Skip to content

Bump the npm_and_yarn group across 6 directories with 11 updates#448

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-bf732750ec
Open

Bump the npm_and_yarn group across 6 directories with 11 updates#448
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-bf732750ec

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 19, 2026

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
glob 11.0.1 12.0.0
zx 8.3.0 8.8.5
axios 0.28.0 0.30.3
@modelcontextprotocol/sdk 1.25.1 1.26.0
js-yaml 4.1.0 4.1.1
pnpm 9.15.4 10.28.2
next 15.1.6 16.1.6
@trpc/server 10.45.2 10.45.3

Bumps the npm_and_yarn group with 1 update in the /activities-examples directory: axios.
Bumps the npm_and_yarn group with 1 update in the /expense directory: axios.
Bumps the npm_and_yarn group with 3 updates in the /food-delivery directory: pnpm, next and @trpc/server.
Bumps the npm_and_yarn group with 1 update in the /patching-api directory: axios.
Bumps the npm_and_yarn group with 1 update in the /timer-examples directory: axios.

Updates glob from 11.0.1 to 12.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

  • Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
  • Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
  • Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

  • Drop support for node before v20

10.4

  • Add includeChildMatches: false option
  • Export the Ignore class

10.3

  • Add --default -p flag to provide a default pattern
  • exclude symbolic links to directories when follow and nodir are both set

10.2

  • Add glob cli

10.1

  • Return '.' instead of the empty string '' when the current working directory is returned as a match.
  • Add posix: true option to return / delimited paths, even on

... (truncated)

Commits
  • 2b03cca 12.0.0
  • d56203d prettier config
  • bb521e5 Remove --shell option where unsafe to use
  • 2551fb5 11.1.0
  • 47473c0 bin: Do not expose filenames to shell expansion
  • bc33fe1 skip tilde test on systems that lack tilde expansion
  • 59bf9ca fix notes
  • dde4fa6 docs(README): add #anchor and improve notes
  • 0559b0e docs: add better links to path-scurry docs
  • c9773c2 fix: correct typos in README.md
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates zx from 8.3.0 to 8.8.5

Release notes

Sourced from zx's releases.

8.8.5 — Temporary Reservoir

This release fixes the issue, when zx flushes external node_modules on linking #1348 #1349 #1355

Also globby@15.0.0 arrives here.

8.8.4 — Flange Coupling

It's time. This release updates zx internals to make the ps API and related methods ProcessPromise.kill(), kill() work on Windows systems without wmic. #1344 webpod/ps#15

  1. WMIC will be missing in Windows 11 25H2 (kernel >= 26000)
  2. The windows-latest label in GitHub Actions will migrate from Windows Server 2022 to Windows Server 2025 beginning September 2, 2025 and finishing by September 30, 2025.

https://github.blog/changelog/2025-07-31-github-actions-new-apis-and-windows-latest-migration-notice/#windows-latest-image-label-migration

8.8.3 — Sealing Gasket

Continues #1339 to prevent injections via Proxy input or custom toString() manipulations.

8.8.2 — Leaking Valve

Fixes potential cmd injection via kill() method for Windows platform. #1337 #1339. Affects the versions range 8.7.1...8.8.1.

8.8.1 — Turbo Flush

We keep improving the projects internal infra to bring more stability, safety and performance for artifacts.

Featfixes

  • Applied flags filtration for CLI-driven deps install #1308
  • Added kill() event logging #1312
  • Set SIGTERM as kill() fallback signal #1313
  • Allowed stdio() arg be an array #1311
const p = $({halt: true})`cmd`
p.stdio([stream, 'ignore', 'pipe'])

Enhancements

8.8.0 — Pressure Tested

This release enhances the coherence between the ProcessPromise and the Streams API, eliminating the need for certain script-level workarounds.

✨ New Features

unpipe() — Selectively stop piping

You can now call .unpipe() to stop data transfer from a source to a destination without closing any of the pair. #1302

</tr></table>

... (truncated)

Commits

Updates axios from 0.28.0 to 0.30.3

Release notes

Sourced from axios's releases.

Release notes - v0.30.3

This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).

Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.

🛡️ Security Fixes

  • Backport: Fix DoS via proto key in merge config
    • Patched a vulnerability where specifically crafted configuration objects using the proto key could cause a Denial of Service during the merge process. - by @​FeBe95 in [PR #7388](axios/axios#7388)

⚙️ Maintenance & CI

  • CI Infrastructure Update

⚠️ Breaking Changes

Configuration Merging Behavior:

As part of the security fix, Axios now restricts the merging of the proto key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.

Full Changelog: v0.30.2...v0.30.3

v0.30.2

What's Changed

New Contributors

Full Changelog: axios/axios@v0.30.1...v0.30.2

Release v0.30.1

Release notes:

Bug Fixes

Contributors to this release

Full Changelog: axios/axios@v0.30.0...v0.30.1

Release v0.30.0

Release notes:

Bug Fixes

... (truncated)

Commits
  • f53bcf6 chore: release 0.30.2
  • 3ddccd3 chore: remove publish as this wont work
  • 9ef39d0 chore: try with npm token
  • 4775de6 chore: fix version scheme
  • f96f26b chore: fix issues with using replace
  • ead45c2 chore: update the publish workflow to run on tag
  • 8119265 chore: tag version as legacy on v0.x
  • 9954985 chore: dispatch for first time
  • 3f8b70f chore: final rename
  • c665584 chore: revert naming
  • Additional commits viewable in compare view
Attestation changes

This version has no provenance attestation, while the previous version (0.28.0) was attested. Review the package versions before updating.


Updates @modelcontextprotocol/sdk from 1.25.1 to 1.26.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

v1.25.3

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.2...v1.25.3

v1.25.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.25.1...v1.25.2

Commits
  • fe9c07b chore: bump version to 1.26.0 (#1479)
  • 4f01e7e fix: add non-null assertions for optional setupServer fields in stateful test
  • a05be17 Merge commit from fork
  • 50d9fa3 Fix #1430: Client Credentials providers scopes support (backported) (#1442)
  • aa81a66 fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x back...
  • 6aba065 chore: bump v1.25.3 for backport fixes (#1412)
  • 6e8f7e1 fix: prevent Hono from overriding global Response object (v1.x) (#1411)
  • 12ae856 [v1.x backport] Use correct schema for client sampling validation when tools ...
  • b392f02 fix: prevent ReDoS in UriTemplate regex patterns (v1.x backport) (#1365)
  • a0c9b13 fix: README badges links destinations (#907)
  • Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates pnpm from 9.15.4 to 10.28.2

Release notes

Sourced from pnpm's releases.

pnpm 10.28.2

Patch Changes

  • Security fix: prevent path traversal in directories.bin field.

  • When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

    This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

    Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

  • Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.2

Patch Changes

  • Security fix: prevent path traversal in directories.bin field.

  • When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

    This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

    Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

  • Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

10.28.1

Patch Changes

  • Fixed installation of config dependencies from private registries.

    Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.

  • Fix path traversal vulnerability in binary fetcher ZIP extraction

    • Validate ZIP entry paths before extraction to prevent writing files outside target directory
    • Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
    • Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error

  • Support plain http:// and https:// URLs ending with .git as git repository dependencies.

    Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

    Changes:

    • The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
    • The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
    • Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

    Fixes #10468

  • pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.

  • Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

  • When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.

  • Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

  • Revert Try to avoid making network calls with preferOffline #10334.

  • Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.

  • Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

10.28.0

Minor Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.


Updates next from 15.1.6 to 16.1.6

Release notes

Sourced from next's releases.

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Upgrade to swc 54 (#88207)
  • implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)
  • tweak LRU sentinel key (#89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @​mischnic for helping!

v16.1.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Fix linked list bug in LRU deleteFromLru (#88652)
  • Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

v16.1.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

... (truncated)

Commits

Updates @trpc/server from 10.45.2 to 10.45.3

Release notes

Sourced from @​trpc/server's releases.

v10.45.3

Full Changelog: trpc/trpc@v10.45.2...v10.45.3

Commits

Updates hono from 4.11.1 to 4.12.0

Release notes

Sourced from hono's releases.

v4.12.0

Release Notes

Hono v4.12.0 is now available!

This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context.

$path for Hono Client

The Hono client now has a $path() method that returns the path string instead of a full URL. This is useful when you need just the path portion for routing or key-based operations:

const client = hc<typeof app>('http://localhost:8787')
// Get the path string
const path = client.api.posts.$path()
// => '/api/posts'
// With path parameters
const postPath = client.api.posts[':id'].$path({
param: { id: '123' },
})
// => '/api/posts/123'
// With query parameters
const searchPath = client.api.posts.$path({
query: { filter: 'test' },
})
// => '/api/posts?filter=test'

Unlike $url() which returns a URL object, $path() returns a plain path string, making it convenient for use with routers or as cache keys.

Thanks @​ShaMan123!

ApplyGlobalResponse Type Helper for RPC Client

The new ApplyGlobalResponse type helper allows you to add global error response types to all routes in the RPC client. This is useful for typing common error responses from app.onError() or global middlewares:

const app = new Hono()
  .get('/api/users', (c) => c.json({ users: ['alice', 'bob'] }, 200))
  .onError((err, c) => c.json({ error: err.message }, 500))
type AppWithErrors = ApplyGlobalResponse<
typeof app,
{
401: { json: { error: string; message: string } }
500: { json: { error: string; message: string } }
}
</tr></table>

... (truncated)

Commits
  • d2ed2e9 4.12.0
  • 01e78ad Merge pull request #4735 from honojs/next
  • a340a25 perf(context): use createResponseInstance for new Response (#4733)
  • bd26c31 perf(trie-router): improve performance (1.5x ~ 2.0x) (#4724)
  • b85c1e0 feat(types): Add exports field to ExecutionContext (#4719)
  • 02346c6 feat(language): add progressive locale code truncation to normalizeLanguage (...
  • 7438ab9 perf(context): add fast path to c.json() matching c.text() optimization (#4707)
  • 034223f feat(trailing-slash): add alwaysRedirect option to support wildcard routes ...
  • 16321af feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify ...
  • bf37828 feat(basic-auth): add context key and callback options (#4645)
  • Additional commits viewable in compare view

Updates vite from 5.4.14 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

Commits

Updates vm2 from 3.9.19 to 3.10.5

Release notes

Sourced from vm2's releases.

v3.10.5

What's Changed

  • fix: allow Object.setPrototypeOf on sandbox-local objects
  • fix: block Function constructor access via getOwnPropertyDescriptor
  • fix: block Function constructor from crossing bridge regardless of access path
  • fix: block all code-executing constructors from crossing bridge via property descriptors
  • fix: block Function constructor extraction via nested property descriptors
  • fix: prevent proxy unwrapping to block Function constructor extraction via Object.entries
  • fix: prevent sandbox escape via doPreventExtensions exposure in util.inspect
  • fix: prevent sandbox escape via getFactory exposure in util.inspect
  • fix: sanitize SuppressedError sub-errors to prevent sandbox escape
  • fix: block host Function constructor leak via direct handler.get() call
  • fix: block WebAssembly.JSTag to prevent wasm-level exception catch sandbox escape in Node 25

Full Changelog: patriksimek/vm2@v3.10.4...v3.10.5

v3.10.4

What's Changed

  • fix: prevent sandbox escape via Promise static method stealing
  • fix: prevent sandbox escape via Reflect.construct Promise species bypass
  • fix: prevent sandbox escape via proxy handler exposure in util.inspect
  • fix: prevent sandbox escape via fromOtherWithContext exposure in util.inspect

Full Changelog: patriksimek/vm2@v3.10.3...v3.10.4

v3.10.3

What's Changed

  • fix: prevent sandbox escape via Symbol.for cross-realm symbols
  • fix: prevent Symbol.for bypass via hasOwnProperty override
  • fix: prevent Symbol.for bypass via object key coercion
  • fix: prevent cross-realm symbol extraction via Object.getOwnPropertySymbols
  • fix: prevent cross-realm symbol extraction via spread operator on bridge proxies
  • fix: prevent sandbox escape via Promise species manipulation
  • fix: prevent Symbol.species getter TOCTOU bypass in Promise species reset
  • fix: eliminate Promise species TOCTOU by unconditional constructor override
  • fix: prevent sandbox escape via Promise.try static method stealing

Full Changelog: patriksimek/vm2@v3.10.2...v3.10.3

v3.10.2

What's Changed

Full Changelog: patriksimek/vm2@v3.10.1...v3.10.2

v3.10.1

What's Changed

... (truncated)

Commits
  • 408fc85 docs: refactor docs
  • 5706a0f chore: bump version
  • 4467d10 chore: fix test on node 25
  • 1fbdeff fix: block WebAssembly.JSTag to prevent wasm-level exception catch sandbox es...
  • f2d9cfe chore: fix tests
  • 9084cd6 fix: block host Function constructor leak via direct handler.get() call
  • 6c194d9 chore: perf optimization
  • f32590b chore: fix tests
  • a6cd917 Merge commit from fork
  • 57971fa Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vm2 since your current version.


Updates axios from 0.28.0 to 0.30.3

Release notes

Sourced from axios's releases.

Release notes - v0.30.3

This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).

Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.

🛡️ Security Fixes

  • Backport: Fix DoS via proto key in merge config
    • Patched a vulnerability where specifically crafted configuration objects using the proto key could cause a Denial of Service during the merge process. - by @​FeBe95 in [PR #7388](axios/axios#7388)

⚙️ Maintenance & CI

  • CI Infrastructure Update

⚠️ Breaking Changes

Configuration Merging Behavior:

As part of the security fix, Axios now restricts the merging of the proto key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.

Full Changelog: v0.30.2...v0.30.3

v0.30.2

What's Changed

New Contributors

Full Changelog: axios/axios@v0.30.1...v0.30.2

Release v0.30.1

Release notes:

Bug Fixes

Contributors to this release

Full Changelog: axios/axios@v0.30.0...v0.30.1

Release v0.30.0

Release notes:

<...

Description has been truncated

@dependabot
Bump the npm_and_yarn group across 6 directories with 11 updates
e802767 
Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [glob](https://github.com/isaacs/node-glob) | `11.0.1` | `12.0.0` |
| [zx](https://github.com/google/zx) | `8.3.0` | `8.8.5` |
| [axios](https://github.com/axios/axios) | `0.28.0` | `0.30.3` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.25.1` | `1.26.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) | `9.15.4` | `10.28.2` |
| [next](https://github.com/vercel/next.js) | `15.1.6` | `16.1.6` |
| [@trpc/server](https://github.com/trpc/trpc/tree/HEAD/packages/server) | `10.45.2` | `10.45.3` |

Bumps the npm_and_yarn group with 1 update in the /activities-examples directory: [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /expense directory: [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 3 updates in the /food-delivery directory: [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm), [next](https://github.com/vercel/next.js) and [@trpc/server](https://github.com/trpc/trpc/tree/HEAD/packages/server).
Bumps the npm_and_yarn group with 1 update in the /patching-api directory: [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /timer-examples directory: [axios](https://github.com/axios/axios).


Updates `glob` from 11.0.1 to 12.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.1...v12.0.0)

Updates `zx` from 8.3.0 to 8.8.5
- [Release notes](https://github.com/google/zx/releases)
- [Commits](google/zx@8.3.0...8.8.5)

Updates `axios` from 0.28.0 to 0.30.3
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.28.0...v0.30.3)

Updates `@modelcontextprotocol/sdk` from 1.25.1 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.25.1...v1.26.0)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `pnpm` from 9.15.4 to 10.28.2
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.2/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.28.2/pnpm)

Updates `next` from 15.1.6 to 16.1.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.1.6...v16.1.6)

Updates `@trpc/server` from 10.45.2 to 10.45.3
- [Release notes](https://github.com/trpc/trpc/releases)
- [Commits](https://github.com/trpc/trpc/commits/v10.45.3/packages/server)

Updates `hono` from 4.11.1 to 4.12.0
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.1...v4.12.0)

Updates `vite` from 5.4.14 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)

Updates `vm2` from 3.9.19 to 3.10.5
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Commits](patriksimek/vm2@3.9.19...v3.10.5)

Updates `axios` from 0.28.0 to 0.30.3
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.28.0...v0.30.3)

Updates `axios` from 0.28.0 to 0.30.3
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.28.0...v0.30.3)

Updates `pnpm` from 9.15.4 to 10.28.2
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.2/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.28.2/pnpm)

Updates `next` from 15.1.6 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.1.6...v16.1.6)

Updates `@trpc/server` from 10.45.2 to 10.45.3
- [Release notes](https://github.com/trpc/trpc/releases)
- [Commits](https://github.com/trpc/trpc/commits/v10.45.3/packages/server)

Updates `axios` from 0.28.0 to 0.30.3
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.28.0...v0.30.3)

Updates `axios` from 0.28.0 to 0.30.3
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.28.0...v0.30.3)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 12.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: zx
  dependency-version: 8.8.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 0.30.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: pnpm
  dependency-version: 10.28.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.1.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@trpc/server"
  dependency-version: 10.45.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 5.4.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vm2
  dependency-version: 3.10.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 0.30.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 0.30.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: pnpm
  dependency-version: 10.28.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@trpc/server"
  dependency-version: 10.45.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 0.30.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 0.30.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from a team as a code owner February 19, 2026 21:34
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

Comments