Skip to content

chore(deps): bump the dependencies group across 1 directory with 9 updates#130

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a98e48b6e6
May 19, 2026
Merged

chore(deps): bump the dependencies group across 1 directory with 9 updates#130
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a98e48b6e6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026

Bumps the dependencies group with 9 updates in the / directory:

Package From To
@types/node 25.8.0 25.9.1
@hono/node-server 2.0.2 2.0.3
hono 4.12.18 4.12.21
tsx 4.22.0 4.22.3
@base-ui/react 1.4.1 1.5.0
@eslint-react/eslint-plugin 5.7.8 5.8.2
@types/react 19.2.14 19.2.15
eslint 10.3.0 10.4.0
typescript-eslint 8.59.3 8.59.4

Updates @types/node from 25.8.0 to 25.9.1

Commits

Updates @hono/node-server from 2.0.2 to 2.0.3

Release notes

Sourced from @​hono/node-server's releases.

v2.0.3

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.2...v2.0.3

Commits
  • 9d87987 2.0.3
  • 9463250 fix: preserve headers mutated after raw Response construction (#357)
  • cee5e81 docs: Align the ServeStaticOption command with the current specification (#...
  • 4aa0650 chore(ci): update GitHub Actions versions (#352)
  • See full diff in compare view

Updates hono from 4.12.18 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.18...v4.12.19

Commits

Updates tsx from 4.22.0 to 4.22.3

Release notes

Sourced from tsx's releases.

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

  • decode typed loader source (dce02fc)
  • preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

  • preserve CJS JSON require in ESM hooks (35b700b)
  • preserve named exports from CommonJS TypeScript (11de737)
  • support module.exports require(esm) interop (cf8f199)

This release is also available on:

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

  • resolve tsconfig path aliases containing a colon (#780) (6979f28)

This release is also available on:

Commits
  • dce02fc fix: decode typed loader source
  • 68f72f3 fix: preserve entrypoint with TypeScript preload hooks
  • 69455cf test: cover package exports for ambiguous ESM reexports
  • 35b700b fix: preserve CJS JSON require in ESM hooks
  • ef807db chore: update testing dependencies
  • 3917090 test: document compatibility test taxonomy
  • de8113f refactor: centralize Node capability facts
  • c1f62db test: consolidate tsconfig path edge coverage
  • 4e08174 test: consolidate loader hook coverage
  • 674bb30 test: consolidate tsImport commonjs mts coverage
  • Additional commits viewable in compare view

Updates @base-ui/react from 1.4.1 to 1.5.0

Release notes

Sourced from @​base-ui/react's releases.

v1.5.0

General changes

  • Improve mount performance with interaction splitting, including closed popup mount performance by up to 50% and unmounting performance by up to 85% (#4661) by @​atomiks
  • Use local document for virtual arrow (#4662) by @​lyzno1
  • Fix macOS Safari and Firefox minimizing fullscreen when closing popups with Esc (#4695) by @​arturbien
  • Drop unnecessary memoization (#4693) by @​flaviendelangle
  • Do not use Math.random() in useStableCallback() (#4732) by @​michaldudak
  • Fix return focus when reference disconnects (#4655) by @​atomiks
  • Don't steal initial focus if focus already moved inside a popup (#4775) by @​stefee

Alert Dialog

Autocomplete

Checkbox

Combobox

Dialog

Drawer

Field

Form

Menu

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.5.0

May 19, 2026

General changes

  • Improve mount performance with interaction splitting, including closed popup mount performance by up to 50% and unmounting performance by up to 85% (#4661) by @​atomiks
  • Use local document for virtual arrow (#4662) by @​lyzno1
  • Fix macOS Safari and Firefox minimizing fullscreen when closing popups with Esc (#4695) by @​arturbien
  • Drop unnecessary memoization (#4693) by @​flaviendelangle
  • Do not use Math.random() in useStableCallback() (#4732) by @​michaldudak
  • Fix return focus when reference disconnects (#4655) by @​atomiks
  • Don't steal initial focus if focus already moved inside a popup (#4775) by @​stefee

Alert Dialog

Autocomplete

Checkbox

Combobox

Dialog

Drawer

Field

Form

... (truncated)

Commits

Updates @eslint-react/eslint-plugin from 5.7.8 to 5.8.2

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.8.2 (2026-05-20)

What's Changed

📝 Documentation

  • Added React 19 use hook guidance to error-boundaries, rules-of-hooks, and no-use-context docs.
  • Added migration examples and corrected rule descriptions for class-component-related rules.
  • Improved eslint-plugin-react-x rule documentation with scenario-based examples, Troubleshooting sections, and Further Reading links across 48 rule docs (#1786).
  • Removed inline ESLint error annotations (^^^) from documentation examples for better readability (#1785).
  • Updated migration guide for eslint-plugin-react with additional details.

🏗️ Internal

  • Set up textlint and fixed inappropriate wording in documentation (#1787).
  • Bumped dependencies across workspace packages (#1788).
  • Updated pnpm-lock.yaml: bumped nx to 22.7.2 and brace-expansion to 5.0.5.

Full Changelog: Rel1cx/eslint-react@v5.8.1...v5.8.2

v5.8.1 (2026-05-18)

What's Changed

📝 Documentation

  • Restructured rule documentation across all plugins from the Common Violations / Invalid / Valid format to the new Examples / scenario-based / Troubleshooting / Further Reading format (#1784).
  • Updated README tagline and description, removed the Benchmark section, and fixed migration guide links (#1783).
  • Updated website recipe docs, FAQ, and third-party plugins page (#1783).

🏗️ Internal

  • Updated scripts/scaffold-rule.ts and the rule request issue template to match the new documentation structure (#1782).

Full Changelog: Rel1cx/eslint-react@v5.8.0...v5.8.1

v5.8.0 (2026-05-17)

What's Changed

🪄 Improvements

  • react-jsx/no-children-prop, react-jsx/no-children-prop-with-children: Added support for createElement calls in addition to JSX elements (#1780).

📝 Documentation

  • Added eslint-plugin-perfectionist to the third-party plugins documentation page (#1778).

🏗️ Internal

  • Bumped import-integrity-lint to 1.0.1.
  • Fixed multiple versions of typescript-eslint and import-integrity-lint in the workspace (#1776).
  • Increased pnpm minimumReleaseAge to 3 days and updated lockfile (#1779).

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.8.2 (2026-05-20)

📝 Documentation

  • Added React 19 use hook guidance to error-boundaries, rules-of-hooks, and no-use-context docs.
  • Added migration examples and corrected rule descriptions for class-component-related rules.
  • Improved eslint-plugin-react-x rule documentation with scenario-based examples, Troubleshooting sections, and Further Reading links across 48 rule docs (#1786).
  • Removed inline ESLint error annotations (^^^) from documentation examples for better readability (#1785).
  • Updated migration guide for eslint-plugin-react with additional details.

🏗️ Internal

  • Set up textlint and fixed inappropriate wording in documentation (#1787).
  • Bumped dependencies across workspace packages (#1788).
  • Updated pnpm-lock.yaml: bumped nx to 22.7.2 and brace-expansion to 5.0.5.

Full Changelog: Rel1cx/eslint-react@v5.8.1...v5.8.2

v5.8.1 (2026-05-18)

📝 Documentation

  • Restructured rule documentation across all plugins (eslint-plugin-react-x, eslint-plugin-react-dom, eslint-plugin-react-jsx, eslint-plugin-react-web-api, eslint-plugin-react-naming-convention, eslint-plugin-react-debug, eslint-plugin-react-rsc) from the Common Violations / Invalid / Valid format to the new Examples / scenario-based / Troubleshooting / Further Reading format (#1784).
  • Updated README tagline and description, removed the Benchmark section, and fixed migration guide links (#1783).
  • Updated website recipe docs, FAQ, and third-party plugins page (#1783).

🏗️ Internal

  • Updated scripts/scaffold-rule.ts and the rule request issue template to match the new documentation structure (#1782).

Full Changelog: Rel1cx/eslint-react@v5.8.0...v5.8.1

v5.8.0 (2026-05-17)

🪄 Improvements

  • react-jsx/no-children-prop, react-jsx/no-children-prop-with-children: Added support for createElement calls in addition to JSX elements (#1780).

📝 Documentation

  • Added eslint-plugin-perfectionist to the third-party plugins documentation page (#1778).

🏗️ Internal

  • Bumped import-integrity-lint to 1.0.1.
  • Fixed multiple versions of typescript-eslint and import-integrity-lint in the workspace (#1776).
  • Increased pnpm minimumReleaseAge to 3 days and updated lockfile (#1779).
  • Removed .repos directory references from config files (#1773).
  • Removed obsolete maintenance scripts (create-spec-alignment-issues.sh, migrate-labels.sh) (#1777).
  • Replaced eslint-plugin-fast-import with import-integrity-lint (#1774).

... (truncated)

Commits

Updates @types/react from 19.2.14 to 19.2.15

Commits

Updates eslint from 10.3.0 to 10.4.0

Release notes

Sourced from eslint's releases.

v10.4.0

Features

  • 1a45ec5 feat: check sequence expressions in for-direction (#20701) (kuldeep kumar)
  • 450040b feat: add includeIgnoreFile() to eslint/config (#20735) (Kirk Waiblinger)

Bug Fixes

  • 544c0c3 fix: escape code path DOT labels in debug output (#20866) (Pixel998)
  • 6799431 fix: update dependency @​eslint/config-helpers to ^0.6.0 (#20850) (renovate[bot])
  • f078fef fix: handle non-array deprecated rule replacements (#20825) (xbinaryx)

Documentation

  • 7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869) (Pavel)
  • db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865) (Kirk Waiblinger)
  • 9084664 docs: Update README (GitHub Actions Bot)
  • 9cc7387 docs: Update README (GitHub Actions Bot)
  • 3d7b548 docs: Update README (GitHub Actions Bot)
  • 191ec3c docs: Update README (GitHub Actions Bot)

Chores

  • 6616856 chore: upgrade knip to v6 (#20875) (Pixel998)
  • d13b084 ci: ensure auto-created PRs run CI (#20860) (lumir)
  • e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862) (dependabot[bot])
  • d84393d test: add unit tests for SuppressionsService.applySuppressions() (#20863) (kuldeep kumar)
  • 24db8cb test: add tests for SuppressionsService.save() (#20802) (kuldeep kumar)
  • 2ef0549 chore: update ecosystem plugins (#20857) (github-actions[bot])
  • a429791 ci: remove eslint-webpack-plugin types integration test (#20668) (Milos Djermanovic)
  • 9e37386 chore: replace recast with range approach in code-sample-minimizer (#20682) (Copilot)
  • 0dd1f9f test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#20845) (Francesco Trotta)
  • 9da3c7b refactor: remove deprecated meta.language and migrate meta.dialects (#20716) (Pixel998)
  • 2099ed1 refactor: add meta.defaultOptions to more rules, enable linting (#20800) (xbinaryx)
  • f1dfbc9 chore: update ecosystem plugins (#20836) (github-actions[bot])
  • c759413 ci: bump pnpm/action-setup from 6.0.3 to 6.0.5 (#20843) (dependabot[bot])
  • 5b817d6 test: add unit tests for lib/shared/ast-utils (#20838) (kuldeep kumar)
  • 1c13ae3 test: add unit tests for lib/shared/severity (#20835) (kuldeep kumar)
Commits

Updates typescript-eslint from 8.59.3 to 8.59.4

Release notes

Sourced from typescript-eslint's releases.

v8.59.4

8.59.4 (2026-05-18)

🩹 Fixes

  • eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#12294)
  • project-service: throw error cause in getParsedConfigFileFromTSServer (#12321)
  • typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.59.4 (2026-05-18)

🩹 Fixes

  • typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • ca6ca14 chore(release): publish 8.59.4
  • 4b927c6 fix(typescript-eslint): export Compatible* types from typescript-eslint to re...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dependencies group across 1 directory with 9 up…
3e07c20 
…dates

Bumps the dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.8.0` | `25.9.1` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.2` | `2.0.3` |
| [hono](https://github.com/honojs/hono) | `4.12.18` | `4.12.21` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.0` | `4.22.3` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.4.1` | `1.5.0` |
| [@eslint-react/eslint-plugin](https://github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin) | `5.7.8` | `5.8.2` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.14` | `19.2.15` |
| [eslint](https://github.com/eslint/eslint) | `10.3.0` | `10.4.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.59.3` | `8.59.4` |



Updates `@types/node` from 25.8.0 to 25.9.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@hono/node-server` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.2...v2.0.3)

Updates `hono` from 4.12.18 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.18...v4.12.21)

Updates `tsx` from 4.22.0 to 4.22.3
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.0...v4.22.3)

Updates `@base-ui/react` from 1.4.1 to 1.5.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.5.0/packages/react)

Updates `@eslint-react/eslint-plugin` from 5.7.8 to 5.8.2
- [Release notes](https://github.com/Rel1cx/eslint-react/releases)
- [Changelog](https://github.com/Rel1cx/eslint-react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Rel1cx/eslint-react/commits/v5.8.2/plugins/eslint-plugin)

Updates `@types/react` from 19.2.14 to 19.2.15
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `eslint` from 10.3.0 to 10.4.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.3.0...v10.4.0)

Updates `typescript-eslint` from 8.59.3 to 8.59.4
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.4/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: tsx
  dependency-version: 4.22.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@eslint-react/eslint-plugin"
  dependency-version: 5.8.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.59.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@github-actions github-actions Bot enabled auto-merge May 19, 2026 18:01
@github-actions github-actions Bot merged commit d713ab2 into main May 19, 2026
6 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-a98e48b6e6 branch May 19, 2026 18:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants