Skip to content

chore(deps): bump the npm_and_yarn group across 5 directories with 4 updates#16

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-9743477fbb
Open

chore(deps): bump the npm_and_yarn group across 5 directories with 4 updates#16
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-9743477fbb

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 20, 2026

Bumps the npm_and_yarn group with 1 update in the /examples/agent-in-aws-bedrock-agent-core directory: hono.
Bumps the npm_and_yarn group with 2 updates in the /examples/serve-astack directory: fastify and next.
Bumps the npm_and_yarn group with 1 update in the /examples/serve-astack/frontend directory: next.
Bumps the npm_and_yarn group with 1 update in the /examples/simple-browser-use directory: undici.
Bumps the npm_and_yarn group with 1 update in the /website directory: next.

Updates hono from 4.10.7 to 4.11.10

Release notes

Sourced from hono's releases.

v4.11.10

What's Changed

  • fix: fixed to be more properly timing safe (Merge commit from fork 91def7ca)

Full Changelog: honojs/hono@v4.11.9...v4.11.10

v4.11.9

What's Changed

Full Changelog: honojs/hono@v4.11.8...v4.11.9

v4.11.8

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.11.7...v4.11.8

v4.11.7

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components

IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

... (truncated)

Commits
  • a40d210 4.11.10
  • 91def7c Merge commit from fork
  • 8b17935 test(types): add regression tests for #4388 (routes before .use() with explic...
  • 4a03f4f doc(jwt): mark options.secret as required in JSDoc (#4718)
  • 7300551 chore(ci): bump typescript-go to the latest (#4716)
  • 4b29780 chore: update Zod import examples to use namespace imports (#4715)
  • 69ad885 4.11.9
  • 3d536ff fix: determine if rendered or not by node.vC[0] instead of referring to `no...
  • 0c1d4c7 fix(url): ignore fragment identifiers in getPath() (#4627)
  • 5ca5c3e 4.11.8
  • Additional commits viewable in compare view

Updates fastify from 5.6.1 to 5.7.3

Release notes

Sourced from fastify's releases.

v5.7.3

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.7.2...v5.7.3

v5.7.2

⚠️ Notice ⚠️

Parsing of the content-type header has been improved to a strict parser in PR #6414. This means only header values in the form described in RFC 9110 are accepted.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.7.1...v5.7.2

v5.7.1

What's Changed

Full Changelog: fastify/fastify@v5.7.0...v5.7.1

v5.7.0

What's Changed

... (truncated)

Commits

Updates next from 15.5.9 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

Commits

Updates next from 15.5.9 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

Commits

Updates undici from 7.16.0 to 7.22.0

Release notes

Sourced from undici's releases.

v7.22.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.21.0...v7.22.0

v7.21.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.20.0...v7.21.0

v7.20.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v7.19.2...v7.20.0

v7.19.2

What's Changed

... (truncated)

Commits
  • 0a23610 Bumped v7.22.0 (#4829)
  • f3c5c61 feat: Support async cache stores in revalidation (#4826)
  • 9b78a44 fix(deduplicate): avoid deduping methods not in methods option (#4818)
  • 0ce57ba build(deps-dev): bump esbuild from 0.25.12 to 0.27.3 (#4821)
  • 2453caf fix: route websocket upgrades through new handler API (#4787)
  • 4658cdf feat(dispatcher/env-http-proxy-agent): strip leading dot and asterisk (#4676)
  • a821c56 fix: use OR operator in includesCredentials per WHATWG URL Standard (#4816)
  • b3326b5 docs: fix syntax highlighting in WebSocket.md (#4814)
  • 393c0da Bumped v7.21.0 (#4813)
  • 47f9b96 fix: set finalizer only for fetch responses (#4803)
  • Additional commits viewable in compare view

Updates next from 15.5.9 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates

Bumps the npm_and_yarn group with 1 update in the /examples/agent-in-aws-bedrock-agent-core directory: [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 2 updates in the /examples/serve-astack directory: [fastify](https://github.com/fastify/fastify) and [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /examples/serve-astack/frontend directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /examples/simple-browser-use directory: [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 1 update in the /website directory: [next](https://github.com/vercel/next.js).


Updates `hono` from 4.10.7 to 4.11.10
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.7...v4.11.10)

Updates `fastify` from 5.6.1 to 5.7.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.6.1...v5.7.3)

Updates `next` from 15.5.9 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.9...v15.5.10)

Updates `next` from 15.5.9 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.9...v15.5.10)

Updates `undici` from 7.16.0 to 7.22.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.22.0)

Updates `next` from 15.5.9 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.9...v15.5.10)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.11.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.7.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.22.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 20, 2026
@vercel
Copy link

vercel bot commented Feb 20, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
astack Error Error Feb 20, 2026 3:31am

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants