chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 12 updates by dependabot[bot] · Pull Request #152 · middleapi/standard-server

dependabot · 2026-10-10T01:14:29Z

Bumps the dev-dependencies-minor-patch group with 12 updates in the / directory:

Package	From	To
@hono/node-server	`2.1.1`	`2.1.4`
@types/node	`26.4.1`	`26.6.4`
fastify	`5.12.1`	`5.12.5`
h3	`2.0.1-rc.26`	`2.0.2`
pkg-pr-new	`0.0.87`	`0.0.91`
ws	`8.21.3`	`8.22.0`
@types/ws	`8.18.1`	`8.18.2`
@types/aws-lambda	`8.10.163`	`8.10.164`
@fastify/cookie	`11.1.2`	`11.1.3`
supertest	`7.2.2`	`7.3.1`
tsx	`4.23.13`	`4.23.15`
@types/bun	`1.4.0`	`1.4.2`

Updates @hono/node-server from 2.1.1 to 2.1.4

Release notes

Sourced from @hono/node-server's releases.

v2.1.4

What's Changed

chore: allow hono v5 as a peer dependency by @yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

ci: add autofix.ci by @yusukebe in honojs/node-server#392

fix: type error in early hints and add typecheck to CI by @BlankParticle in honojs/node-server#390

chore: add better benchmarks by @BlankParticle in honojs/node-server#391

docs(readme): update the benchmark by @yusukebe in honojs/node-server#394

test(request): accept asynchronous body read errors by @usualoma in honojs/node-server#403

fix(listener): avoid mutating response headers when setting Content-Length by @usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits

d57ed9b 2.1.4
92b014c chore: allow hono v5 as a peer dependency (#406)
720ac78 2.1.3
9821792 Merge commit from fork
35bca95 2.1.2
90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
fe7467c test(request): accept asynchronous body read errors (#403)
64dc09e docs(readm): update the benchmark (#394)
8f505ae chore: add better benchmarks (#391)
2469b1a fix: type error in early hints and add typecheck to CI (#390)
Additional commits viewable in compare view

Updates @types/node from 26.4.1 to 26.6.4

Commits

See full diff in compare view

Updates fastify from 5.12.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

[Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in fastify/fastify#7019

[Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

Fix for GHSA-9q9j-q6p8-xq58

Fix for GHSA-hwr6-493r-vm6h

Fix for GHSA-p68q-wchp-6fh7

Fix for GHSA-667r-xxjv-c9mm

What's Changed

[Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in fastify/fastify#6973

[Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

ba235fd Bumped v5.12.5
ad06a4c Merge commit from fork
7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
1690e35 Bumped v5.12.4
1c991c4 Bumped v5.12.3
942a2be Bumped v5.12.2
853f6e2 test(validation): cover normalization and async branches
f02d8d4 fix(validation): do not unwrap async validator results
93c239a fix: reject malformed URLs before custom 404 handlers
Additional commits viewable in compare view

Updates h3 from 2.0.1-rc.26 to 2.0.2

Release notes

Sourced from h3's releases.

v2.0.2

compare changes

🩹 Fixes

node: Call onError for stream errors in Node.js handlers (#1571)

response: Use matching reason phrases in redirect and noContent (#1570)

middleware: Pass through handled responses in onError (#1574)

🌊 Types

session: Remove @ts-nocheck from iron-crypto (#1572)

route: Infer defineRoute handler input from validation schemas (ec527f0)

🏡 Chore

session: Retarget legacy seal fallback removal to v3 (#1573)

session: Mark legacySealFallback as deprecated (44dbfb8)

❤️ Contributors

Pooya Parsa (@pi0)

Bao Nguyen (@giaBaoJS)

Kaan Çelebi (@kaanisthatyou)

Daniel Shafer (@dannyshafer)

v2.0.1

H3 v2 is now stable! 🎉

[!NOTE] A full release article is coming soon on the H3 blog.

H3 v2 is a full rewrite on top of web standards (Request, Response, URL, Headers). It stays compatible with most v1 utilities and is faster and smaller than v1.

👉 Get started: https://h3.dev/guide 👉 Upgrading from v1: https://h3.dev/migration

Highlights

🌐 Web standards first: Handlers receive event.req (a standard Request) and event.url, and set response headers through event.res. Return any value (string, object, Response, stream, Blob, ...) and H3 converts it to a Response.

🚀 Runs everywhere: The same app runs on Node.js, Bun, Deno, Cloudflare Workers, Service Workers and browsers. srvx provides a universal server layer, and event.req.runtime gives access to runtime-specific details when needed.

⚡ Fast and small: Routing uses rou3 v1, and the core is a fraction of v1's bundle size. Every handler can be called directly with handler.fetch().

🧩 Middleware and plugins: Onion-style (event, next) middleware, built-in helpers (onRequest, onResponse, onError, basicAuth, bodyLimit, ...) and reusable definePlugin() extensions.

🔒 Type safety: Typed handlers, responses and errors (HTTPError), plus validated handlers and body/query/params validation with any Standard Schema library.

📏 Route rules (h3/rules): Add headers, redirects, CORS, caching and proxying to groups of routes with one config object. See the Route Rules guide.

🧰 Built-in utilities: Cookies (including chunked), sessions, CORS, proxy, static files, cache headers, SSE, WebSockets via crossws, JSON-RPC/MCP helpers and an h3/tracing plugin. See https://h3.dev/utils.

Requirements

Node.js >= 20.19 (if you run on Node.js)

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.2

compare changes

🩹 Fixes

node: Call onError for stream errors in Node.js handlers (#1571)

response: Use matching reason phrases in redirect and noContent (#1570)

middleware: Pass through handled responses in onError (#1574)

📖 Documentation

Add v2 blog article (9adeeee)

🌊 Types

session: Remove @ts-nocheck from iron-crypto (#1572)

route: Infer defineRoute handler input from validation schemas (ec527f0)

🏡 Chore

session: Retarget legacy seal fallback removal to v3 (#1573)

session: Mark legacySealFallback as deprecated (44dbfb8)

Update deps (ac79e5f)

Update release script (07d7d2c)

❤️ Contributors

Pooya Parsa (@pi0)

Pi0x x@pi0.io

Bao Nguyen (@giaBaoJS)

Kaan Çelebi (@kaanisthatyou)

Daniel Shafer (@dannyshafer)

v2.0.1-rc.33

compare changes

🚀 Enhancements

rules: Skip redirect when the request is already at the target (#1559)

🩹 Fixes

cookie: Include partitioned in the distinct-cookie key (#1553)

sse: Preserve buffered events during overlapping flushes (#1555)

static: Set vary header when a single encoding is accepted (#1556)

static: Honor q-values and case in accept-encoding (#1560)

mime: Add .mjs and .cjs to COMMON_MIME_TYPES (#1566)

rules: Normalize rule keys like routes and tighten the shape guard (7cbf21c)

... (truncated)

Commits

66cfb8a chore(release): v2.0.2
07d7d2c chore: update release script
ac79e5f chore: update deps
44dbfb8 chore(session): mark legacySealFallback as deprecated
ec527f0 types(route): infer defineRoute handler input from validation schemas
b52a9e7 fix(middleware): pass through handled responses in onError (#1574)
403bd02 fix(response): use matching reason phrases in redirect and noContent (#1570)
bca3a8e fix(node): call onError for stream errors in Node.js handlers (#1571)
fb34b0f types(session): remove @ts-nocheck from iron-crypto (#1572)
024b278 chore(session): retarget legacy seal fallback removal to v3 (#1573)
Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.87 to 0.0.91

Commits

3cf47a1 release: v0.0.91
62357c7 release: v0.0.90
4ac7860 release: v0.0.89
b594954 release: v0.0.88
See full diff in compare view

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

Introduced the protocols option (8b918b01).

Bug fixes

Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

297202c [dist] 8.22.0
8b918b0 [feature] Introduce the protocols option
73e03eb [ci] Update actions/setup-node action to v7
d9b8954 [fix] Change the ready state after validating the arguments (#2337)
See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

See full diff in compare view

Updates @types/aws-lambda from 8.10.163 to 8.10.164

Commits

See full diff in compare view

Updates @fastify/cookie from 11.1.2 to 11.1.3

Release notes

Sourced from @fastify/cookie's releases.

v11.1.3

What's Changed

ci: pin actions to commit-hash by @Fdawgs in fastify/fastify-cookie#364

chore: bump c8 from 11.0.0 to 12.0.0 by @dependabot[bot] in fastify/fastify-cookie#365

docs: fix signed cookie request examples by @mdiniz97 in fastify/fastify-cookie#366

chore(.npmrc): add min-release-age by @Fdawgs in fastify/fastify-cookie#367

chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in fastify/fastify-cookie#369

chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in fastify/fastify-cookie#368

ci: enable trusted publishing releases by @Puppo in fastify/fastify-cookie#378

New Contributors

@mdiniz97 made their first contribution in fastify/fastify-cookie#366

@Puppo made their first contribution in fastify/fastify-cookie#378

Full Changelog: fastify/fastify-cookie@v11.1.2...v11.1.3

Commits

576e0dd Bumped v11.1.3
19a1307 ci: enable trusted publishing releases
104aca7 chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#368)
c838334 chore: bump fastify/workflows/.github/workflows/lock-threads.yml (#369)
916538c chore(.npmrc): add min-release-age
0c569e6 docs: fix signed cookie request examples (#366)
56d895f chore: bump c8 from 11.0.0 to 12.0.0 (#365)
fb92235 ci: pin actions to commit-hash
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @fastify/cookie since your current version.

Updates supertest from 7.2.2 to 7.3.1

Release notes

Sourced from supertest's releases.

v7.3.1

Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind 884cd26

fix: bind ephemeral server to the loopback address it connects to e74a1e0

forwardemail/supertest@v7.3.0...v7.3.1

v7.3.0

fix: stabilize ephemeral server requests and assertions 71dc5fb

Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd8535d99 3b5ba5c

Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2.3.2 c3419b2

Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1 7e409db

Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expansion-1.1.21 b55a7f9

Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslist-4.29.0 7a5deaa

Merge pull request #900 from forwardemail/dependabot/npm_and_yarn/fast-uri-3.1.8 a75f6ee

Merge pull request #901 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.15.2 c2cb33e

Merge pull request #896 from pnookala-godaddy/codex/ephemeral-loopback-bind 7fb34e7

chore(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 c357584

chore(deps-dev): bump browserslist from 4.25.1 to 4.29.0 2a01b57

chore(deps-dev): bump fast-uri from 3.0.6 to 3.1.8 343394d

chore(deps-dev): bump brace-expansion from 1.1.12 to 1.1.21 6b203e9

Merge pull request #881 from forwardemail/dependabot/npm_and_yarn/qs-6.14.2 d40ca7e

fix: match ephemeral server address family b6f5995

chore(deps-dev): bump lodash from 4.17.21 to 4.18.1 81766ca

chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 985ac7c

chore(deps): bump minimatch 58baa5f

chore(deps): bump qs from 6.14.1 to 6.14.2 c406e82

forwardemail/supertest@v7.2.2...v7.3.0

Commits

3634bdd 7.3.1
884cd26 Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind
e74a1e0 fix: bind ephemeral server to the loopback address it connects to
a3f5cb8 7.3.0
71dc5fb fix: stabilize ephemeral server requests and assertions
3b5ba5c Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd85...
c3419b2 Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2...
7e409db Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1
b55a7f9 Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expan...
7a5deaa Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslis...
Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

exclude bare builtins from namespace inheritance (38e1588)

expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)

make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

npm package (@latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

npm package (@latest dist-tag)

Commits

ca66105 test: fix drive-less file URLs in ESM resolver fixtures
2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
38e1588 fix: exclude bare builtins from namespace inheritance
562c434 fix: make namespaced register() overloads portable for declaration emit
edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
70e7828 test: upgrade tinyspy for disposable API
9ed2022 ci: avoid duplicate release notifications
872e77f refactor: use disposables for cleanup
6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
See full diff in compare view

Updates @types/bun from 1.4.0 to 1.4.2

Commits

See full diff in compare view

pkg-pr-new · 2026-10-10T01:15:02Z

@standard-server/aws-lambda

npm i https://pkg.pr.new/@standard-server/aws-lambda@152

@standard-server/core

npm i https://pkg.pr.new/@standard-server/core@152

@standard-server/fastify

npm i https://pkg.pr.new/@standard-server/fastify@152

@standard-server/fetch

npm i https://pkg.pr.new/@standard-server/fetch@152

@standard-server/node

npm i https://pkg.pr.new/@standard-server/node@152

@standard-server/peer

npm i https://pkg.pr.new/@standard-server/peer@152

@standard-server/shared

npm i https://pkg.pr.new/@standard-server/shared@152

commit: f8e2c07

codecov · 2026-10-10T01:15:45Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

codspeed · 2026-10-10T01:16:10Z

Merging this PR will not alter performance

⚠️

4 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

json 10KB

octet stream 10KB

form data 10KB

json 10KB

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

_{Comparing dependabot/npm_and_yarn/dev-dependencies-minor-patch-06aca7604d (f8e2c07) with main (177f457)}

108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

… directory with 12 updates Bumps the dev-dependencies-minor-patch group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.1.1` | `2.1.4` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.4` | | [fastify](https://github.com/fastify/fastify) | `5.12.1` | `5.12.5` | | [h3](https://github.com/h3js/h3) | `2.0.1-rc.26` | `2.0.2` | | [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.87` | `0.0.91` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [@types/aws-lambda](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/aws-lambda) | `8.10.163` | `8.10.164` | | [@fastify/cookie](https://github.com/fastify/fastify-cookie) | `11.1.2` | `11.1.3` | | [supertest](https://github.com/ladjs/supertest) | `7.2.2` | `7.3.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.0` | `1.4.2` | Updates `@hono/node-server` from 2.1.1 to 2.1.4 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.1.1...v2.1.4) Updates `@types/node` from 26.4.1 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `fastify` from 5.12.1 to 5.12.5 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.1...v5.12.5) Updates `h3` from 2.0.1-rc.26 to 2.0.2 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/main/CHANGELOG.md) - [Commits](h3js/h3@v2.0.1-rc.26...v2.0.2) Updates `pkg-pr-new` from 0.0.87 to 0.0.91 - [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.91/packages/cli) Updates `ws` from 8.21.3 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.0) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `@types/aws-lambda` from 8.10.163 to 8.10.164 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/aws-lambda) Updates `@fastify/cookie` from 11.1.2 to 11.1.3 - [Release notes](https://github.com/fastify/fastify-cookie/releases) - [Commits](fastify/fastify-cookie@v11.1.2...v11.1.3) Updates `supertest` from 7.2.2 to 7.3.1 - [Release notes](https://github.com/ladjs/supertest/releases) - [Commits](forwardemail/supertest@v7.2.2...v7.3.1) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `@types/bun` from 1.4.0 to 1.4.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) --- updated-dependencies: - dependency-name: "@fastify/cookie" dependency-version: 11.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@hono/node-server" dependency-version: 2.1.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/aws-lambda" dependency-version: 8.10.164 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/bun" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: fastify dependency-version: 5.12.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: h3 dependency-version: 2.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: pkg-pr-new dependency-version: 0.0.91 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: supertest dependency-version: 7.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 10, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-minor-patch-06aca7604d branch from 05fca38 to f8e2c07 Compare October 10, 2026 02:46

dinwwwh approved these changes Oct 11, 2026

View reviewed changes

dinwwwh merged commit e28c5e3 into main Oct 11, 2026
10 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-minor-patch-06aca7604d branch October 11, 2026 00:53

Navigation Menu

Repository navigation

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 12 updates - #152

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 12 updates#152
dinwwwh merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-minor-patch-06aca7604d

dependabot Bot commented on behalf of github Oct 10, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 10, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 10, 2026

Uh oh!

codspeed Bot commented Oct 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.1.4

What's Changed

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

v2.1.2

What's Changed

v5.12.5

⚠️ Security release

What's Changed

v5.12.4

v5.12.2

⚠️ Security release

What's Changed

v2.0.2

🩹 Fixes

🌊 Types

🏡 Chore

❤️ Contributors

v2.0.1

Highlights

Requirements

v2.0.2

🩹 Fixes

📖 Documentation

🌊 Types

🏡 Chore

❤️ Contributors

v2.0.1-rc.33

🚀 Enhancements

🩹 Fixes

8.22.0

Features

Bug fixes

v11.1.3

What's Changed

New Contributors

v7.3.1

v7.3.0

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

Uh oh!

pkg-pr-new Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Oct 10, 2026

Codecov Report

Uh oh!

codspeed Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 10, 2026 •

edited

Loading

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

pkg-pr-new Bot commented Oct 10, 2026 •

edited

Loading

codspeed Bot commented Oct 10, 2026 •

edited

Loading