Skip to content

Bump the minor-and-patch group across 1 directory with 8 updates#33

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-24268de576
Closed

Bump the minor-and-patch group across 1 directory with 8 updates#33
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-24268de576

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 10, 2026 •
edited
Loading

Bumps the minor-and-patch group with 8 updates in the / directory:

Package From To
oxfmt 0.46.0 0.47.0
oxlint 1.61.0 1.62.0
es-toolkit 1.46.0 1.46.1
zod 4.3.6 4.4.2
hono 4.12.15 4.12.16
otpauth 9.5.0 9.5.1
@cloudflare/workers-types 4.20260426.1 4.20260503.1
wrangler 4.85.0 4.87.0

Updates oxfmt from 0.46.0 to 0.47.0

Commits

Updates oxlint from 1.61.0 to 1.62.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

  • 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
  • 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
  • bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
  • 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
  • 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
  • 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
  • ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

  • 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
  • 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
  • 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
  • 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
  • a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
  • ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
  • 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
  • ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
  • e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
  • 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
  • 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
  • fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
  • ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
  • dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
  • 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
  • cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

  • 25d577e language_server: Start tools in parallel (#15500) (Sysix)
  • 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
  • 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
  • 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
  • 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
  • 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

  • 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
  • 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
  • a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
  • 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
  • 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
  • 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.62.0] - 2026-04-27

🚀 Features

  • 348f46c linter: Add respectEslintDisableDirectives option (#21384) (Christian Vuerings)

🐛 Bug Fixes

  • 8c425db linter: Allow string for jest version in config schema (#21649) (camc314)
Commits

Updates es-toolkit from 1.46.0 to 1.46.1

Release notes

Sourced from es-toolkit's releases.

v1.46.1

Released on April 29th, 2026.

  • Fixed AbortError and TimeoutError to fall back to Error when DOMException is undefined. ([#1694])
  • Fixed missing forEach and countBy exports for map and set. ([#1695])

We sincerely thank @​SrAnthony and @​umsungjun for their contributions. We appreciate your great efforts!

Changelog

Sourced from es-toolkit's changelog.

Version v1.46.1

Released on April 29th, 2026.

  • Fixed AbortError and TimeoutError to fall back to Error when DOMException is undefined. (#1694)
  • Fixed missing forEach and countBy exports for map and set. (#1695)

We sincerely thank @​SrAnthony and @​umsungjun for their contributions. We appreciate your great efforts!

Commits
  • 0e8656d v1.46.1
  • 29d5e41 fix: DOMException might be undefined
  • 810e2c7 fix(AbortError, TimeoutError): fall back to Error when DOMException is undefi...
  • 50d799e fix: add missing forEach/countBy exports to map and set (#1695)
  • d19ddb0 docs: Add canonical URL
  • a1c3249 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#1697)
  • 7534358 build(deps): bump autofix-ci/action from 1.3.3 to 1.3.4 (#1696)
  • See full diff in compare view

Updates zod from 4.3.6 to 4.4.2

Release notes

Sourced from zod's releases.

v4.4.2

Commits:

  • 0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (#5901)
  • 20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps
  • 6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)
  • 4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing
  • bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents
  • cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
  • 292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor
  • 1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion
  • 1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance
  • e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes
  • e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights
  • 905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing
  • bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md
  • 8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch
  • 02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (#5929)
  • 88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated baseUrl from tsconfig
  • c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2

v4.4.1

Commits:

  • 481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow
  • 95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations
  • cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes before required defaults (#5900)
  • edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1
  • 180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured sponsor

v4.4.0

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

Tuple defaults now materialize output values correctly

Fixed in #5661. Tuple parsing now more accurately reflects defaults, optional tails, explicit undefined, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output.

const schema = z.tuple([
  z.string(),
  z.string().default("fallback"),
]);
schema.parse(["a"]);
// ["a", "fallback"]

... (truncated)

Commits
  • c59d447 4.4.2
  • 88015df fix(docs): drop deprecated baseUrl from tsconfig
  • 02c2baf Make z.preprocess defer optionality to inner schema (#5929)
  • 8ec4e73 chore: update play.ts scratch
  • bf64bac chore: tighten test guidance in AGENTS.md
  • 905761a docs: document preprocess input type narrowing
  • e58ea4d docs: test Zod Mini tab code heights
  • e20d02b chore: ignore triage notes
  • 1373c85 docs: remove AI disclosure guidance
  • 1fc9f31 docs: document codec inversion
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Updates hono from 4.12.15 to 4.12.16

Release notes

Sourced from hono's releases.

v4.12.16

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

Commits

Updates otpauth from 9.5.0 to 9.5.1

Release notes

Sourced from otpauth's releases.

v9.5.1

What's Changed

Full Changelog: hectorm/otpauth@v9.5.0...v9.5.1

Commits
  • 4903d3d 9.5.1
  • b5c6df7 Add 7 day cooldown for new dependency versions
  • 01f7caf Update dependencies
  • adff202 Bump the npm-development-minor-patch group across 1 directory with 8 updates ...
  • 0e4fa84 Bump @​noble/hashes in the npm-production-minor-patch group (#688)
  • b7f24c9 Bump the github-actions-all group with 4 updates (#692)
  • 80b053d Bump flatted from 3.3.3 to 3.4.2 (#682)
  • 4d0f0cc Bump picomatch from 4.0.3 to 4.0.4 (#684)
  • 2f0e384 Bump the github-actions-all group with 5 updates (#685)
  • 7097f14 Bump the npm-development-minor-patch group across 1 directory with 8 updates ...
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 4.20260426.1 to 4.20260503.1

Commits

Updates wrangler from 4.85.0 to 4.87.0

Release notes

Sourced from wrangler's releases.

wrangler@4.87.0

Minor Changes

  • #13726 b5ac54b Thanks @​penalosa! - Hard fail on Node.js < 22

    Wrangler no longer supports Node.js 20.x, as it reached end-of-life on 2026-04-30. The minimum supported Node.js version is now 22.0.0. See https://github.com/nodejs/release?tab=readme-ov-file#end-of-life-releases.

  • #13717 9a1f014 Thanks @​NuroDev! - Add an experimental experimental_generateTypes() programmatic API.

    Wrangler now exposes experimental_generateTypes() from the package root so you can generate Worker types in code using the same logic as wrangler types. The API supports the same core type-generation options (include env/runtime toggles) and returns structured output with separate env and runtime content alongside the combined formatted output.

Patch Changes

  • #13732 22e1a61 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260426.1 1.20260429.1

  • #13754 00523c8 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260429.1 1.20260430.1

  • #13711 1c4d850 Thanks @​dario-piotrowicz! - fix: skip auto-config and OpenNext delegation when --config is explicitly provided

    When --config is passed to wrangler deploy, the user is explicitly targeting a specific Worker configuration. Previously, wrangler would ignore --config and delegate to opennextjs-cloudflare deploy if it detected an OpenNext project in the working directory, silently deploying the wrong Worker. Now, both auto-config detection and OpenNext delegation are skipped when --config is provided, matching the existing behavior for --script and --assets.

  • #13735 6d28037 Thanks @​edmundhung! - Improve config-schema.json hover text in more editors

    Wrangler now emits markdownDescription in config-schema.json alongside the existing description field. Editors that support rich JSON Schema hovers can use that markdown directly instead of rendering escaped links and formatting.

  • #13722 0827815 Thanks @​MattieTK! - Improve safe telemetry categorisation for user-facing Wrangler errors.

  • #13116 e539008 Thanks @​dario-piotrowicz! - Allow getPlatformProxy and unstable_getMiniflareWorkerOptions to start when the assets directory does not exist yet

    Previously, getPlatformProxy would catch and swallow NonExistentAssetsDirError internally when the configured assets directory was absent on disk. This has been refactored so that the directory-existence check is skipped entirely for getPlatformProxy and unstable_getMiniflareWorkerOptions, since these APIs are typically used at dev time in frameworks where the assets directory is a build output that may not exist yet.

    wrangler dev, wrangler deploy, wrangler versions upload, and wrangler triggers deploy continue to require the assets directory to exist when specified.

  • Updated dependencies [22e1a61, 00523c8, b5ac54b, e653edf, e1eff94, e539008, 0bf64a7, b04eedf, 6457fb3, c07d0cb]:

    • miniflare@4.20260430.0
    • @​cloudflare/kv-asset-handler@​0.5.0

wrangler@4.86.0

... (truncated)

Commits
  • 47cf644 Version Packages (#13714)
  • e653edf fix(miniflare): expose send_email in platform proxy (#13723)
  • 0827815 [wrangler] Add safe telemetry labels for user errors (#13722)
  • 9a1f014 feat(wrangler): Add programmatic type generation API (#13717)
  • e539008 Allow users to run getPlatformProxy on static asset workers when the assets...
  • 00523c8 Bump the workerd-and-workers-types group with 2 updates (#13754)
  • 6d28037 fix(wrangler): emit markdownDescription in config schema (#13735)
  • 22e1a61 Bump the workerd-and-workers-types group with 2 updates (#13732)
  • b5ac54b Hard fail on Node.js < 22 (#13726)
  • 0bf64a7 fix(miniflare): Skip creating hyperdrive proxy server for local database (#13...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-and-patch group across 1 directory with 8 updates
a183172 
Bumps the minor-and-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.46.0` | `0.47.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.61.0` | `1.62.0` |
| [es-toolkit](https://github.com/toss/es-toolkit) | `1.46.0` | `1.46.1` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.2` |
| [hono](https://github.com/honojs/hono) | `4.12.15` | `4.12.16` |
| [otpauth](https://github.com/hectorm/otpauth) | `9.5.0` | `9.5.1` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260426.1` | `4.20260503.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.85.0` | `4.87.0` |



Updates `oxfmt` from 0.46.0 to 0.47.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.47.0/npm/oxfmt)

Updates `oxlint` from 1.61.0 to 1.62.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.62.0/npm/oxlint)

Updates `es-toolkit` from 1.46.0 to 1.46.1
- [Release notes](https://github.com/toss/es-toolkit/releases)
- [Changelog](https://github.com/toss/es-toolkit/blob/main/CHANGELOG.md)
- [Commits](toss/es-toolkit@v1.46.0...v1.46.1)

Updates `zod` from 4.3.6 to 4.4.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.4.2)

Updates `hono` from 4.12.15 to 4.12.16
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.16)

Updates `otpauth` from 9.5.0 to 9.5.1
- [Release notes](https://github.com/hectorm/otpauth/releases)
- [Commits](hectorm/otpauth@v9.5.0...v9.5.1)

Updates `@cloudflare/workers-types` from 4.20260426.1 to 4.20260503.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.85.0 to 4.87.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.87.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: oxfmt
  dependency-version: 0.47.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: es-toolkit
  dependency-version: 1.46.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.12.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: otpauth
  dependency-version: 9.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 4.20260503.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.87.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 10, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented May 10, 2026 •
edited
Loading

Deploying differ-web with  Cloudflare Pages  Cloudflare Pages

Latest commit: a183172
Status: ✅  Deploy successful!
Preview URL: https://8596d69e.differ-web.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-mino.differ-web.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 10, 2026
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 17, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 17, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-24268de576 branch May 17, 2026 21:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants