Skip to content
This repository was archived by the owner on Mar 21, 2026. It is now read-only.

Bump the npm_and_yarn group across 2 directories with 6 updates#11

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-e897bb03ae
Open

Bump the npm_and_yarn group across 2 directories with 6 updates#11
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-e897bb03ae

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Feb 20, 2026

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
@fedify/fedify 1.8.8 1.8.15
hono 4.9.10 4.11.10
lodash 4.17.21 4.17.23
node-forge 1.3.1 1.3.3
vite 5.4.20 5.4.21

Bumps the npm_and_yarn group with 2 updates in the /jobs/populate-explore-json directory: @fedify/fedify and @smithy/config-resolver.

Updates @fedify/fedify from 1.8.8 to 1.8.15

Release notes

Sourced from @​fedify/fedify's releases.

Fedify 1.8.15

Released on December 20, 2025.

@​fedify/fedify

  • Fixed a ReDoS (Regular Expression Denial of Service) vulnerability in the document loader's HTML parsing. An attacker-controlled server could respond with a malicious HTML payload that blocked the event loop. [CVE-2025-68475]

@​fedify/sqlite

  • Fixed SyntaxError: Identifier 'Temporal' has already been declared error that occurred when using SqliteKvStore on Node.js or Bun. The error was caused by duplicate Temporal imports during the build process. [#487]

Fedify 1.8.14

Released on October 19, 2025.

@​fedify/testing

  • Fixed JSR publishing hanging indefinitely at the processing stage. The issue was caused by TypeScript function overload signatures in MockContext and MockFederation classes that triggered a bug in JSR's type analyzer. All method overloads have been removed and simplified to use any types where necessary. [#468, #470]

@​fedify/cli

  • Fixed fedify command failing on Windows with PermissionDenied error when trying to locate or execute package managers during initialization. The CLI now properly handles *.cmd and *.bat files on Windows by invoking them through cmd /c. [#463]

Fedify 1.8.13

Released on October 10, 2025.

@​fedify/fedify

  • Fixed inconsistent encoding/decoding of URI template identifiers with special characters. Updated uri-template-router to version 1.0.0, which properly decodes percent-encoded characters in URI template variables according to RFC 6570. This resolves issues where identifiers containing URIs (e.g., https%3A%2F%2Fexample.com) were being inconsistently decoded in dispatcher callbacks and double-encoded in collection URLs. [#416]

Fedify 1.8.12

Released on September 20, 2025.

@​fedify/sqlite

  • Fixed bundling issues where incorrect import paths to node_modules were included in the bundled output. The @​js-temporal/polyfill dependency was moved from devDependencies to dependencies to ensure proper bundling.

Fedify 1.8.11

Released on September 17, 2025.

  • Improved the AT Protocol URI workaround to handle all DID methods and edge cases. The fix now properly percent-encodes any authority component in at:// URIs, supporting did:web, did:key, and other DID methods beyond just did:plc. Also handles URIs without path components correctly. [#436]

Fedify 1.8.10

Released on Steptember 17, 2025.

@​fedify/fedify

  • Added a temporary workaround for invalid AT Protocol URIs from BridgyFed. URIs like at://did:plc:... that violate RFC 3986 URI syntax are now automatically URL-encoded to at://did%3Aplc%3A... to prevent parsing failures when processing bridged Bluesky content. [#436]

Fedify 1.8.9

Released on September 10, 2025.

... (truncated)

Changelog

Sourced from @​fedify/fedify's changelog.

Version 1.8.15

Released on December 20, 2025.

@​fedify/fedify

  • Fixed a ReDoS (Regular Expression Denial of Service) vulnerability in the document loader's HTML parsing. An attacker-controlled server could respond with a malicious HTML payload that blocked the event loop. [[CVE-2025-68475]]

@​fedify/sqlite

  • Fixed SyntaxError: Identifier 'Temporal' has already been declared error that occurred when using SqliteKvStore on Node.js or Bun. The error was caused by duplicate Temporal imports during the build process. [#487]

Version 1.8.14

Released on October 19, 2025.

@​fedify/testing

  • Fixed JSR publishing hanging indefinitely at the processing stage. The issue was caused by TypeScript function overload signatures in MockContext and MockFederation classes that triggered a bug in JSR's type analyzer. All method overloads have been removed and simplified to use any types where necessary. [#468, #470]

#470: fedify-dev/fedify#470

@​fedify/cli

  • Fixed fedify command failing on Windows with PermissionDenied error when trying to locate or execute package managers during initialization. The CLI now properly handles *.cmd and *.bat files on Windows by invoking them through cmd /c. [#463]

Version 1.8.13

Released on October 10, 2025.

@​fedify/fedify

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​fedify/fedify since your current version.


Updates hono from 4.9.10 to 4.11.10

Release notes

Sourced from hono's releases.

v4.11.10

What's Changed

  • fix: fixed to be more properly timing safe (Merge commit from fork 91def7ca)

Full Changelog: honojs/hono@v4.11.9...v4.11.10

v4.11.9

What's Changed

Full Changelog: honojs/hono@v4.11.8...v4.11.9

v4.11.8

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.11.7...v4.11.8

v4.11.7

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components

IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

... (truncated)

Commits
  • a40d210 4.11.10
  • 91def7c Merge commit from fork
  • 8b17935 test(types): add regression tests for #4388 (routes before .use() with explic...
  • 4a03f4f doc(jwt): mark options.secret as required in JSDoc (#4718)
  • 7300551 chore(ci): bump typescript-go to the latest (#4716)
  • 4b29780 chore: update Zod import examples to use namespace imports (#4715)
  • 69ad885 4.11.9
  • 3d536ff fix: determine if rendered or not by node.vC[0] instead of referring to `no...
  • 0c1d4c7 fix(url): ignore fragment identifiers in getPath() (#4627)
  • 5ca5c3e 4.11.8
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.17.23

Commits

Updates node-forge from 1.3.1 to 1.3.3

Changelog

Sourced from node-forge's changelog.

1.3.3 - 2025-12-02

Fixed

  • [pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 - 2025-11-25

Security

  • HIGH: ASN.1 Validator Desynchronization
    • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-12816
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: ASN.1 Unbounded Recursion
    • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66031
    • GHSA ID: GHSA-554w-wpv2-vw27
  • MODERATE: ASN.1 OID Integer Truncation
    • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66030
    • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

  • [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
  • [asn1] Add fromDer() max recursion depth check.
    • Add a asn1.maxDepth global configurable maximum depth of 256.
    • Add a asn1.fromDer() per-call maxDepth option.
    • NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.
    • NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default

... (truncated)

Commits

Updates vite from 5.4.20 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

Commits

Updates @fedify/fedify from 1.6.8 to 1.6.13

Release notes

Sourced from @​fedify/fedify's releases.

Fedify 1.8.15

Released on December 20, 2025.

@​fedify/fedify

  • Fixed a ReDoS (Regular Expression Denial of Service) vulnerability in the document loader's HTML parsing. An attacker-controlled server could respond with a malicious HTML payload that blocked the event loop. [CVE-2025-68475]

@​fedify/sqlite

  • Fixed SyntaxError: Identifier 'Temporal' has already been declared error that occurred when using SqliteKvStore on Node.js or Bun. The error was caused by duplicate Temporal imports during the build process. [#487]

Fedify 1.8.14

Released on October 19, 2025.

@​fedify/testing

  • Fixed JSR publishing hanging indefinitely at the processing stage. The issue was caused by TypeScript function overload signatures in MockContext and MockFederation classes that triggered a bug in JSR's type analyzer. All method overloads have been removed and simplified to use any types where necessary. [#468, #470]

@​fedify/cli

  • Fixed fedify command failing on Windows with PermissionDenied error when trying to locate or execute package managers during initialization. The CLI now properly handles *.cmd and *.bat files on Windows by invoking them through cmd /c. [#463]

Fedify 1.8.13

Released on October 10, 2025.

@​fedify/fedify

  • Fixed inconsistent encoding/decoding of URI template identifiers with special characters. Updated uri-template-router to version 1.0.0, which properly decodes percent-encoded characters in URI template variables according to RFC 6570. This resolves issues where identifiers containing URIs (e.g., https%3A%2F%2Fexample.com) were being inconsistently decoded in dispatcher callbacks and double-encoded in collection URLs. [#416]

Fedify 1.8.12

Released on September 20, 2025.

@​fedify/sqlite

  • Fixed bundling issues where incorrect import paths to node_modules were included in the bundled output. The @​js-temporal/polyfill dependency was moved from devDependencies to dependencies to ensure proper bundling.

Fedify 1.8.11

Released on September 17, 2025.

  • Improved the AT Protocol URI workaround to handle all DID methods and edge cases. The fix now properly percent-encodes any authority component in at:// URIs, supporting did:web, did:key, and other DID methods beyond just did:plc. Also handles URIs without path components correctly. [#436]

Fedify 1.8.10

Released on Steptember 17, 2025.

@​fedify/fedify

  • Added a temporary workaround for invalid AT Protocol URIs from BridgyFed. URIs like at://did:plc:... that violate RFC 3986 URI syntax are now automatically URL-encoded to at://did%3Aplc%3A... to prevent parsing failures when processing bridged Bluesky content. [#436]

Fedify 1.8.9

Released on September 10, 2025.

... (truncated)

Changelog

Sourced from @​fedify/fedify's changelog.

Version 1.8.15

Released on December 20, 2025.

@​fedify/fedify

  • Fixed a ReDoS (Regular Expression Denial of Service) vulnerability in the document loader's HTML parsing. An attacker-controlled server could respond with a malicious HTML payload that blocked the event loop. [[CVE-2025-68475]]

@​fedify/sqlite

  • Fixed SyntaxError: Identifier 'Temporal' has already been declared error that occurred when using SqliteKvStore on Node.js or Bun. The error was caused by duplicate Temporal imports during the build process. [#487]

Version 1.8.14

Released on October 19, 2025.

@​fedify/testing

  • Fixed JSR publishing hanging indefinitely at the processing stage. The issue was caused by TypeScript function overload signatures in MockContext and MockFederation classes that triggered a bug in JSR's type analyzer. All method overloads have been removed and simplified to use any types where necessary. [#468, #470]

#470: fedify-dev/fedify#470

@​fedify/cli

  • Fixed fedify command failing on Windows with PermissionDenied error when trying to locate or execute package managers during initialization. The CLI now properly handles *.cmd and *.bat files on Windows by invoking them through cmd /c. [#463]

Version 1.8.13

Released on October 10, 2025.

@​fedify/fedify

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​fedify/fedify since your current version.


Updates @smithy/config-resolver from 4.1.4 to 4.4.6

Release notes

Sourced from @​smithy/config-resolver's releases.

@​smithy/util-defaults-mode-browser@​4.3.32

Patch Changes

  • @​smithy/smithy-client@​4.11.5

@​smithy/middleware-compression@​4.3.31

Patch Changes

  • Updated dependencies [c5db01c]
    • @​smithy/core@​3.23.2

@​smithy/util-defaults-mode-browser@​4.3.31

Patch Changes

  • @​smithy/smithy-client@​4.11.4

@​smithy/util-defaults-mode-browser@​4.3.30

Patch Changes

  • @​smithy/smithy-client@​4.11.3

@​smithy/middleware-compression@​4.3.30

Patch Changes

  • Updated dependencies [6f96c01]
    • @​smithy/core@​3.23.1

@​smithy/util-defaults-mode-browser@​4.3.29

Patch Changes

  • @​smithy/smithy-client@​4.11.2

@​smithy/middleware-compression@​4.3.29

Patch Changes

  • Updated dependencies [4f05c6a]
    • @​smithy/core@​3.23.0

@​smithy/util-defaults-mode-browser@​4.3.28

Patch Changes

  • @​smithy/smithy-client@​4.11.1

@​smithy/middleware-compression@​4.3.28

Patch Changes

  • @​smithy/core@​3.22.1

@​smithy/middleware-compression@​4.3.27

Patch Changes

... (truncated)

Changelog

Sourced from @​smithy/config-resolver's changelog.

4.4.6

Patch Changes

  • Updated dependencies [745867a]
    • @​smithy/types@​4.12.0
    • @​smithy/node-config-provider@​4.3.8
    • @​smithy/util-endpoints@​3.2.8
    • @​smithy/util-middleware@​4.2.8

4.4.5

Patch Changes

  • Updated dependencies [9ccb841]
    • @​smithy/types@​4.11.0
    • @​smithy/node-config-provider@​4.3.7
    • @​smithy/util-endpoints@​3.2.7
    • @​smithy/util-middleware@​4.2.7

4.4.4

Patch Changes

  • Updated dependencies [5a56762]
    • @​smithy/types@​4.10.0
    • @​smithy/node-config-provider@​4.3.6
    • @​smithy/util-endpoints@​3.2.6
    • @​smithy/util-middleware@​4.2.6

4.4.3

Patch Changes

  • Updated dependencies [3926fd7]
    • @​smithy/types@​4.9.0
    • @​smithy/node-config-provider@​4.3.5
    • @​smithy/util-endpoints@​3.2.5
    • @​smithy/util-middleware@​4.2.5

4.4.2

Patch Changes

  • 372b46f: allow * region with warning

4.4.1

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 2 directories with 6 updates
dbb614c 
Bumps the npm_and_yarn group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@fedify/fedify](https://github.com/fedify-dev/fedify/tree/HEAD/packages/fedify) | `1.8.8` | `1.8.15` |
| [hono](https://github.com/honojs/hono) | `4.9.10` | `4.11.10` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.3.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.20` | `5.4.21` |

Bumps the npm_and_yarn group with 2 updates in the /jobs/populate-explore-json directory: [@fedify/fedify](https://github.com/fedify-dev/fedify/tree/HEAD/packages/fedify) and [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver).


Updates `@fedify/fedify` from 1.8.8 to 1.8.15
- [Release notes](https://github.com/fedify-dev/fedify/releases)
- [Changelog](https://github.com/fedify-dev/fedify/blob/main/CHANGES.md)
- [Commits](https://github.com/fedify-dev/fedify/commits/1.8.15/packages/fedify)

Updates `hono` from 4.9.10 to 4.11.10
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.9.10...v4.11.10)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `node-forge` from 1.3.1 to 1.3.3
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.3.1...v1.3.3)

Updates `vite` from 5.4.20 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)

Updates `@fedify/fedify` from 1.6.8 to 1.6.13
- [Release notes](https://github.com/fedify-dev/fedify/releases)
- [Changelog](https://github.com/fedify-dev/fedify/blob/main/CHANGES.md)
- [Commits](https://github.com/fedify-dev/fedify/commits/1.8.15/packages/fedify)

Updates `@smithy/config-resolver` from 4.1.4 to 4.4.6
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@4.4.6/packages/config-resolver)

---
updated-dependencies:
- dependency-name: "@fedify/fedify"
  dependency-version: 1.8.15
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.11.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-version: 1.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 5.4.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@fedify/fedify"
  dependency-version: 1.6.13
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@smithy/config-resolver"
  dependency-version: 4.4.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 20, 2026
@dependabot dependabot bot mentioned this pull request Feb 20, 2026
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants