Skip to content

Bump @hono/node-server and promptfoo in /evals - #99

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/evals/multi-54528524f8
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/evals/multi-54528524f8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps @hono/node-server to 2.1.5 and updates ancestor dependency promptfoo. These dependencies need to be updated together.

Updates @hono/node-server from 2.1.1 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • d57ed9b 2.1.4
  • 92b014c chore: allow hono v5 as a peer dependency (#406)
  • 720ac78 2.1.3
  • 9821792 Merge commit from fork
  • 35bca95 2.1.2
  • 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
  • fe7467c test(request): accept asynchronous body read errors (#403)
  • Additional commits viewable in compare view

Updates promptfoo from 0.124.1 to 0.125.1

Release notes

Sourced from promptfoo's releases.

0.125.1

0.125.1 (2026-10-25)

Bug Fixes

0.125.0

0.125.0 (2026-10-23)

⚠ BREAKING CHANGES

  • deps: make jks-js an optional peer dependency (#11739)
  • providers: make Claude Agent and Codex SDKs opt-in (#11134)

Features

  • add provider-only environment overrides (#11889) (2eed6e1)
  • assertions: add rouge-l and rouge-s assertion types (#10256) (6842fc3)
  • assertions: filter trace spans by attributes (#10648) (faf08b4)
  • assertions: optional Unicode normalization for equals and contains (#10555) (92ae1ec)
  • eval: add safe mode to disable inline JavaScript execution (#11382) (80a27b6)
  • eval: disclose cache-hit rows in the eval summary (#11329) (3635a03)
  • eval: report stability across repeated tests (#11416) (3f7bfa7)
  • examples: add local Hermeneutic wording assertion (#10663) (636d59e)
  • providers: add Daybreak access program config (#11737) (8f873ce)
  • providers: add portable OpenAI config schemas (#11746) (3d6cdf2)
  • providers: add templated request metadata for a2a provider (#10242) (f86c893)
  • providers: support current Gemini media models (#11581) (f511091)
  • redteam: add arabic-presentation-forms static encoding strategy (#11404) (ce7adab)

Bug Fixes

  • accounting: ignore malformed optional token usage (#10112) (4f3b359)
  • app: simplify navigation and refresh the local UI (#11740) (bbe73b5)
  • assertions: honor the not- prefix for tool-call validity assertions (#11488) (f5b1d39)
  • assertions: isolate cached answer relevance samples (#11628) (a98f031)
  • assertions: match actual required XML elements (#11669) (6c3ffc5)
  • assertions: preserve custom reason in not-javascript GradingResult inversion (#10880) (62cbfee)
  • assertions: reject non-finite similarity calculations (#11627) (895bbe4)
  • bound telemetry request lifetime (#11536) (04ab6fb)
  • cache: honor disabled caching across package copies (#10793) (1b256fe)
  • ci: refresh code scan action before OIDC expires (#11717) (7fd37b7)
  • ci: secure code-scan action releases (#10108) (b5d6b20)
  • cli: expose MCP errors and remove simulated tests (#11676) (0044799)
  • code-scan: explain empty scan results instead of bare "No files to scan" (#11543) (0864873)
  • config: remove the default configuration cache (#11166) (90c4a7a)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.125.1 (2026-10-25)

Bug Fixes

0.125.0 (2026-10-23)

⚠ BREAKING CHANGES

  • deps: make jks-js an optional peer dependency (#11739)
  • providers: make Claude Agent and Codex SDKs opt-in (#11134)

Features

  • add provider-only environment overrides (#11889) (2eed6e1)
  • assertions: add rouge-l and rouge-s assertion types (#10256) (6842fc3)
  • assertions: filter trace spans by attributes (#10648) (faf08b4)
  • assertions: optional Unicode normalization for equals and contains (#10555) (92ae1ec)
  • eval: add safe mode to disable inline JavaScript execution (#11382) (80a27b6)
  • eval: disclose cache-hit rows in the eval summary (#11329) (3635a03)
  • eval: report stability across repeated tests (#11416) (3f7bfa7)
  • examples: add local Hermeneutic wording assertion (#10663) (636d59e)
  • providers: add Daybreak access program config (#11737) (8f873ce)
  • providers: add portable OpenAI config schemas (#11746) (3d6cdf2)
  • providers: add templated request metadata for a2a provider (#10242) (f86c893)
  • providers: support current Gemini media models (#11581) (f511091)
  • redteam: add arabic-presentation-forms static encoding strategy (#11404) (ce7adab)

Bug Fixes

  • accounting: ignore malformed optional token usage (#10112) (4f3b359)
  • app: simplify navigation and refresh the local UI (#11740) (bbe73b5)
  • assertions: honor the not- prefix for tool-call validity assertions (#11488) (f5b1d39)
  • assertions: isolate cached answer relevance samples (#11628) (a98f031)
  • assertions: match actual required XML elements (#11669) (6c3ffc5)
  • assertions: preserve custom reason in not-javascript GradingResult inversion (#10880) (62cbfee)
  • assertions: reject non-finite similarity calculations (#11627) (895bbe4)
  • bound telemetry request lifetime (#11536) (04ab6fb)
  • cache: honor disabled caching across package copies (#10793) (1b256fe)
  • ci: refresh code scan action before OIDC expires (#11717) (7fd37b7)
  • ci: secure code-scan action releases (#10108) (b5d6b20)
  • cli: expose MCP errors and remove simulated tests (#11676) (0044799)
  • code-scan: explain empty scan results instead of bare "No files to scan" (#11543) (0864873)
  • config: remove the default configuration cache (#11166) (90c4a7a)
  • config: scope runtime environment defaults (#11091) (fb50526)
  • correct provider billing, configuration, and JUnit output (#11060) (c09adb3)
  • csv: parse similar:cosine/dot/euclidean assertion types from CSV (#11365) (eb07d64)
  • dataset: gracefully extract personas from varied JSON responses during dataset synthesis (#11293) (#11298) (2310a94)
  • deps: align Storybook and update Mermaid/KaTeX (#11914) (03844fb)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@hono/node-server](https://github.com/honojs/node-server) to 2.1.5 and updates ancestor dependency [promptfoo](https://github.com/promptfoo/promptfoo). These dependencies need to be updated together.


Updates `@hono/node-server` from 2.1.1 to 2.1.5
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.5)

Updates `promptfoo` from 0.124.1 to 0.125.1
- [Release notes](https://github.com/promptfoo/promptfoo/releases)
- [Changelog](https://github.com/promptfoo/promptfoo/blob/main/CHANGELOG.md)
- [Commits](promptfoo/promptfoo@0.124.1...0.125.1)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.5
  dependency-type: indirect
- dependency-name: promptfoo
  dependency-version: 0.125.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants