Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 11 updates#29

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-0763b3c24b
Closed

chore(deps): bump the production-dependencies group across 1 directory with 11 updates#29
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-0763b3c24b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
react 19.2.4 19.2.7
react-dom 19.2.4 19.2.7
react-router 7.16.0 8.0.0
@hono/node-server 1.19.13 2.0.5
@slack/web-api 7.15.0 7.17.0
better-sqlite3 12.8.0 12.11.1
commander 14.0.3 15.0.0
hono 4.12.14 4.12.26
js-yaml 4.1.1 4.2.0
safe-regex2 5.0.0 5.1.1
zod 4.3.6 4.4.3

Updates react from 19.2.4 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Updates react-dom from 19.2.4 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.


Updates react-router from 7.16.0 to 8.0.0

Release notes

Sourced from react-router's releases.

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

Changelog

Sourced from react-router's changelog.

v8.0.0

Major Changes

  • Remove the future.v8_trailingSlashAwareDataRequests flag (#15100)
    • Trailing slash-aware data request URLs are now the default behavior.
  • Update tsconfig.json target/lib from ES2020 -> ES2022 (591853e)
  • Switch the published packages in packages/ to ESM-only. (#14895) (59ebcf1)
  • Remove deprecated data parameter in favor of loaderData for meta APIs (to align with Route.ComponentProps) (#14931)
    • Route.MetaArgs, Route.MetaMatch, MetaArgs, MetaMatch, Route.ComponentProps.matches, UIMatch
  • Remove future.v8_passThroughRequests flag - the raw incoming request is now always passed through to loader/action. Use url for the normalized URL without React Router-specific implementation details (.data suffixes, index/_routes search params). (#15079)
  • Remove internal hasErrorBoundary field added to router.routes when using a data router (#15074)
    • This should not impact user-facing code since this was an internal prop and was computed based on the presence of ErrorBoundary or errorElement on your route
    • hasErrorBoundary is no longer accepted on RouteObject (IndexRouteObject/NonIndexRouteObject), DataRouteObject, <Route> JSX props, or as a key in lazy route definitions.
    • The MapRoutePropertiesFunction signature no longer requires returning hasErrorBoundary; the router infers it directly.
  • Remove react-router-dom package (#15076)
    • In v7 everything DOM-specific was collapsed into react-router/dom
      • react-router-dom was kept around as a convenience so existing v6 app imports would still work
    • For v8, you will need to swap react-router-dom imports:
      • RouterProvider/HydratedRouter should be imported from react-router/dom
      • Everything else should be imported from react-router
  • Remove future.v8_middleware flag — middleware is always enabled in v8 (#15078)
    • The future.v8_middleware flag has been removed; middleware is now always enabled
    • The context parameter passed to loader, action, and middleware functions is always a RouterContextProvider instance
    • getLoadContext functions in custom servers must return a RouterContextProvider — returning a plain object is no longer supported
    • The MiddlewareEnabled type (previously exported as UNSAFE_MiddlewareEnabled) has been removed since the conditional it gated is now unconditional
    • The Future module augmentation pattern (interface Future { v8_middleware: true }) is no longer needed to type context in Data Mode
  • Update minimum Node version to 22.22.0 (#14928)
  • Update minimum React version to 19.2.7 (#15062)

Minor Changes

  • Bump dependencies (#15080)
    • Bumped cookie from ^1.0.1 to ^1.1.1
    • Bumped set-cookie-parser from ^2.6.0 to ^3.1.0

Patch Changes

  • Ensure client middleware errors load lazy route error boundaries before bubbling (#15086)
  • Remove explicit onSubmit type override from SharedFormProps to fix deprecation warning with @types/react@19.x (#14932) (59ebcf1)
  • Update package builds to preserve individual module files in published artifacts. Public APIs and documented import paths are unchanged. (#15092)
    • Updated package TypeScript configs to support modern module syntax used by the build configuration.
  • Migrate package builds from tsup to tsdown. Published package entry points and public APIs are unchanged. (#15092)
  • Upgrade React Router's TypeScript tooling to TypeScript 6. Runtime behavior and public APIs are unchanged. (#15092)

v7.18.0

Patch Changes

  • Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)

... (truncated)

Commits

Updates @hono/node-server from 1.19.13 to 2.0.5

Release notes

Sourced from @​hono/node-server's releases.

v2.0.5

Security Fix

Fixed a security issue in Serve Static Middleware where prefix-mounted middleware could be bypassed on Windows. This only affects applications running on Windows that use Serve Static Middleware. Affected users are encouraged to upgrade to this version.

See GHSA-frvp-7c67-39w9 for details.

v2.0.4

What's Changed

Full Changelog: honojs/node-server@v2.0.3...v2.0.4

v2.0.3

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.2...v2.0.3

v2.0.2

What's Changed

Full Changelog: honojs/node-server@v2.0.1...v2.0.2

v2.0.1

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.0...v2.0.1

v2.0.0

Now, we release the second major version of the Hono Node.js adapter 🎉 🎉 🎉

The Hono Node.js adapter is now up to 2.3x faster

v2 of the Hono Node.js adapter reaches up to 2.3x the throughput of v1 — that's the peak number, measured on the body-parsing scenario of bun-http-framework-benchmark. The other scenarios (Ping, Query) get a smaller but real boost too.

... (truncated)

Commits
  • 9d56900 2.0.5
  • cd076e1 Merge commit from fork
  • 9e1cdee 2.0.4
  • b4ca622 fix: stub ws types to prevent them leaking in public types (#359)
  • 9d87987 2.0.3
  • 9463250 fix: preserve headers mutated after raw Response construction (#357)
  • cee5e81 docs: Align the ServeStaticOption command with the current specification (#...
  • 4aa0650 chore(ci): update GitHub Actions versions (#352)
  • 808159c 2.0.2
  • 1a9748e fix: handle serveStatic stream fallback backpressure (#351)
  • Additional commits viewable in compare view

Updates @slack/web-api from 7.15.0 to 7.17.0

Release notes

Sourced from @​slack/web-api's releases.

@​slack/web-api@​7.17.0

Minor Changes

  • 2085900: feat: expose public read-only ts getter on ChatStreamer for fallback to chat.update when a stream expires server-side

    import { WebClient } from "@slack/web-api";
const client = new WebClient(process.env.SLACK_BOT_TOKEN);
const streamer = client.chatStream({
channel: "C0123456789",
thread_ts: "1700000001.123456",
recipient_team_id: "T0123456789",
recipient_user_id: "U0123456789",
});
await streamer.append({ markdown_text: "hello!" });
// streamer.ts is now set after the first flush
console.log(streamer.ts);
await streamer.stop();

@​slack/web-api@​7.16.0

Minor Changes

  • 2814969: feat: add highlight_type to files.completeUploadExternal and filesUploadV2 for optimistic rendering

    import { WebClient } from "@slack/web-api";
const client = new WebClient(process.env.SLACK_BOT_TOKEN);
await client.filesUploadV2({
channel_id: "C0123456789",
file: "./image.png",
filename: "image.png",
title: "Image Upload",
highlight_type: "png",
});

@​slack/web-api@​7.15.2

Patch Changes

... (truncated)

Commits
  • 2d370dc chore: release (#2612)
  • e8fbfd5 fix(cli-test)!: remove default "--app deployed" global flag from commands (#2...
  • b06909d chore(deps): bump changesets/action from 1.8.0 to 1.9.0 (#2623)
  • 65d23cb chore(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 (#2622)
  • 058bd1e chore(deps): bump changesets/action from 1.7.0 to 1.8.0 (#2619)
  • 030ed92 chore(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1 (#2620)
  • 5915300 chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#2617)
  • 5457fce chore(deps): bump actions/create-github-app-token from 3.1.1 to 3.2.0 (#2618)
  • efacdb4 Upload required SECURITY.md file for compliance
  • 32633d8 Upload required SECURITY.md file for compliance
  • Additional commits viewable in compare view

Updates better-sqlite3 from 12.8.0 to 12.11.1

Release notes

Sourced from better-sqlite3's releases.

v12.11.1

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1

v12.11.0

⚠️CAUTION: NOT A VIABLE RELEASE

Use v12.11.1 instead.

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.10.1...v12.11.0

v12.10.1

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

v12.10.0

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v12.9.1...v12.10.0

v12.9.1

⚠️CAUTION: NOT A VIABLE RELEASE

Electron v39+ prebuilds are not building successfully at the moment. Stick to v12.9.0 for now.

What's Changed

New Contributors

Full Changelog: WiseLibs/better-sqlite3@v12.9.0...v12.9.1

... (truncated)

Commits

Updates commander from 14.0.3 to 15.0.0

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

Changed

  • Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
  • Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
  • dev: switch tests from Jest to node:test test runner (#2463)

Deleted

  • Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

  • show excess command-arguments in error message (#2384)

Fixed

  • Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
  • update example to use compatible character for MINGW64 (#2475)

Changed

  • Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
  • Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
  • dev: switch tests from Jest to node:test test runner (#2463)

Deleted

  • Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

Commits

Updates hono from 4.12.14 to 4.12.26

Release notes

Sourced from hono's releases.

v4.12.26

What's Changed

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

What's Changed

... (truncated)

Commits
  • 27b7992 4.12.26
  • d29982c chore: replace arg and glob with Bun native APIs in build script
  • 16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
  • c574cf1 ci: publish to npm from CI with OIDC trusted publishing (#5028)
  • e50df01 fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (#5...
  • fce483e 4.12.25
  • 751ba41 Merge commit from fork
  • f0b094d Merge commit from fork
  • fa5f9bf Merge commit from fork
  • 3892a6c Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates safe-regex2 from 5.0.0 to 5.1.1

Release notes

Sourced from safe-regex2's releases.

v5.1.1

What's Changed

New Contributors

Full Changelog: fastify/safe-regex2@v5.1.0...v5.1.1

v5.1.0

What's Changed

New Contributors

Full Changelog: fastify/safe-regex2@v5.0.0...v5.1.0

Commits
  • 35dd3a7 Bumped v5.1.1
  • 29c58ae fix: detect alternation inside REPETITION groups (#76)
  • 58d5872 ci: add lock-threads workflow (#75)
  • d19f1f3 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#74)
  • 5f9d306 build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#72)
  • 96f8f0a 5.1.0
  • ca60981 ci: remove stale.yml (#71)
  • 9f69b95 chore(license): standardise license notice (#67)
  • 5567b6d build(deps-dev): bump c8 from 10.1.3 to 11.0.0 (#68)
  • 90c2fdc ci(ci): add concurrency config (#66)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by climba03003, a new releaser for safe-regex2 since your current version.


Updates zod from 4.3.6 to 4.4.3

Release notes

Sourced from zod's releases.

v4.4.3

Commits:

  • 4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo
  • 2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern
  • 9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)
  • b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)
  • f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3
  • 1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release procedure in AGENTS.md

v4.4.2

Commits:

  • 0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (#5901)
  • 20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps
  • 6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)
  • 4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing
  • bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents
  • cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
  • 292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor
  • 1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion
  • 1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance
  • e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes
  • e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights
  • 905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing
  • bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md
  • 8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch
  • 02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (#5929)
  • 88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated baseUrl from tsconfig
  • c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2

v4.4.1

Commits:

  • 481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow
  • 95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations
  • cede2c63739a5823d6aa5093d291e9a111da943d fix(v4):...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 4, 2026
@dependabot dependabot Bot requested a review from olivrg as a code owner June 4, 2026 15:28
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 4, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-0763b3c24b branch 3 times, most recently from 8651fd1 to 71fa843 Compare June 16, 2026 10:21
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
7adb329 
…y with 11 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.4` | `19.2.7` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.4` | `19.2.7` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.16.0` | `8.0.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.13` | `2.0.5` |
| [@slack/web-api](https://github.com/slackapi/node-slack-sdk) | `7.15.0` | `7.17.0` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.8.0` | `12.11.1` |
| [commander](https://github.com/tj/commander.js) | `14.0.3` | `15.0.0` |
| [hono](https://github.com/honojs/hono) | `4.12.14` | `4.12.26` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [safe-regex2](https://github.com/fastify/safe-regex2) | `5.0.0` | `5.1.1` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.3` |



Updates `react` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `react-dom` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `react-router` from 7.16.0 to 8.0.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@8.0.0/packages/react-router)

Updates `@hono/node-server` from 1.19.13 to 2.0.5
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.13...v2.0.5)

Updates `@slack/web-api` from 7.15.0 to 7.17.0
- [Release notes](https://github.com/slackapi/node-slack-sdk/releases)
- [Commits](https://github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.15.0...@slack/web-api@7.17.0)

Updates `better-sqlite3` from 12.8.0 to 12.11.1
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v12.8.0...v12.11.1)

Updates `commander` from 14.0.3 to 15.0.0
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](tj/commander.js@v14.0.3...v15.0.0)

Updates `hono` from 4.12.14 to 4.12.26
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.14...v4.12.26)

Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `safe-regex2` from 5.0.0 to 5.1.1
- [Release notes](https://github.com/fastify/safe-regex2/releases)
- [Commits](fastify/safe-regex2@v5.0.0...v5.1.1)

Updates `zod` from 4.3.6 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.4.3)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@slack/web-api"
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: better-sqlite3
  dependency-version: 12.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: commander
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-router
  dependency-version: 7.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: safe-regex2
  dependency-version: 5.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-0763b3c24b branch from 71fa843 to 7adb329 Compare June 18, 2026 15:27
@dependabot @github

dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 19, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-0763b3c24b branch June 19, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@olivrg olivrg Awaiting requested review from olivrg olivrg is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants