Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #16 · kou029w/http-echo

dependabot · 2026-04-01T01:09:56Z

Bumps the npm_and_yarn group with 4 updates in the / directory: @hono/node-server, hono, wrangler and esbuild.

Updates @hono/node-server from 1.19.5 to 1.19.10

Release notes

Sourced from @hono/node-server's releases.

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

fix(globals): Stop overwriting global.fetch by @usualoma in honojs/node-server#295

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

docs: add guide for listening to UNIX domain socket by @TransparentLC in honojs/node-server#292

fix(serve-static): Use Readable.toWeb in serveStatic by @otya128 in honojs/node-server#293

New Contributors

@TransparentLC made their first contribution in honojs/node-server#292

@otya128 made their first contribution in honojs/node-server#293

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

v1.19.7

What's Changed

fix: Fix for hono issue 4563 - incorrect content-length after following symlink by @tshmieldev in honojs/node-server#290

chore: add configVersion to bun.lock by @yusukebe in honojs/node-server#291

New Contributors

@tshmieldev made their first contribution in honojs/node-server#290

Full Changelog: honojs/node-server@v1.19.6...v1.19.7

v1.19.6

What's Changed

fix(serve-static): fix onFound timing by @usualoma in honojs/node-server#286

Full Changelog: honojs/node-server@v1.19.5...v1.19.6

Commits

2f8ca36 1.19.10
455015b Merge commit from fork
cc05c48 chore: add benchmark for comparing with npm and local (dev) (#305)
58c4412 chore: Adding LICENSE file with MIT license referenced in README.md (#297)
b1daa4c docs(readme): add @usualoma as an author (#300)
26f5e89 1.19.9
2d729e7 fix(globals): Stop overwriting global.fetch (#295)
9b72ddf 1.19.8
0b1229e fix(serve-static): Use Readable.toWeb in serveStatic (#293)
76d80e6 docs: add guide for listening to UNIX domain socket (#292)
Additional commits viewable in compare view

Updates hono from 4.10.2 to 4.12.9

Release notes

Sourced from hono's releases.

v4.12.9

What's Changed

fix(request): remove parseBody from bodyCache to prevent TypeError by @yusukebe in honojs/hono#4807

feat(client): add PickResponseByStatusCode type by @yusukebe in honojs/hono#4791

fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest by @yuintei in honojs/hono#4810

fix(service-worker): make fire() fallback behavior consistent with handle() by @yusukebe in honojs/hono#4821

fix(cors): reflect request origin when credentials is true with wildcard by @ctonneslan in honojs/hono#4813

New Contributors

@yuintei made their first contribution in honojs/hono#4810

@ctonneslan made their first contribution in honojs/hono#4813

Full Changelog: honojs/hono@v4.12.8...v4.12.9

v4.12.8

What's Changed

fix(utils/mime): Normalize input extension to lowercase before MIME check by @TheEssem in honojs/hono#4800

fix(bearer-auth): escape regex metacharacters in bearer auth prefix option by @otoneko1102 in honojs/hono#4750

New Contributors

@TheEssem made their first contribution in honojs/hono#4800

Full Changelog: honojs/hono@v4.12.7...v4.12.8

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

fix(accept): replace regex split to mitigate ReDoS by @EdamAme-x in honojs/hono#4758

fix(jsx): align link hoisting and dedupe with React 19 by @usualoma in honojs/hono#4792

chore(builld): tsconfig project references by @BarryThePenguin in honojs/hono#4797

chore: add tsconfig.spec.json by @yusukebe in honojs/hono#4798

feat(jsx-renderer): support function-based options by @3w36zj6 in honojs/hono#4780

fix(lambda-edge): avoid callback handler deprecation on NODEJS_24_X by @t0waxx in honojs/hono#4782

New Contributors

@t0waxx made their first contribution in honojs/hono#4782

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

fix(request): return string | undefined from param() when path type is any by @andrewdamelio in honojs/hono#4723

... (truncated)

Commits

e1ae0eb 4.12.9
66fe9fe fix(cors): reflect request origin when credentials is true with wildcard (#4813)
50e2611 fix(service-worker): make fire() fallback behavior consistent with `handle(...
be85106 fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest (#4810)
d1722e3 feat(client): add PickResponseByStatusCode type (#4791)
8bd9ddd fix(request): remove parseBody from bodyCache to prevent TypeError (#4807)
fe689ec 4.12.8
0c0bf8d fix(bearer-auth): escape regex metacharacters in bearer auth prefix option (#...
488ea6a fix(utils/mime): Normalize input extension to lowercase before MIME check (#4...
b0aba5b 4.12.7
Additional commits viewable in compare view

Updates wrangler from 3.114.15 to 3.114.17

Changelog

Sourced from wrangler's changelog.

3.114.17

Patch Changes

#11891 6d5557b Thanks @emily-shen! - Use argument array when executing git commands with wrangler pages deploy

Pass user provided values from --commit-hash safely to underlying git command.

3.114.16

Patch Changes

#11689 9bab0a0 Thanks @ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.

#10737 c41a078 Thanks @workers-devprod! - Allow WRANGLER_SEND_ERROR_REPORTS env var to override whether to report Wrangler crashes to Sentry

#11134 bd39455 Thanks @petebacondarwin! - Reduce the amount of arguments being passed in metrics capture.

Now the argument values that are captured come from an allow list, and can be marked as ALLOW (capture the real value) or REDACT (capture as "").

#11020 9cb702e Thanks @dario-piotrowicz! - Fix observability.logs.persist being flagged as an unexpected field during the wrangler config file validation

#11147 cf4993b Thanks @FlorentCollin! - Improve the formatting of the D1 execute command to always show the duration in milliseconds with two decimal places.

#11650 cc29ead Thanks @ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules

When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.

#11179 7f779e9 Thanks @ascorbic! - Log a more helpful error when attempting to "r2 object put" a non-existent file

#11501 c78d942 Thanks @edmundhung! - fix: prevent reporting SQLite error from wrangler d1 execute to Sentry

#11262 b2683f7 Thanks @workers-devprod! - Avoid using object lookup for OAuth Error classes

#11107 d8037d3 Thanks @workers-devprod! - Fixed conflict between --env and --expires flags in wrangler r2 object put.

--e now aliases --env only, and NOT --expires.

#10961 02d2ea9 Thanks @devin-ai-integration! - Acquire Cloudflare Access tokens for additional requests made during a wrangler dev --remote session

#11108 892ec4f Thanks @emily-shen! - Fixed self-bindings (service bindings to the same worker) showing as [not connected] in wrangler dev. Self-bindings now correctly show as [connected] since a worker is always available to itself.

#11138 3db872a Thanks @devin-ai-integration! - Implement tail-based logging for wrangler dev remote mode, behind the --x-tail-tags flag. This will become the default in the future.

#10889 204616c Thanks @workers-devprod! - Clarify that wrangler check startup generates a local CPU profile

#11491 ed8aaef Thanks @edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25

#10962 203e599 Thanks @devin-ai-integration! - Fixed duplicate warning messages appearing during wrangler dev when configuration changes or state transitions occur

... (truncated)

Commits

f21ee75 Version Packages (#11895)
6d5557b fix: execute git commands in pages deploy safely (#11889) (#11891)
0e19ae9 Version Packages (#10906)
3db872a [v3 backport] Backport tail-based logging from #11135 and #11346 (#11138)
02d2ea9 Fix remote dev with Access (#10961)
9bab0a0 fix(wrangler): add warning when account_id mismatch detected on auth error (v...
4b18c6f Introduce internal isWorkerNotFoundError utility and avoid worker-not-found...
ed8aaef fix(wrangler): close FileHandle in to support Node 25 (#11491)
c78d942 V3 backport of #11467: prevent SQLite users error from being reported to Sent...
cc29ead fix: respect TypeScript path aliases when resolving non-JS modules with modul...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for wrangler since your current version.

Updates esbuild from 0.17.19 to 0.27.3

Release notes

Sourced from esbuild's releases.

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates undici from 5.29.0 to 7.24.4

Release notes

Sourced from undici's releases.

v7.24.4

What's Changed

fix(fetch): handle URL credentials in dispatch path extraction by @mcollina in nodejs/undici#4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @hxinhan in nodejs/undici#4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

fix fetch path logic by @KhafraDev in nodejs/undici#4890

remove maxDecompressedMessageSize by @KhafraDev in nodejs/undici#4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

fix: proto pollution by @rahulyadav5524 in nodejs/undici#4885

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.

GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)

... (truncated)

Commits

4991f3e Bumped v7.24.4
ea3a06d fix(fetch): preserve path for credentialed URLs (#4892)
9b96516 Bumped v7.24.3
7926660 Ignore .githuman
9eaa5af fix(h2): TypeError: Cannot read properties of null (reading 'push') in Reques...
a9bfe21 ignore .pi
f2e155b Bumped v7.24.2
4d2d1af remove maxDecompressedMessageSize (#4891)
3a05a4f fix fetch path logic (#4890)
23e3cd3 Bumped v7.24.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates in the / directory: [@hono/node-server](https://github.com/honojs/node-server), [hono](https://github.com/honojs/hono), [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) and [esbuild](https://github.com/evanw/esbuild). Updates `@hono/node-server` from 1.19.5 to 1.19.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.5...v1.19.10) Updates `hono` from 4.10.2 to 4.12.9 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.10.2...v4.12.9) Updates `wrangler` from 3.114.15 to 3.114.17 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/wrangler@3.114.17/packages/wrangler/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@3.114.17/packages/wrangler) Updates `esbuild` from 0.17.19 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.17.19...v0.27.3) Updates `undici` from 5.29.0 to 7.24.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v7.24.4) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 1.19.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 3.114.17 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-04-01T01:09:59Z

Deploying http-echo with Cloudflare Pages

Latest commit:	`bbfc085`
Status:	✅ Deploy successful!
Preview URL:	https://11b96038.http-echo.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-npm.http-echo.pages.dev

View logs

vercel · 2026-04-01T01:10:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
http-echo	Ready	Preview, Comment	Apr 1, 2026 1:10am

cloudflare-workers-and-pages · 2026-04-01T01:10:09Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	http-echo	`bbfc085`	Commit Preview URL Branch Preview URL	Apr 01 2026, 01:10 AM

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 1, 2026

dependabot bot mentioned this pull request Apr 1, 2026

Bump wrangler from 3.114.15 to 3.114.17 #10

Closed

This was referenced Apr 1, 2026

Bump @hono/node-server from 1.19.5 to 1.19.10 #14

Closed

Bump hono from 4.10.2 to 4.12.7 #15

Closed

vercel bot deployed to Preview April 1, 2026 01:10 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 5 updates#16

Bump the npm_and_yarn group across 1 directory with 5 updates#16
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-89eddec017

dependabot bot commented on behalf of github Apr 1, 2026

Uh oh!

cloudflare-workers-and-pages bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

vercel bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Apr 1, 2026

v1.19.10

Security Fix

v1.19.9

What's Changed

v1.19.8

What's Changed

New Contributors

v1.19.7

What's Changed

New Contributors

v1.19.6

What's Changed

v4.12.9

What's Changed

New Contributors

v4.12.8

What's Changed

New Contributors

v4.12.7

Security hardening

v4.12.6

What's Changed

New Contributors

v4.12.5

What's Changed

3.114.17

Patch Changes

3.114.16

Patch Changes

v0.27.3

Changelog: 2023

0.19.11

v7.24.4

What's Changed

v7.24.3

What's Changed

v7.24.2

What's Changed

v7.24.1

What's Changed

v7.24.0

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

Uh oh!

cloudflare-workers-and-pages bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying http-echo with Cloudflare Pages

Uh oh!

vercel bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cloudflare-workers-and-pages bot commented Apr 1, 2026 •

edited

Loading

vercel bot commented Apr 1, 2026 •

edited

Loading

cloudflare-workers-and-pages bot commented Apr 1, 2026 •

edited

Loading