Skip to content

Bump the prod-deps group across 1 directory with 5 updates#64

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/prod-deps-4b782ea8b3
Closed

Bump the prod-deps group across 1 directory with 5 updates#64
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/prod-deps-4b782ea8b3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026

Bumps the prod-deps group with 5 updates in the / directory:

Package From To
fastify 5.7.4 5.8.5
hono 4.12.3 4.12.19
koa 3.1.2 3.2.0
@types/koa 3.0.1 3.0.2
ioredis 5.10.0 5.10.1

Updates fastify from 5.7.4 to 5.8.5

Release notes

Sourced from fastify's releases.

v5.8.5

⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.4...v5.8.5

v5.8.4

Full Changelog: fastify/fastify@v5.8.3...v5.8.4

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

... (truncated)

Commits
  • 3983cce Bumped v5.8.5
  • 3ce3ae6 Merge commit from fork
  • b06a196 docs(ecosystem): add @​pompelmi/fastify-plugin (#6610)
  • 909c5d5 chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 (#6630)
  • 4db21a3 chore: Bump borp from 0.21.0 to 1.0.0 (#6633)
  • 0f4e544 chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 (#6632)
  • 33a2fcd chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 (#6629)
  • fd35d82 ci: reduce cron schedules from daily/weekly to monthly (#6623)
  • 8dee9be fix: restore trustProxy function for number and string types, add null check ...
  • d457aed chore: upgrade to typescript v6.0.2 (#6605)
  • Additional commits viewable in compare view

Updates hono from 4.12.3 to 4.12.19

Release notes

Sourced from hono's releases.

v4.12.19

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.18...v4.12.19

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36


Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

... (truncated)

Commits
  • 7e62bcd 4.12.19
  • e2f252a fix(stream): upgrade @hono/node-server to v2 and fix abort handling (#4940)
  • 54f2f0c feat(request): add bytes() (#4921)
  • e59db59 feat(cache): key cache entries by configured vary headers (#4915)
  • 48a7ccb feat(bearer-auth): make bearerAuth generic for typed context in verifyToken (...
  • ff7522f fix(cookie): return the first cookie when there are multiple cookies with the...
  • 26f8c33 fix(serveStatic): make options parameter optional in all adapters (#4934)
  • 16c4e38 ci: pin GitHub Actions to SHAs (#4932)
  • f10dee8 4.12.18
  • a5bd9eb Merge commit from fork
  • Additional commits viewable in compare view

Updates koa from 3.1.2 to 3.2.0

Release notes

Sourced from koa's releases.

v3.2.0

What's Changed

New Contributors

Full Changelog: koajs/koa@v3.1.2...v3.2.0

Commits

Updates @types/koa from 3.0.1 to 3.0.2

Commits

Updates ioredis from 5.10.0 to 5.10.1

Release notes

Sourced from ioredis's releases.

v5.10.1

5.10.1 (2026-03-19)

Bug Fixes

  • cluster: lazily start sharded subscribers (#2090) (4f167bb)
Changelog

Sourced from ioredis's changelog.

5.10.1 (2026-03-19)

Bug Fixes

  • cluster: lazily start sharded subscribers (#2090) (4f167bb)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the prod-deps group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastify](https://github.com/fastify/fastify) | `5.7.4` | `5.8.5` |
| [hono](https://github.com/honojs/hono) | `4.12.3` | `4.12.19` |
| [koa](https://github.com/koajs/koa) | `3.1.2` | `3.2.0` |
| [@types/koa](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/koa) | `3.0.1` | `3.0.2` |
| [ioredis](https://github.com/luin/ioredis) | `5.10.0` | `5.10.1` |



Updates `fastify` from 5.7.4 to 5.8.5
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.7.4...v5.8.5)

Updates `hono` from 4.12.3 to 4.12.19
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.3...v4.12.19)

Updates `koa` from 3.1.2 to 3.2.0
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@v3.1.2...v3.2.0)

Updates `@types/koa` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/koa)

Updates `ioredis` from 5.10.0 to 5.10.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.10.0...v5.10.1)

---
updated-dependencies:
- dependency-name: fastify
  dependency-version: 5.8.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: hono
  dependency-version: 4.12.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
- dependency-name: koa
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: "@types/koa"
  dependency-version: 3.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: prod-deps
- dependency-name: ioredis
  dependency-version: 5.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 26, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 26, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/develop/prod-deps-4b782ea8b3 branch May 26, 2026 05:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants