chore(deps): Bump the production-dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #57 · scheemunai/agent-artifacts

dependabot · 2026-09-28T06:23:49Z

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
@hono/zod-openapi	`1.6.1`	`1.6.3`
drizzle-orm	`0.45.2`	`0.45.3`
hono	`4.13.5`	`4.13.9`
marked	`18.0.11`	`18.0.14`
satori	`0.33.4`	`0.33.5`
stripe	`22.6.0`	`22.6.2`
zod	`4.4.3`	`4.6.5`

Updates @hono/zod-openapi from 1.6.1 to 1.6.3

Release notes

Sourced from @hono/zod-openapi's releases.

@hono/zod-openapi@1.6.3

Patch Changes

#2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

@hono/zod-openapi@1.6.2

Patch Changes

#2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

#2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

#1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

Changelog

Sourced from @hono/zod-openapi's changelog.

1.6.3

Patch Changes

#2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

1.6.2

Patch Changes

#2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

#2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

#1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

Commits

bc7d9e6 Version Packages (#2123)
3b08600 fix(zod-openapi): return 415 for request bodies with undeclared content type ...
b125de5 Version Packages (#2121)
28f1d39 fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler (#...
525564d perf(zod-openapi): Flatten batched route schemas (#2115)
38232db perf(zod-openapi): Reuse route response projections (#2116)
See full diff in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3 New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.9

Release notes

Sourced from hono's releases.

v4.13.9

What's Changed

fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380

fix(accepts): match media types and language tags case-insensitively in honojs/hono#5376

fix(linear-router): don't match an empty path segment as a param in honojs/hono#5373

fix(pretty-json): don't break responses with unparseable JSON bodies in honojs/hono#5377

fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in honojs/hono#5379

fix(aws-lambda): treat binary +xml archive media types as binary in honojs/hono#5424

fix(aws-lambda): preserve empty query parameters in honojs/hono#5292

fix(lambda-edge): sync content type detection with aws-lambda in honojs/hono#5426

fix(lambda-edge): fail with a descriptive error on a malformed event in honojs/hono#5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

What's Changed

docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343

perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340

fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351

fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311

fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349

fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357

fix(request): keep the request media type when reusing a cached body in honojs/hono#5366

docs(combine): fix except() JSDoc param and add missing @returns in honojs/hono#5346

perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

7c3b0df 4.13.9
6cadf75 fix(lambda-edge): fail with a descriptive error on a malformed event (#5358)
de310ac fix(lambda-edge): sync content type detection with aws-lambda (#5426)
28e8572 fix(aws-lambda): preserve empty query parameters (#5292)
0d86899 fix(aws-lambda): treat binary +xml archive media types as binary (#5424)
52febbc fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url (#5...
f950277 fix(pretty-json): don't break responses with unparseable JSON bodies (#5377)
00ee875 fix(linear-router): don't match an empty path segment as a param (#5373)
f5a5346 fix(accepts): match media types and language tags case-insensitively (#5376)
cb5bea3 fix(jsx): replace Suspense and ErrorBoundary content across newlines (#5380)
Additional commits viewable in compare view

Updates marked from 18.0.11 to 18.0.14

Release notes

Sourced from marked's releases.

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

allow indented lines in setext heading text (#4095) (7d05530)

decode numeric character references in text (#4076) (cead8de)

keep text after empty nested blockquote (#4101) (1b89557), closes #4098

preserve internal tabs in list item content (#4086) (e136da7)

strip whitespace when normalizing link reference labels (#4091) (c7ee43a)

support GFM protocol autolinks (#4067) (7f7a496)

v18.0.13

18.0.13 (2026-09-12)

Bug Fixes

allow tabs in the thematic break that ends a list item (#4087) (afbb27c)

avoid O(n^2) scanning in reflinkSearch (#4090) (c6a25bb)

case fold reference link labels (#4077) (aed9336)

drop the leading whitespace after a hard line break (#4075) (123ce04)

match html block start conditions when ending a list item (#4072) (c2facac)

respect raw tokens when closing link labels (#4066) (ef394f7)

strip a tab that follows spaces in an indented code block (#4080) (dbb393d)

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

allow a tab before the closing sequence of an ATX heading (#4084) (4417582)

allow one more level of nested brackets in a link label (#4064) (37b28d8)

do not add a newline to an empty code block (#4073) (23b1706)

escape character references in autolink destinations (#4053) (8f432f0)

reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)

reject invalid characters in HTML tag names (#4083) (300bb1d)

remove up to the fence indentation from each content line (#4074) (0244f08)

Commits

ef0704c chore(release): 18.0.14 [skip ci]
23c82ad chore: update deps (#4108)
1b89557 fix: keep text after empty nested blockquote (#4101)
7f7a496 fix: support GFM protocol autolinks (#4067)
5196d98 docs: add commonmark and gfm as versions in demo (#4094)
de2320a docs: add marked-gitlab to known extensions (#4092)
7d05530 fix: allow indented lines in setext heading text (#4095)
c7ee43a fix: strip whitespace when normalizing link reference labels (#4091)
cead8de fix: decode numeric character references in text (#4076)
e136da7 fix: preserve internal tabs in list item content (#4086)
Additional commits viewable in compare view

Updates satori from 0.33.4 to 0.33.5

Release notes

Sourced from satori's releases.

0.33.5

0.33.5 (2026-09-22)

Bug Fixes

Harden SVG serialization (#814) (26a52af)

Commits

26a52af fix: Harden SVG serialization (#814)
499436f chore: Replace playground Monaco editor with sugar-high (#803)
See full diff in compare view

Updates stripe from 22.6.0 to 22.6.2

Release notes

Sourced from stripe's releases.

v22.6.2

#2841 Validate that webhook secrets are non-empty

See the changelog for more details.

v22.6.1

#2831 Use cryptographically secure boundaries for multipart file uploads

#2836 update OtherString docstring

#2835 Fix request coercion for GET and DELETE parameters

Fixes serialization of schema-coerced values, including Decimal, in GET and DELETE query parameters.

#2829 Harden API requestor code against malicious URLs

See the changelog for more details.

Changelog

Sourced from stripe's changelog.

22.6.2 - 2026-09-09

#2841 Validate that webhook secrets are non-empty

22.6.1 - 2026-09-09

#2829 Harden API requestor code against malicious URLs

#2835 Fix request coercion for GET and DELETE parameters

Fixes serialization of schema-coerced values, including Decimal, in GET and DELETE query parameters.

#2836 update OtherString docstring

#2831 Use cryptographically secure boundaries for multipart file uploads

Commits

d9d0927 Bump version to 22.6.2
a7baa7e Validate that webhook secrets are non-empty (#2841)
b64815c Print npm HTTP logs in the publish job when debug logging is on (#2838)
998f558 Restore the NODE_AUTH_TOKEN placeholder in the publish job (#2837)
9f82c46 Bump version to 22.6.1
d157b22 Use cryptographically secure boundaries for multipart file uploads (#2831)
6b2a81c update OtherString docstring (#2836)
b4a248e Fix request coercion for GET and DELETE parameters 🪿✨ (#2835)
56ff49e Harden API requestor code against malicious URLs (#2829)
edca154 Add open vs closed enum section to README (#2811)
Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

0c483c58 docs: the Zod 4.6 announcement post (#6546)

a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577

dd9c36fa fix(v4): defer recursive object index inference (#6580)

3b154992 feat(lang): add Tajik (tg) locale (#6581) by @ismoil77

2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.
npm install zod@latest
At a glance:

... (truncated)

Commits

59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
0f3f5ee 4.6.5
cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
743aedb 4.6.4
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 7 updates Bumps the production-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/zod-openapi](https://github.com/honojs/middleware/tree/HEAD/packages/zod-openapi) | `1.6.1` | `1.6.3` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.2` | `0.45.3` | | [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.9` | | [marked](https://github.com/markedjs/marked) | `18.0.11` | `18.0.14` | | [satori](https://github.com/vercel/satori) | `0.33.4` | `0.33.5` | | [stripe](https://github.com/stripe/stripe-node) | `22.6.0` | `22.6.2` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.5` | Updates `@hono/zod-openapi` from 1.6.1 to 1.6.3 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-openapi/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/zod-openapi@1.6.3/packages/zod-openapi) Updates `drizzle-orm` from 0.45.2 to 0.45.3 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.45.2...0.45.3) Updates `hono` from 4.13.5 to 4.13.9 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.5...v4.13.9) Updates `marked` from 18.0.11 to 18.0.14 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.0.11...v18.0.14) Updates `satori` from 0.33.4 to 0.33.5 - [Release notes](https://github.com/vercel/satori/releases) - [Commits](vercel/satori@0.33.4...0.33.5) Updates `stripe` from 22.6.0 to 22.6.2 - [Release notes](https://github.com/stripe/stripe-node/releases) - [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-node@v22.6.0...v22.6.2) Updates `zod` from 4.4.3 to 4.6.5 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.5) --- updated-dependencies: - dependency-name: "@hono/zod-openapi" dependency-version: 1.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: drizzle-orm dependency-version: 0.45.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: hono dependency-version: 4.13.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: marked dependency-version: 18.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: satori dependency-version: 0.33.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: stripe dependency-version: 22.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: zod dependency-version: 4.6.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-05T06:22:31Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 28, 2026

dependabot Bot closed this Oct 5, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-bd6e32d890 branch October 5, 2026 06:22

Navigation Menu

Repository navigation

chore(deps): Bump the production-dependencies group across 1 directory with 7 updates - #57

chore(deps): Bump the production-dependencies group across 1 directory with 7 updates#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-bd6e32d890

dependabot Bot commented on behalf of github Sep 28, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​hono/zod-openapi@​1.6.3

Patch Changes

@​hono/zod-openapi@​1.6.2

Patch Changes

1.6.3

Patch Changes

1.6.2

Patch Changes

0.45.3

New Netlify DB Driver

v4.13.9

What's Changed

v4.13.8

What's Changed

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

v18.0.13

18.0.13 (2026-09-12)

Bug Fixes

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

0.33.5

0.33.5 (2026-09-22)

Bug Fixes

v22.6.2

v22.6.1

22.6.2 - 2026-09-09

22.6.1 - 2026-09-09

v4.6.5

Commits:

v4.6.4

v4.6.3

v4.6.2

v4.6.1

v4.6.0

Uh oh!

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 28, 2026 •

edited

Loading

`@hono/zod-openapi@1`.6.3

`@hono/zod-openapi@1`.6.2

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS