Update all non-major dependencies by cnap-tech-renovate[bot] · Pull Request #6 · cnap-tech/codemode

cnap-tech-renovate · 2026-03-10T02:38:51Z

This PR contains the following updates:

Package	Type	Update	Change
@modelcontextprotocol/sdk (source)	devDependencies	minor	`1.27.1` → `1.29.0`
hono (source)	devDependencies	patch	`4.12.5` → `4.12.12`
isolated-vm	devDependencies	minor	`6.0.2` → `6.1.2`
oxlint (source)	devDependencies	minor	`1.51.0` → `1.59.0`

Release Notes

modelcontextprotocol/typescript-sdk (@modelcontextprotocol/sdk)

`v1.29.0`

Compare Source

What's Changed

fix: treat v1.x as primary branch for npm latest tag (backport #1577) by @felixweinberger in #1749
[v1.x] fix: disallow null (infinite) requested TTL by @LucaButBoring in #1339
[v1.x] fix: add missing size field to ResourceSchema by @olaservo in #1575
Add typings exports by @tdraier in #1623
v1.x npm audit fix by @KKonstantinov in #1780
v1.x #1623 follow up -add missing types to package.json by @KKonstantinov in #1773
[v1.x backport] Allow servers / clients to advertise extensions in the capability object by @localden in #1811
fix(stdio): always set windowsHide on Windows, not just in Electron by @jnMetaCode in #1640
chore: bump version to 1.29.0 by @felixweinberger in #1820

New Contributors

@tdraier made their first contribution in #1623
@jnMetaCode made their first contribution in #1640

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

`v1.28.0`

Compare Source

What's Changed

feat: use scopes_supported from resource metadata by default (fixes #580) by @antogyn in #757
[v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by @pcarleton in #1611
fix: reject plain JSON Schema objects passed as inputSchema by @tiluckdave in #1596
fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by @pcarleton in #1462
fix(server/auth): RFC 8252 loopback port relaxation by @poteat in #1738
chore: bump version to 1.28.0 by @felixweinberger in #1746

New Contributors

@antogyn made their first contribution in #757
@tiluckdave made their first contribution in #1596
@poteat made their first contribution in #1738

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

honojs/hono (hono)

`v4.12.12`

Compare Source

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4

Users who use Serve Static, Static Site Generation, Cookie utilities, or IP restriction middleware are strongly encouraged to upgrade to this version.

`v4.12.11`

Compare Source

What's Changed

feat(css): add classNameSlug option to createCssContext by @flow-pie in #4834

New Contributors

@flow-pie made their first contribution in #4834

Full Changelog: honojs/hono@v4.12.10...v4.12.11

`v4.12.10`

Compare Source

What's Changed

test(router): fix Simple capturing group test by @yusukebe in #4838
docs: fix impaired -> inspired typo in benchmark READMEs by @Abhi3975 in #4843
fix(jsx/dom): apply select value after children are rendered by @usualoma in #4847
fix(compress): convert strong ETag to weak ETag when compressing by @usualoma in #4848
docs(ip-restriction): add clear JSDoc examples and param types by @VISHNU7KASIREDDY in #4851

New Contributors

@Abhi3975 made their first contribution in #4843
@VISHNU7KASIREDDY made their first contribution in #4851

Full Changelog: honojs/hono@v4.12.9...v4.12.10

`v4.12.9`

Compare Source

What's Changed

fix(request): remove parseBody from bodyCache to prevent TypeError by @yusukebe in #4807
feat(client): add PickResponseByStatusCode type by @yusukebe in #4791
fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest by @yuintei in #4810
fix(service-worker): make fire() fallback behavior consistent with handle() by @yusukebe in #4821
fix(cors): reflect request origin when credentials is true with wildcard by @ctonneslan in #4813

New Contributors

@yuintei made their first contribution in #4810
@ctonneslan made their first contribution in #4813

Full Changelog: honojs/hono@v4.12.8...v4.12.9

`v4.12.8`

Compare Source

What's Changed

fix(utils/mime): Normalize input extension to lowercase before MIME check by @TheEssem in #4800
fix(bearer-auth): escape regex metacharacters in bearer auth prefix option by @otoneko1102 in #4750

New Contributors

@TheEssem made their first contribution in #4800

Full Changelog: honojs/hono@v4.12.7...v4.12.8

`v4.12.7`

Compare Source

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

`v4.12.6`

Compare Source

What's Changed

fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in #4758
fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in #4792
chore(builld): tsconfig project references by @BarryThePenguin in #4797
chore: add tsconfig.spec.json by @yusukebe in #4798
feat(jsx-renderer): support function-based options by @3w36zj6 in #4780
fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X by @t0waxx in #4782

New Contributors

@t0waxx made their first contribution in #4782

Full Changelog: honojs/hono@v4.12.5...v4.12.6

laverdet/isolated-vm (isolated-vm)

oxc-project/oxc (oxlint)

`v1.59.0`

Compare Source

🐛 Bug Fixes

dd2df87 npm: Export package.json for oxlint and oxfmt (#20784) (kazuya kawaguchi)

`v1.58.0`

Compare Source

🚀 Features

16516de linter: Enhance types for DummyRule (#20751) (camc314)

📚 Documentation

be3dcc1 linter: Add note about node version + custom TS plugin (#19381) (camc314)

`v1.57.0`

Compare Source

`v1.56.0`

Compare Source

`v1.55.0`

Compare Source

🐛 Bug Fixes

bc20217 oxlint,oxfmt: Omit useless | null for Option<T> field from schema (#20273) (leaysgur)

📚 Documentation

f339f10 linter/plugins: Promote JS plugins to alpha status (#20281) (overlookmotel)

`v1.54.0`

Compare Source

📚 Documentation

0c7da4f linter: Fix extra closing brace in example config. (#20253) (connorshea)

`v1.53.0`

Compare Source

`v1.52.0`

Compare Source

🚀 Features

61bf388 linter: Add options.reportUnusedDisableDirectives to config file (#19799) (Peter Wagenet)
2919313 linter: Introduce denyWarnings config options (#19926) (camc314)
a607119 linter: Introduce maxWarnings config option (#19777) (camc314)

📚 Documentation

6c0e0b5 linter: Add oxlint.config.ts to the config docs. (#19941) (connorshea)
160e423 linter: Add a note that the typeAware and typeCheck options require oxlint-tsgolint (#19940) (connorshea)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

cnap-tech-renovate bot force-pushed the renovate/all-minor-patch branch from f95d0a8 to a6b2f2b Compare March 10, 2026 05:19

cnap-tech-renovate bot changed the title ~~chore(deps): update dependency oxlint to v1.52.0~~ chore(deps): update all non-major dependencies Mar 10, 2026

cnap-tech-renovate bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 2c2616a to 4a0c5ee Compare March 17, 2026 09:05

cnap-tech-renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 080ff20 to 94a917d Compare March 30, 2026 09:26

cnap-tech-renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from ddda28d to 5e1d845 Compare April 2, 2026 13:34

cnap-tech-renovate bot changed the title ~~chore(deps): update all non-major dependencies~~ Update all non-major dependencies Apr 2, 2026

cnap-tech-renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from e8defee to a0cabdf Compare April 8, 2026 17:19

Update all non-major dependencies

fa29773

cnap-tech-renovate bot force-pushed the renovate/all-minor-patch branch from a0cabdf to fa29773 Compare April 8, 2026 21:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update all non-major dependencies#6

Update all non-major dependencies#6
cnap-tech-renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

cnap-tech-renovate bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

cnap-tech-renovate bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

Security fixes

Middleware bypass via repeated slashes in serveStatic

Path traversal in toSSG() allows writing files outside the output directory

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Missing validation of cookie name on write path in setCookie()

Non-breaking space prefix bypass in cookie name handling in getCookie()

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Security hardening

What's Changed

New Contributors

🐛 Bug Fixes

🚀 Features

📚 Documentation

🐛 Bug Fixes

📚 Documentation

📚 Documentation

🚀 Features

📚 Documentation

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cnap-tech-renovate bot commented Mar 10, 2026 •

edited

Loading