Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates - #4059

Merged
ChronosSF merged 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-83a9cf5799
Nov 10, 2026
Merged

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates#4059
ChronosSF merged 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-83a9cf5799

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
dompurify 3.4.14 3.4.17
@modelcontextprotocol/sdk 1.30.0 1.32.2
hono 4.13.5 4.13.17
proxy-addr 2.0.7 2.0.8
source-map-js 1.2.1 1.2.2

Updates dompurify from 3.4.14 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies

DOMPurify 3.4.16

  • Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
  • Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
  • Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
  • Migrated from rollup to rolldown because performance, thanks @​ssi02014
  • Bumped several dependencies where possible

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible
Commits

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

... (truncated)

Commits
  • 3b73021 chore: bump version to 1.32.2 (#3089)
  • fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
  • 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.17

Release notes

Sourced from hono's releases.

v4.13.17

What's Changed

  • fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in honojs/hono#5608
  • fix(utils/url): do not match a query key across separators in honojs/hono#5607
  • fix(etag,pretty-json): cancel the discarded response body in honojs/hono#5606
  • fix(client): detect the JSON media type with whitespace before a parameter in honojs/hono#5609
  • fix(timing): honor a precision of 0 in setMetric in honojs/hono#5363
  • fix(utils/mime,ssg): match media types case-insensitively in honojs/hono#5449
  • fix(timing): escape double quotes and backslashes in Server-Timing descriptions in honojs/hono#5478
  • fix(etag): preserve commas within quoted entity tags in honojs/hono#5353
  • fix(accepts): preserve exact media type quality over subtype wildcards in honojs/hono#5427
  • fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in honojs/hono#5611
  • fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in honojs/hono#5430
  • fix(ssg): do not reuse created directories across toSSG runs in honojs/hono#5381
  • fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in honojs/hono#5483
  • fix(jsx): escape element and object attribute values in honojs/hono#5512
  • fix(jsx): do not render ref objects as attributes in honojs/hono#5615
  • fix(factory): keep independent return types for nine handlers in honojs/hono#5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

... (truncated)

Commits
  • 61f7c59 4.13.17
  • 1534ffa fix(factory): keep independent return types for nine handlers (#5618)
  • eb754bd fix(jsx): do not render ref objects as attributes (#5615)
  • 6cbe361 fix(jsx): escape element and object attribute values (#5512)
  • 8b7f9e9 fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events (#...
  • 7852e0a fix(ssg): do not reuse created directories across toSSG runs (#5381)
  • bcfd02b fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary (#5430)
  • 456fe46 fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in C...
  • 98b35af fix(accepts): preserve exact media type quality over subtype wildcards (#5427)
  • b3f1272 fix(etag): preserve commas within quoted entity tags (#5353)
  • Additional commits viewable in compare view

Updates proxy-addr from 2.0.7 to 2.0.8

Release notes

Sourced from proxy-addr's releases.

2.0.8

Important

What's Changed

New Contributors

Full Changelog: jshttp/proxy-addr@v2.0.7...v2.0.8

Changelog

Sourced from proxy-addr's changelog.

2.0.8

Commits
  • a11ad82 2.0.8 (#70)
  • 780911d fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix
  • 92e103e fix(ci): use publised as release trigger event (#71)
  • 3e5ac75 ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)
  • 4b9db81 chore(ci): npm-publish via workflows (#54)
  • 655e895 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)
  • 50ce4d0 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)
  • 0fd347f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)
  • 6a517fa build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)
  • 0d45e2a Fix "arugment" typo in README (#61)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.


Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Changelog

Sourced from source-map-js's changelog.

1.2.2

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-83a9cf5799 branch from 02e5aa2 to 689238d Compare October 28, 2026 15:21
@kdinev

kdinev commented Nov 9, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 5 up…
2b85c23 
…dates

Bumps the npm_and_yarn group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.14` | `3.4.17` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.2` |
| [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.17` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |



Updates `dompurify` from 3.4.14 to 3.4.17
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.14...3.4.17)

Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.2
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.2)

Updates `hono` from 4.13.5 to 4.13.17
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.5...v4.13.17)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.4.17
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: indirect
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-83a9cf5799 branch from 689238d to 2b85c23 Compare November 9, 2026 14:14
@ChronosSF
ChronosSF merged commit 9bb8ee3 into master Nov 10, 2026
4 checks passed
@ChronosSF
ChronosSF deleted the dependabot/npm_and_yarn/npm_and_yarn-83a9cf5799 branch November 10, 2026 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChronosSF ChronosSF ChronosSF approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kdinev @ChronosSF