Skip to content

chore(deps): Bump the npm-minor-patch group across 1 directory with 10 updates - #142

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1d3ebd754e
Closed

chore(deps): Bump the npm-minor-patch group across 1 directory with 10 updates#142
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1d3ebd754e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 10 updates in the / directory:

Package From To
@biomejs/biome 2.5.6 2.5.8
publint 0.3.22 0.3.23
@types/node 26.1.2 26.2.0
tsx 4.23.1 4.23.12
hono 4.12.32 4.13.1
axe-core 4.12.1 4.13.0
playwright 1.61.1 1.62.1
smol-toml 1.7.1 1.7.2
wrangler 4.114.0 4.120.0
@cloudflare/vitest-pool-workers 0.18.8 0.20.3

Updates @biomejs/biome from 2.5.6 to 2.5.8

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.8

2.5.8

Patch Changes

  • #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

  • #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

  • #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

    Invalid:

    {#each boxes as box}
  {@const area = box.width * box.height}
  <p>{area}</p>
{/each}

    Valid:

    {#each boxes as box}
  {const area = $derived(box.width * box.height)}
  <p>{area}</p>
{/each}

  • #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

  • #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

  • #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

     :root {
   --font-stack:
-/* comment */
+    /* comment */
     system-ui;
 }

  • #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

    -:/* comment */ where(div) {}
+:where(/* comment */ div) {}

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.8

Patch Changes

  • #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

  • #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

  • #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

    Invalid:

    {#each boxes as box}
  {@const area = box.width * box.height}
  <p>{area}</p>
{/each}

    Valid:

    {#each boxes as box}
  {const area = $derived(box.width * box.height)}
  <p>{area}</p>
{/each}

  • #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

  • #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

  • #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

     :root {
   --font-stack:
-/* comment */
+    /* comment */
     system-ui;
 }

  • #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

    -:/* comment */ where(div) {}
+:where(/* comment */ div) {}

... (truncated)

Commits

Updates publint from 0.3.22 to 0.3.23

Release notes

Sourced from publint's releases.

publint@0.3.23

Patch Changes

  • #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

  • #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

Changelog

Sourced from publint's changelog.

0.3.23

Patch Changes

  • #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

  • #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

Commits

Updates @types/node from 26.1.2 to 26.2.0

Commits

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

This release is also available on:

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

  • map Node test locations (2f55884)
  • support data URLs in tsImport (b94f46f)

This release is also available on:

v4.23.8

... (truncated)

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • b94f46f fix: support data URLs in tsImport
  • Additional commits viewable in compare view

Updates hono from 4.12.32 to 4.13.1

Release notes

Sourced from hono's releases.

v4.13.1

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
ping — GET / 165.83 ns 163.99 ns 1.01x
query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
json — GET /user 528.99 ns 422.44 ns 1.25x
body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
</tr></table>

... (truncated)

Commits
  • cf78528 4.13.1
  • f6aa913 fix(etag): skip unsafe methods or error responses on non-* case (#5196)
  • cd31bc1 fix(utils/stream): re-acquire writer lock when pipe() throws (#4988)
  • 569b419 fix(trie-router): count every slash a pattern consumes (#5189)
  • 192768f 4.13.0
  • b0c2d90 Merge pull request #5154 from honojs/next
  • 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
  • 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
  • 3feb355 fix(jsx): allow a function component to return an array (#5179)
  • 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
  • Additional commits viewable in compare view

Updates axe-core from 4.12.1 to 4.13.0

Release notes

Sourced from axe-core's releases.

Release 4.13.0

In summary, this release adds:

  1. Support Element Internals: A modern way for building accessible component libraries Axe-core is the first accessibility tool to support this major new web feature! Thanks to RedHat and Adobe for working with us to figure out the right way forward.

  2. A new Swedish translation, thanks to our a community contribution

  3. A new Finish contribution (not open source), thanks to our Scandinavian partner

  4. 10 False positives closed, including all the critical ones!

  5. And 13 updates to get Axe-core consistent with the latest web standards

This release is one of the bigger changes we've done in a few years, so likely issue numbers are going to change in adopting this version.

Features

  • aria-actions: add aria-actions to allowed ARIA attributes (#5200) (029655d), closes #4584 #5199, references #5215 #5215
  • aria-allowed-attr: flag deprecated ARIA attributes as needs-review (#5246) (518f3cc), closes #3341
  • aria-prohibited-attr: allow many elements to be named and disallow label and body from being named (#5259) (d8b1ea5)
  • aria-roles: add sectionheader and sectionfooter roles (#5238) (c36c109), closes #4734, references #4734
  • aria/get-aria-value: new function to get aria values of a node (#5109) (a7d8f3e), references #5042
  • aria/has-attr-value: new function to check if node has aria value (#5136) (61f2624), references #5109
  • aria: support role=image as equivalent to role=img (#5248) (5aa8aaf), closes #4656, references #5272
  • checks/aria: support ARIA element internals properties (#5172) (9b7f754)
  • checks/label: support ARIA element internals properties (#5170) (21c5f8b)
  • checks/navigation: support ARIA element internals properties (#5167) (2c3a98f)
  • commons/aria: support ARIA element internals properties (#5171) (31f09e7)
  • commons/dom: support ARIA element internals properties (#5163) (f0a12cf)
  • commons/forms: support ARIA element internals properties (#5165) (27a4686)
  • commons/matches/fromPrimative: deprecate in favor of correct spelling (#5270) (31cfb2e)
  • commons/text: support ARIA element internals properties (#5169) (e841a33)
  • commons/text: support form-associated labels via element internals (#5182) (57cfe0a), closes #5045, references #5170 #5039 #5151 #5039
  • dom/getResolvedRefs: new function to get the resolved virtual nodes of idrefs (#5151) (489cdea), references #5109
  • element-internals: enable ElementInternals by default (#5284) (2740d42), closes #5277
  • i18n: Add Swedish locale (#5190) (dcd13f2), references #5189
  • matches: add inSectioningContent, hasChild, and isSummaryForDetails matches (#5262) (c47cdcd)
  • rules: support ARIA element internals properties (#5168) (065baf7)
  • standards/ariaAttrs: add caseInsensitive property for attributes (#5224) (bcd791c)

Bug Fixes

  • aria-allowed-role: allow roles on a non-details summary (#5242) (3bd9875), closes #3911, references #3443 #3911
  • aria-allowed-role: restrict figure roles with child figcaption (#5240) (178a635), closes #3443
  • aria-prohibited-attr: visible aria-labelledby requires review only (#5285) (fd6fa9f)
  • axe.d.ts: make enabled property of RuleMetadata optional (#5129) (90fce18)
  • color-contrast: fix various stacking context bugs (#5214) (d5e5b04), references #8 #5213

... (truncated)

Changelog

Sourced from axe-core's changelog.

4.13.0 (2026-08-05)

Features

  • aria-actions: add aria-actions to allowed ARIA attributes (#5200) (029655d), closes #4584 #5199, references #5215 #5215
  • aria-allowed-attr: flag deprecated ARIA attributes as needs-review (#5246) (518f3cc), closes #3341
  • aria-prohibited-attr: allow many elements to be named and disallow label and body from being named (#5259) (d8b1ea5)
  • aria-roles: add sectionheader and sectionfooter roles (#5238) (c36c109), closes #4734, references #4734
  • aria/get-aria-value: new function to get aria values of a node (#5109) (a7d8f3e), references #5042
  • aria/has-attr-value: new function to check if node has aria value (#5136) (61f2624), references #5109
  • aria: support role=image as equivalent to role=img (#5248) (5aa8aaf), closes #4656, references #5272
  • checks/aria: support ARIA element internals properties (#5172) (9b7f754)
  • checks/label: support ARIA element internals properties (#5170) (21c5f8b)
  • checks/navigation: support ARIA element internals properties (#5167) (2c3a98f)
  • commons/aria: support ARIA element internals properties (#5171) (31f09e7)
  • commons/dom: support ARIA element internals properties (#5163) (f0a12cf)
  • commons/forms: support ARIA element internals properties (#5165) (27a4686)
  • commons/matches/fromPrimative: deprecate in favor of correct spelling (#5270) (31cfb2e)
  • commons/text: support ARIA element internals properties (#5169) (e841a33)
  • commons/text: support form-associated labels via element internals (#5182) (57cfe0a), closes #5045, references #5170 #5039 #5151 #5039
  • dom/getResolvedRefs: new function to get the resolved virtual nodes of idrefs (#5151) (489cdea), references #5109
  • element-internals: enable ElementInternals by default (#5284) (2740d42), closes #5277
  • i18n: Add Swedish locale (#5190) (dcd13f2), references #5189
  • matches: add inSectioningContent, hasChild, and isSummaryForDetails matches (#5262) (c47cdcd)
  • rules: support ARIA element internals properties (#5168) (065baf7)
  • standards/ariaAttrs: add caseInsensitive property for attributes (#5224) (bcd791c)

Bug Fixes

  • aria-allowed-role: allow roles on a non-details summary (#5242) (3bd9875), closes #3911, references #3443 #3911
  • aria-allowed-role: restrict figure roles with child figcaption (#5240) (178a635), closes #3443
  • aria-prohibited-attr: visible aria-labelledby requires review only (#5285) (fd6fa9f)
  • axe.d.ts: make enabled property of RuleMetadata optional (#5129) (90fce18)
  • color-contrast: fix various stacking context bugs (#5214) (d5e5b04), references #8 #5213
  • gather-internals: handle non-HTMLElement nodes (#5161) (06e84c3)
  • get-selector: escape control characters in attribute selectors (#5273) (4b60ac5), closes #5204 #5204
  • image-alt: allow whitespace alt on presentational images (#5218) (c5dd0ef), closes #5216
  • landmark-unique: exclude section/form with non-landmark roles from landmark match (#5085) (c5fd013), closes #4722 #5064
  • name the image role in role-img-alt and svg-img-alt metadata (#5279) (995a269), closes #5272, references #5248 #5248
  • standards: update aria-errormessage and aria-details to be idrefs (#5157) (fb94f8a)
Commits
  • 1cc54b9 chore(release): v4.13.0 (#5288)
  • a1c9ebb chore(release): 4.13.0
  • 98400d7 test(arialabelledby-text): cover closed shadow DOM and out-of-tree idrefs (#5...
  • bcd791c feat(standards/ariaAttrs): add caseInsensitive property for attributes (#5224)
  • fd6fa9f fix(aria-prohibited-attr): visible aria-labelledby requires review only (#5285)
  • 013ee82 ci: increase wait-for-npm-ready timeout for publish scan delay (#5286)
  • c5fd013 fix(landmark-unique): exclude section/form with non-landmark roles from landm...
  • dcd13f2 feat(i18n): Add Swedish locale (#5190)
  • a713bd8 test(hasAriaValue): reenable skipped test due to firefox crash (#5229)
  • fb94f8a fix(standards): update aria-errormessage and aria-details to be idrefs (#5157)
  • Additional commits viewable in compare view

Updates playwright from 1.61.1 to 1.62.1

Release notes

Sourced from playwright's releases.

v1.62.1

Bug Fixes

  • #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
  • #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
  • #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
  • #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
  • #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits
  • 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
  • 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
  • 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
  • 66c5cc9 chore: mark v1.62.1 (#42020)
  • 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
  • 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
  • 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
  • e3950d9 chore: mark v1.62.0 (#41981)
  • f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
  • 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
  • Additional commits viewable in compare view

Updates smol-toml from 1.7.1 to 1.7.2

Release notes

Sourced from smol-toml's releases.

v1.7.2

What's Changed

Full Changelog: squirrelchat/smol-toml@v1.7.1...v1.7.2

Commits
  • 19239d0 chore: bump version
  • 5f55c3a chore: revert sourcemap publishing
  • 5c26f1b chore: update benchmarks
  • 92832d2 refactor: better logic orchestration in structs
  • 2fb9ab8 refactor: ctx object instead of pointer arg + tuple returns
  • e6017c4 ci: use staged publish
  • See full diff in compare view

Updates wrangler from 4.114.0 to 4.120.0

Release notes

Sourced from wrangler's releases.

wrangler@4.120.0

Minor Changes

  • #15008 35c87e9 Thanks @​skepticfx! - Adds the ability to find container instances by exact ID or name

    wrangler containers instances <application_id> --search <instance_id_or_name> now searches every page and returns exact matches in human-readable or JSON output. JSON returns a top-level array, including an empty array when there is no match, while human-readable output prints a no-match message. If multiple instances have the same exact name, every matching instance is returned.

  • #15008 35c87e9 Thanks @​skepticfx! - Add explicit pagination to container instance JSON output

    Use wrangler containers instances <application_id> --json --per-page <size> to return one page with machine-readable result_info, then pass its next_page_token to --page-token to retrieve the next page. Plain --json remains backward-compatible: it requests the complete list and returns the existing top-level array.

Patch Changes

  • #15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

  • #15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

    Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per sp...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 14, 2026
@github-actions

github-actions Bot commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

Preview deployed

Federated GitLab lookups (freedesktop / GNOME) degrade to the "use the CLI" card — the Anubis relay is off in preview. GitHub lookups, permalinks, and OG render work once INTERNAL_SECRET/GITHUB_TOKEN are set on the preview env.

@lukaso
lukaso force-pushed the dependabot/npm_and_yarn/npm-minor-patch-1d3ebd754e branch from 841d2bd to 6d8369c Compare August 15, 2026 04:19
@lukaso-bot

lukaso-bot commented Aug 15, 2026

Copy link
Copy Markdown
Collaborator

Adopted this PR's red osv dependency scan — pushed 6d8369c.

Root cause: not this group bump. The 2 High advisories came from the override
floors this branch inherited from main:

Advisory CVSS Package Was Fixed in
GHSA-5p4m-2wfm-xmqj 7.5 js-yaml 4.3.0 4.3.1
GHSA-4cwx-7wf7-3272 7.4 undici 7.28.0 7.29.0

(plus 4 Medium on the same undici version)

Fix: raised undici >=7.28.0 → >=7.29.0, jsdom>undici likewise, and
js-yaml@4 ^4.3.0 → ^4.3.1, then refreshed the lockfile. nanoid already
resolves to 3.3.18 here, so it needs no override.

Red → green, verified locally with the gate's own scripts/osv-check.sh:

  • before (at 1c80e50): Total 2 packages affected by 6 known vulnerabilities (0 Critical, 2 High, 4 Medium) → ✗ osv: ... must be resolved before merge —
    byte-identical to the CI failure
  • after: No issues found → ✓ osv: no High/Critical vulnerabilities

Full gate green on the new head: pnpm -r build, pnpm -r typecheck,
pnpm test (277 web + 27/6 web-og + cli), pnpm lint.

Scope, so the severity isn't overread: both advisories are dev-only in this
repo. undici arrives via jsdom (test env) and miniflare (local dev); js-yaml via
@changesets/cli (release tooling). Neither is reachable from the deployed Workers —
so this is a red gate on main, not a production exposure.

Two things worth knowing before you merge:

  1. main carries the same stale floors, so its osv gate is red today. Merging this
    clears it. fix(web-og): stop workers-og's 1-year immutable default overriding OG cache-control #141 also carries these floors (bundled with its OG cache-control fix) —
    whichever of the two merges second will need a trivial rebase on the pnpm.overrides
    block.
  2. Pre-existing peer warning, untouched here and not this PR's job: this group bumps
    wrangler to 4.120.0, which wants @cloudflare/workers-types@^5.20260801.1; the repo
    has 4.20260702.1. chore(deps-dev): Bump @cloudflare/workers-types from 4.20260702.1 to 5.20260708.1 #138 bumps that to 5.20260708.1, which is still below wrangler's
    floor. Warning only — no gate fails on it.

This was referenced Aug 15, 2026
Merged
Closed
Closed
@dependabot liveapp-bot
chore(deps): Bump the npm-minor-patch group across 1 directory with 1…
6ad9073 
…0 updates

Bumps the npm-minor-patch group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.8` |
| [publint](https://github.com/publint/publint/tree/HEAD/packages/publint) | `0.3.22` | `0.3.23` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |
| [hono](https://github.com/honojs/hono) | `4.12.32` | `4.13.1` |
| [axe-core](https://github.com/dequelabs/axe-core) | `4.12.1` | `4.13.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.7.2` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.114.0` | `4.120.0` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.18.8` | `0.20.3` |

Updates `@biomejs/biome` from 2.5.6 to 2.5.8
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.8/packages/@biomejs/biome)

Updates `publint` from 0.3.22 to 0.3.23
- [Release notes](https://github.com/publint/publint/releases)
- [Changelog](https://github.com/publint/publint/blob/master/packages/publint/CHANGELOG.md)
- [Commits](https://github.com/publint/publint/commits/publint@0.3.23/packages/publint)

Updates `@types/node` from 26.1.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.12)

Updates `hono` from 4.12.32 to 4.13.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.32...v4.13.1)

Updates `axe-core` from 4.12.1 to 4.13.0
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core@v4.12.1...v4.13.0)

Updates `playwright` from 1.61.1 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.1)

Updates `smol-toml` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.7.1...v1.7.2)

Updates `wrangler` from 4.114.0 to 4.120.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.120.0/packages/wrangler)

Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.3
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.3/packages/vitest-pool-workers)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: publint
  dependency-version: 0.3.23
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: hono
  dependency-version: 4.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: axe-core
  dependency-version: 4.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: smol-toml
  dependency-version: 1.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: wrangler
  dependency-version: 4.120.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.20.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@lukaso
lukaso force-pushed the dependabot/npm_and_yarn/npm-minor-patch-1d3ebd754e branch from 6d8369c to 6ad9073 Compare August 20, 2026 17:11
@lukaso-bot

lukaso-bot commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

liveapp adoption pass @ 6d8369c: adopted — rebased onto origin/main (1a717ce) at new head 6ad9073. My osv-floor commit 6d8369c was dropped as redundant (#138 put the same overrides on main), so this is back to Dependabot's single grouped commit — all 10 bumps intact: biome 2.5.8, publint 0.3.23, @types/node 26.2.0, tsx 4.23.12, hono 4.13.1, @cloudflare/vitest-pool-workers 0.20.3, wrangler 4.120.0, axe-core 4.13.0, playwright 1.62.1, smol-toml 1.7.2. The packages/web-og/package.json conflict was resolved keeping main's @cloudflare/workers-types@^5 and the group's vitest-pool-workers@0.20.3; the lockfile was regenerated and re-verified stable (pnpm install --lockfile-only produces no drift). Verified locally: typecheck clean, pnpm test 585 passed, pnpm -r build clean. Bonus: osv now reports No issues found on this branch — hono 4.13.1 also clears the 4 Medium advisories (GHSA-54fx / -79qm / -8j4g / -f23p) that main still carries at hono 4.12.32. No member is blocked; all 10 adopted.

@dependabot @github

dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 21, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-1d3ebd754e branch August 21, 2026 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lukaso-bot