chore(deps-dev): bump the dependencies group with 6 updates

[dependabot]

Bumps the dependencies group with 6 updates:

Package	From	To
eslint	10.9.1	10.10.0
fastify	5.12.1	5.12.3
globals	17.11.0	17.12.0
hono	4.12.34	4.13.7
mysql2	3.24.2	3.24.3
oxc-minify	0.147.0	0.148.0

Updates eslint from 10.9.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates fastify from 5.12.1 to 5.12.3

Release notes

Sourced from fastify's releases.

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

• See full diff in compare view

Updates globals from 17.11.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• See full diff in compare view

Updates hono from 4.12.34 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• Additional commits viewable in compare view

Updates mysql2 from 3.24.2 to 3.24.3

Release notes

Sourced from mysql2's releases.

v3.24.3

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Changelog

Sourced from mysql2's changelog.

3.24.3 (2026-09-01)

Bug Fixes

• typings: PoolCluster node events emit a string nodeId (#4513) (1281e1e)

Commits

• 83bda80 chore(master): release 3.24.3 (#4514)
• 6cac974 build(deps): bump lucide-react from 1.35.0 to 1.37.0 in /website (#4520)
• d3f8ceb build(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 in /website (#4519)
• 05993b1 build(deps): bump lucide-react from 1.34.0 to 1.35.0 in /website (#4518)
• 797f38e build(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 (#4517)
• f17babe build(deps-dev): bump @​biomejs/biome from 2.5.10 to 2.5.11 (#4516)
• f4099d5 build(deps-dev): bump rollup from 4.62.5 to 4.63.1 in the rollup group (#4515)
• 1281e1e fix(typings): PoolCluster node events emit a string nodeId (#4513)
• 0957ae4 build(deps-dev): bump @​types/node from 26.2.0 to 26.3.0 (#4510)
• a331feb build(deps-dev): bump @​types/node from 26.2.0 to 26.3.0 in /website (#4511)
• Additional commits viewable in compare view

Updates oxc-minify from 0.147.0 to 0.148.0

Release notes

Sourced from oxc-minify's releases.

oxc crates_v0.148.0

💥 BREAKING CHANGES

• a31567a allocator: [BREAKING] Make Allocator::cursor_ptr and data_end_ptr private (#26081) (overlookmotel)

🚀 Features

• 115955d minifier: Drop cases whose condition is statically false (#26172) (Armano)
• 784e9fa minifier: Invert !0 and !1 in place for boolean context to 1 and 0 (#26050) (Armano)
• 1e902cc minifier: Expand fold leading assignments into the var decl (#26142) (Armano)
• 3ed4f6a minifier: Expand de morgan's optimization to allow move of ! (#25930) (Armano)
• 5672585 parser: Attach all comments to nodes (#25944) (camc314)

🐛 Bug Fixes

• a3d33dd semantic: Skip body bindings in type parameters and this param (#26169) (Dunqing)
• 4adfb4c semantic: Validate chained continue labels (#26157) (camc314)
• b874f48 ecmascript: Math.round only exact half ties (#26150) (camc314)
• a625378 minifier: Coerce omitted indexOf search argument (#26149) (camc314)
• dc7398b ecmascript: Trim trailing whitespace in string to number (#26148) (camc314)
• 243b685 transformer/object-rest: Lower multiple declarators correctly (#26147) (camc314)
• dc09a3a parser: Avoid panic on escaped string export names (#26146) (camc314)
• e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
• c3dedc9 semantic: Skip function body bindings in parameters (#26099) (Dunqing)
• e74de61 transform-react: Match Babel diagnostic reporting (#26128) (Boshen)
• d5163d0 parser: Correctly classify unapplied pure annotations (#26084) (camc314)
• 8531b9b linter/plugins: Alter method for obtaining mutable Program when sending AST to JS plugins (#26077) (overlookmotel)
• 9b51658 regular_expression: Allow oversized decimal escape for Annex B (#26070) (leaysgur)
• c8de4df regular_expression: Reject oversized backreferences (#26055) (camc314)

⚡ Performance

• ac4785a diagnostics: Use fixed ANSI styles (#26130) (Boshen)
• 07a0793 packages/codegen: Flatten output in chunks (#26109) (overlookmotel)
• 487427a packages/codegen: Faster string flattening (#26108) (overlookmotel)
• 7785583 packages/codegen: Ensure indent strings are flattened (#26107) (overlookmotel)
• 0dd4db3 packages/codegen: Store mapping positions in an Int32Array (#26085) (overlookmotel)

Commits

• 894c8f9 release(crates): oxc v0.148.0 (#26198)
• 63bc313 chore(npm): update funding URL (#26066)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying idempot-js with    Cloudflare Pages

Latest commit:	85596c6
Status:	✅  Deploy successful!
Preview URL:	https://e72c1a00.idempot-js.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-depe-21bn.idempot-js.pages.dev

View logs