on behalf of github May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 20, 2026 •

edited

Loading