Bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #1787 · modelcontextprotocol/csharp-sdk

dependabot · 2026-08-04T01:28:57Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
@hono/node-server	`1.19.14`	`2.0.12`
body-parser	`2.2.2`	`2.3.0`
fast-uri	`3.1.2`	`3.1.5`
hono	`4.12.18`	`4.13.0`
ip-address	`10.2.0`	`10.4.0`
undici	`7.27.2`	`7.29.0`

Updates @hono/node-server from 1.19.14 to 2.0.12

Release notes

Sourced from @hono/node-server's releases.

v2.0.12

What's Changed

test: replace supertest by @BlankParticle in honojs/node-server#379

fix(response): copy headers when init is a foreign Response by @yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

test: use a custom helper for path traversal tests by @BlankParticle in honojs/node-server#377

perf(request): fast-path QUERY methods by @usualoma in honojs/node-server#376

perf(request): fast-path PATCH method by @yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

fix(websocket): polyfill missing ErrorEvent global by @otnc in honojs/node-server#371

fix(serve-static): correct Range header parsing edge cases by @otnc in honojs/node-server#372

fix: recover complete request bodies after client disconnect by @usualoma in honojs/node-server#375

New Contributors

@otnc made their first contribution in honojs/node-server#371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

What's Changed

ci(release): add --no-git-checks option for pnpm stage publish by @yusukebe in honojs/node-server#369

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.7

What's Changed

... (truncated)

Commits

a813b6c 2.0.12
caf48ba fix(response): copy headers when init is a foreign Response (#382)
3b1dd68 test: replace supertest (#379)
834e54f 2.0.11
ba72bcd perf(request): fast-path PATCH method (#380)
962baa4 perf(request): fast-path QUERY methods (#376)
62284d6 test: use a custom helper for path traversal tests (#377)
7c1457e 2.0.10
3a21938 Merge commit from fork
9842021 2.0.9
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#681

build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in expressjs/body-parser#682

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/body-parser#683

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#685

build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @dependabot[bot] in expressjs/body-parser#684

perf(urlencoded): move empty-body guard to avoid extra function closure by @Phillip9587 in expressjs/body-parser#647

Improve ESM compatibility by @Phillip9587 in expressjs/body-parser#697

docs: add recommendations for configuring payload limits by @bjohansebas in expressjs/body-parser#699

build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in expressjs/body-parser#701

build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @dependabot[bot] in expressjs/body-parser#702

build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in expressjs/body-parser#700

chore: add explicit type commonjs to package.json by @Phillip9587 in expressjs/body-parser#711

deps: update dependencies to latest versions by @Phillip9587 in expressjs/body-parser#708

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in expressjs/body-parser#712

build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in expressjs/body-parser#713

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#714

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#698

build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in expressjs/body-parser#719

build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in expressjs/body-parser#718

build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in expressjs/body-parser#717

perf: eliminate conditional check in json strict mode hot path by @Phillip9587 in expressjs/body-parser#651

ci: add node.js 26 to text matrix by @Phillip9587 in expressjs/body-parser#726

build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in expressjs/body-parser#725

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/body-parser#724

build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in expressjs/body-parser#723

Upgrade "content-type" by @blakeembrey in expressjs/body-parser#728

refactor: switch to const/let and enable eslint no-var rule by @Phillip9587 in expressjs/body-parser#729

Update outdated reference to MDN docs by @krzysdz in expressjs/body-parser#730

build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @dependabot[bot] in expressjs/body-parser#731

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/body-parser#732

chore: updated deps to latest by @Phillip9587 in expressjs/body-parser#733

2.3.0 by @UlisesGascon in expressjs/body-parser#735

New Contributors

@krzysdz made their first contribution in expressjs/body-parser#730

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

Security fix for GHSA-v422-hmwv-36x6

fix: use static exports instead of lazy getters to improve ESM compatibility

feat: add subpath exports for individual parsers

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

deps:

content-type@^2.0.0

http-errors@^2.0.1

iconv-lite^0.7.2

qs@^6.15.2

raw-body@^3.0.2

type-is@^2.1.0

Commits

d0f2ace 2.3.0 (#735)
7d03f2f chore: updated deps to latest (#733)
8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
ff0f6b9 docs: update outdated reference to MDN docs (#730)
14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
37f36a2 deps: update content-type and type-is (#728)
e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates hono from 4.12.18 to 4.13.0

Release notes

Sourced from hono's releases.

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup

ping — GET / 165.83 ns 163.99 ns 1.01x

query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x

json — GET /user 528.99 ns 422.44 ns 1.25x

body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

perf(context): iterate the header record with for..in honojs/hono#5118

perf(url): replace regex tests with indexOf honojs/hono#5121

perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122

perf(urls): refactor tryDecodeURIComponent honojs/hono#5158

perf(request): allocate #validatedData lazily honojs/hono#5175

perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():
const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})
Thanks @shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

... (truncated)

Commits

192768f 4.13.0
b0c2d90 Merge pull request #5154 from honojs/next
8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
3feb355 fix(jsx): allow a function component to return an array (#5179)
5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
30277ae feat(jwt,jwk): add a configurable WWW-Authenticate realm (#5141)
1f707c5 feat(middleware): add method-not-allowed middleware (#5132)
2df0b47 feat(jsx): add React-compatible overloads to useRef (#5063)
3bc96ba feat(cache): add first-class support for QUERY requests (#5119)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates ip-address from 10.2.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

fbb8db2 10.4.0
45a2b11 Validate the byte arrays Address6 is given (#217)
bac8810 Keep the package loadable on node 12, and enforce it (#216)
9b3d848 Add a security policy and a README section on security posture
e84a7b3 Order the README API reference Address4, Address6, AddressError
015160b Collapse each class in the README API reference
34061a8 Pin checkout and setup-node to commits in the release job
c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
e0ef048 Replace CircleCI with GitHub Actions
5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates undici from 7.27.2 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.

GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

... (truncated)

Commits

9e38fc1 Bumped v7.29.0 (#5590)
d887e34 fix: validate coerced header values for CRLF (#5579)
33928bc fix: validate blob body content type
98011a8 fix(cache): harden cache directive parsing
4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
1b5a531 fix(retry): reject partial content length mismatch
466e99d test: cover crash on mixed unqualified and qualified private cache directives
9f10f1e fix: handle empty qualified private cache directive
3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
f9eba0a Bumped v7.28.0 (#5430)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `2.0.12` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [hono](https://github.com/honojs/hono) | `4.12.18` | `4.13.0` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.4.0` | | [undici](https://github.com/nodejs/undici) | `7.27.2` | `7.29.0` | Updates `@hono/node-server` from 1.19.14 to 2.0.12 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v2.0.12) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `hono` from 4.12.18 to 4.13.0 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.13.0) Updates `ip-address` from 10.2.0 to 10.4.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0) Updates `undici` from 7.27.2 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.27.2...v7.29.0) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.0.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 4, 2026

jeffhandley approved these changes Aug 4, 2026

View reviewed changes

jeffhandley merged commit ce0cf91 into main Aug 4, 2026
10 checks passed

jeffhandley deleted the dependabot/npm_and_yarn/npm_and_yarn-03c02aa4a1 branch August 4, 2026 19:48

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 1 directory with 6 updates - #1787

Bump the npm_and_yarn group across 1 directory with 6 updates#1787
jeffhandley merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-03c02aa4a1

dependabot Bot commented on behalf of github Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Benchmark	v4.12	v4.13	Speedup
`ping` — `GET /`	165.83 ns	163.99 ns	1.01x
`query` — `GET /id/1?name=bun`	674.40 ns	616.99 ns	1.09x
`json` — `GET /user`	528.99 ns	422.44 ns	1.25x
`body` — `POST /json`	1.16 µs	1.00 µs	1.15x

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 4, 2026

v2.0.12

What's Changed

v2.0.11

What's Changed

v2.0.10

Security fixes

Unauthenticated memory-leak DoS via aborted WebSocket handshake

v2.0.9

What's Changed

New Contributors

v2.0.8

What's Changed

v2.0.7

What's Changed

v2.3.0

Important: Security

What's Changed

New Contributors

2.3.0 / 2026-06-15

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v4.13.0

Performance improvements

First-class QUERY method support

QUERY support across built-in middleware

v10.4.0

What's Changed

v10.3.1

v10.3.0

v10.2.2

v10.2.1

v7.29.0

⚠️ Security fixes

High severity

Medium severity

v7.28.0

⚠️ Security Release

Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant