chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #4589 · modelcontextprotocol/servers

dependabot · 2026-07-29T22:04:43Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
@hono/node-server	`1.19.14`	`2.0.12`
body-parser	`2.2.2`	`2.3.0`
brace-expansion	`5.0.6`	`5.0.8`
fast-uri	`3.1.2`	`3.1.4`
hono	`4.12.25`	`4.12.32`
postcss	`8.5.15`	`8.5.25`

Updates @hono/node-server from 1.19.14 to 2.0.12

Release notes

Sourced from @hono/node-server's releases.

v2.0.12

What's Changed

test: replace supertest by @BlankParticle in honojs/node-server#379

fix(response): copy headers when init is a foreign Response by @yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

test: use a custom helper for path traversal tests by @BlankParticle in honojs/node-server#377

perf(request): fast-path QUERY methods by @usualoma in honojs/node-server#376

perf(request): fast-path PATCH method by @yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

fix(websocket): polyfill missing ErrorEvent global by @otnc in honojs/node-server#371

fix(serve-static): correct Range header parsing edge cases by @otnc in honojs/node-server#372

fix: recover complete request bodies after client disconnect by @usualoma in honojs/node-server#375

New Contributors

@otnc made their first contribution in honojs/node-server#371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

v2.0.8

What's Changed

ci(release): add --no-git-checks option for pnpm stage publish by @yusukebe in honojs/node-server#369

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

v2.0.7

What's Changed

... (truncated)

Commits

a813b6c 2.0.12
caf48ba fix(response): copy headers when init is a foreign Response (#382)
3b1dd68 test: replace supertest (#379)
834e54f 2.0.11
ba72bcd perf(request): fast-path PATCH method (#380)
962baa4 perf(request): fast-path QUERY methods (#376)
62284d6 test: use a custom helper for path traversal tests (#377)
7c1457e 2.0.10
3a21938 Merge commit from fork
9842021 2.0.9
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#681

build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in expressjs/body-parser#682

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/body-parser#683

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#685

build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @dependabot[bot] in expressjs/body-parser#684

perf(urlencoded): move empty-body guard to avoid extra function closure by @Phillip9587 in expressjs/body-parser#647

Improve ESM compatibility by @Phillip9587 in expressjs/body-parser#697

docs: add recommendations for configuring payload limits by @bjohansebas in expressjs/body-parser#699

build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in expressjs/body-parser#701

build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @dependabot[bot] in expressjs/body-parser#702

build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in expressjs/body-parser#700

chore: add explicit type commonjs to package.json by @Phillip9587 in expressjs/body-parser#711

deps: update dependencies to latest versions by @Phillip9587 in expressjs/body-parser#708

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in expressjs/body-parser#712

build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in expressjs/body-parser#713

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#714

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#698

build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in expressjs/body-parser#719

build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in expressjs/body-parser#718

build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in expressjs/body-parser#717

perf: eliminate conditional check in json strict mode hot path by @Phillip9587 in expressjs/body-parser#651

ci: add node.js 26 to text matrix by @Phillip9587 in expressjs/body-parser#726

build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in expressjs/body-parser#725

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/body-parser#724

build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in expressjs/body-parser#723

Upgrade "content-type" by @blakeembrey in expressjs/body-parser#728

refactor: switch to const/let and enable eslint no-var rule by @Phillip9587 in expressjs/body-parser#729

Update outdated reference to MDN docs by @krzysdz in expressjs/body-parser#730

build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @dependabot[bot] in expressjs/body-parser#731

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/body-parser#732

chore: updated deps to latest by @Phillip9587 in expressjs/body-parser#733

2.3.0 by @UlisesGascon in expressjs/body-parser#735

New Contributors

@krzysdz made their first contribution in expressjs/body-parser#730

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

Security fix for GHSA-v422-hmwv-36x6

fix: use static exports instead of lazy getters to improve ESM compatibility

feat: add subpath exports for individual parsers

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

deps:

content-type@^2.0.0

http-errors@^2.0.1

iconv-lite^0.7.2

qs@^6.15.2

raw-body@^3.0.2

type-is@^2.1.0

Commits

d0f2ace 2.3.0 (#735)
7d03f2f chore: updated deps to latest (#733)
8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
ff0f6b9 docs: update outdated reference to MDN docs (#730)
14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
37f36a2 deps: update content-type and type-is (#728)
e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
Additional commits viewable in compare view

Updates brace-expansion from 5.0.6 to 5.0.8

Commits

96a63c0 5.0.8
a1bd339 Merge commit from fork
592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
5bf809e Remove Node.js 18 support (#110)
8cb5716 Bump markdown-it from 14.1.0 to 14.2.0 (#113)
43122df Bump sigstore from 4.1.0 to 4.1.1 (#119)
69bd65a Bump @sigstore/verify from 3.1.0 to 3.1.1 (#118)
b3bfbf0 Bump @sigstore/core from 3.1.0 to 3.2.1 (#117)
Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates hono from 4.12.25 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

test(context): assert case-insensitive header names in response helpers by @yusukebe in honojs/hono#5116

chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in honojs/hono#5117

refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in honojs/hono#5130

fix(utils/body): reuse cached formData in parseBody() by @yusukebe in honojs/hono#5131

fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in honojs/hono#5133

fix(sse): emit retry feild when retry is 0 by @yusukebe in honojs/hono#5135

test(validator): fix misspelled identifier in transform type test by @yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

chore(benchmark/routers): bump deps in honojs/hono#5107

chore(benchmark): remove not used benchmarks in honojs/hono#5108

chore: update to ts6 in prep for ts7 in honojs/hono#5104

fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025

fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020

fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096

fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in honojs/hono#5092

chore: fix no-op tsc in test script by @yusukebe in honojs/hono#5093

fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in honojs/hono#5094

docs(language): add JSDoc @example to languageDetector by @codebybilal18 in honojs/hono#5081

test(workerd): add compatibilityDate by @yusukebe in honojs/hono#5100

fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in honojs/hono#5099

fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in honojs/hono#5101

fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in honojs/hono#5103

fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in honojs/hono#5102

fix(etag): treat If-None-Match: * as a match by @yusukebe in honojs/hono#5084

New Contributors

@codebybilal18 made their first contribution in honojs/hono#5081

... (truncated)

Commits

26d8e42 4.12.32
402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
bf8608c ci: enable reports for type & bundle size check (#5148)
cadff88 4.12.31
64c613a test(validator): fix misspelled identifier in transform type test (#5136)
aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates postcss from 8.5.15 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `2.0.12` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.6` | `5.0.8` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.4` | | [hono](https://github.com/honojs/hono) | `4.12.25` | `4.12.32` | | [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.25` | Updates `@hono/node-server` from 1.19.14 to 2.0.12 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v2.0.12) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `brace-expansion` from 5.0.6 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.6...v5.0.8) Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) Updates `hono` from 4.12.25 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.12.32) Updates `postcss` from 8.5.15 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.25) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.0.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.32 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 29, 2026

localden enabled auto-merge July 29, 2026 22:06

localden disabled auto-merge July 29, 2026 22:06

localden merged commit 7112282 into main Jul 29, 2026
33 checks passed

localden deleted the dependabot/npm_and_yarn/npm_and_yarn-49aacb125d branch July 29, 2026 22:06

Navigation Menu

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates - #4589

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates#4589
localden merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-49aacb125d

dependabot Bot commented on behalf of github Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 29, 2026

v2.0.12

What's Changed

v2.0.11

What's Changed

v2.0.10

Security fixes

Unauthenticated memory-leak DoS via aborted WebSocket handshake

v2.0.9

What's Changed

New Contributors

v2.0.8

What's Changed

v2.0.7

What's Changed

v2.3.0

Important: Security

What's Changed

New Contributors

2.3.0 / 2026-06-15

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v4.12.32

What's Changed

v4.12.31

What's Changed

v4.12.30

What's Changed

v4.12.29

What's Changed

New Contributors

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant