Skip to content

build(deps): bump the production-dependencies group across 1 directory with 11 updates - #13

Merged
SenLief merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-60afe431f8
Oct 15, 2026
Merged

build(deps): bump the production-dependencies group across 1 directory with 11 updates#13
SenLief merged 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-60afe431f8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
@astrojs/cloudflare 14.1.3 14.3.0
astro 7.1.1 7.3.1
zod 4.4.3 4.5.4
@hono/zod-validator 0.9.0 0.9.1
@modelcontextprotocol/sdk 1.29.0 1.30.0
agents 0.17.4 0.22.0
hono 4.12.31 4.13.7
jose 6.2.3 6.2.12
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
react-router-dom 7.18.1 7.18.3

Updates @astrojs/cloudflare from 14.1.3 to 14.3.0

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.3.0

Minor Changes

  • #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

    Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

  • #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

    Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

    import { astro, FetchState } from 'astro/fetch';
import { cf, finalize } from '@astrojs/cloudflare/fetch';
export default {
async fetch(request: Request, env: Env, context: ExecutionContext) {
const state = new FetchState(request);
const asset = await cf(state, env, context);
if (asset) return asset;
return finalize(state, await astro(state));

},
};

    The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

  • #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.6

Patch Changes

  • #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

  • #17850 1301c37 Thanks @​matthewp! - Fixes React SSR failures on the first Cloudflare dev request when JSON logging is enabled

  • Updated dependencies [f8e9458]:

    • @​astrojs/internal-helpers@​0.11.0
    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.5

Patch Changes

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.3.0

Minor Changes

  • #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

    Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

  • #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

    Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

    import { astro, FetchState } from 'astro/fetch';
import { cf, finalize } from '@astrojs/cloudflare/fetch';
export default {
async fetch(request: Request, env: Env, context: ExecutionContext) {
const state = new FetchState(request);
const asset = await cf(state, env, context);
if (asset) return asset;
return finalize(state, await astro(state));

},
};

    The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

  • #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

14.2.6

Patch Changes

  • #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

  • #17850 1301c37 Thanks @​matthewp! - Fixes React SSR failures on the first Cloudflare dev request when JSON logging is enabled

  • Updated dependencies [f8e9458]:

    • @​astrojs/internal-helpers@​0.11.0
    • @​astrojs/underscore-redirects@​1.0.4

14.2.5

... (truncated)

Commits

Updates astro from 7.1.1 to 7.3.1

Release notes

Sourced from astro's releases.

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

... (truncated)

Commits

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

  • 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)
  • e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

  • e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
  • 87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines
  • 99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)
  • e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open
  • 7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar
  • eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits
  • e8e206f 4.5.4
  • 84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
  • 1a16102 4.5.3
  • eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
  • 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
  • e3a695b docs(v4): record the email regex and container output-shape findings under Open
  • 99fce39 bench(v4): z.compile() against zod-compiler (#6499)
  • 87d6464 fix(docs): drop the OG description when the title wraps past two lines
  • e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
  • 9a193aa 4.5.2
  • Additional commits viewable in compare view

Updates @hono/zod-validator from 0.9.0 to 0.9.1

Release notes

Sourced from @​hono/zod-validator's releases.

@​hono/zod-validator@​0.9.1

Patch Changes

Changelog

Sourced from @​hono/zod-validator's changelog.

0.9.1

Patch Changes

Commits

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates agents from 0.17.4 to 0.22.0

Release notes

Sourced from agents's releases.

agents@0.22.0

Minor Changes

  • #2071 9620b58 Thanks @​ben-reitz! - Make durable chat recovery unconditional for AIChatAgent and Think.

    Every chat turn now runs in a recovery fiber, including WebSocket, programmatic, retry, and continuation paths. chatRecovery accepts true or a configuration object; false is no longer supported. Previously compiled JavaScript that still supplies false safely receives the default recovery configuration.

    To keep durable bookkeeping while preventing automatic inference after an interruption, return { continue: false } from onChatRecovery(). Use durable cancellation, side-effect, or spend state in that hook and tune chatRecovery budgets when retries must be bounded.

  • #2133 d536067 Thanks @​mattzcarey! - Vendor the required PartyServer runtime into agents/lifecycle and add a reusable Durable Object lifecycle for startup, request interception, alarms, and WebSockets. Agent now directly extends Cloudflare's DurableObject and composes the same lifecycle used by standalone objects; standalone hosts use the explicit Lifecycle.install(this) factory (or the expanded new ... plus installHandlers() form). Both Agent subclasses and standalone hosts use the existing routeAgentRequest() API and /agents URL prefix; the lifecycle entry point does not introduce a second public router.

    Lifecycle WebSockets always use Cloudflare's Hibernation API; the static options.hibernate switch and in-memory connection mode are removed. Named Durable Objects use native ctx.id.name, while a read-only __ps_name fallback migrates objects created by older releases without writing new compatibility state.

  • #2058 381b9bb Thanks @​ben-reitz! - Throttle chat UI updates by default in useAgentChat

    Streaming writes chat state once per chunk, and each write re-renders. When chunks arrive in a burst — a resumed stream replaying a long turn, for example — React reaches its 50-render limit and throws "Maximum update depth exceeded", which the AI SDK reports as a failed turn even though the server completed it (#1913).

    useAgentChat now coalesces those updates every 50ms, which removes about 78% of renders on a fast stream and matches the value the AI SDK documents. The first chunk of a stream is never delayed. Pass throttle: false to render every chunk as it arrives, or a number to change the interval. The deprecated experimental_throttle is still honoured. Message snapshots, functional updates, and streamed continuations resolve against the current chat store, so coalescing renders cannot roll assistant content back to an older snapshot.

  • #1897 29b0107 Thanks @​mattzcarey! - Add Scheduler, a reusable Lifecycle capability for persistent delayed, dated, cron, and interval callbacks, under agents/schedules. Scheduled callbacks are registered on the Scheduler itself (new Scheduler({ callbacks: { ... } })), and set() / every() type both the callback name and the payload against that registration, so the typed scheduling surface and the runtime dispatch target are the same object. LifecycleCapability supplies every capability with storage, readiness, startup state, alarm coordination, a host invocation boundary, best-effort events, and generic capability routing — Scheduler consumes only that standard surface plus its callbacks and policy options, so any host that installs it configures nothing else. Lifecycle owns the physical Durable Object alarm and routes matching capability messages between Agent facets through one internal transport aperture, preserving existing root-owned facet schedule rows without Scheduler-specific Agent RPC methods or an Agent adapter. Agent uses the same Scheduler behind its existing APIs — name-based this.schedule(60, "methodName") keeps dispatching to Agent methods through a composition-root resolver — and preserves callback context, observability, retries, OOM handling, and alarm behavior. MCP now receives storage from Lifecycle when installed. Explicit destruction disposes live capability resources once, then clears shared Durable Object storage with deleteAll(). Think workflow notifications now contribute their wake time through Lifecycle instead of writing the physical alarm directly. The previous agents/schedule parser entry point remains as a deprecated compatibility alias. Agent exposes the composition root as experimental this.lifecycle and this.scheduler properties. The agents/lifecycle entry point and the capability surfaces built on it (Scheduler, installing MCPClientManager directly as a capability) are experimental and may change between releases; Agent's established APIs are unaffected.

    Compatibility notes: MCPClientManagerOptions.storage is removed — the manager receives storage from the Lifecycle it is installed on, so standalone construction with an explicit DurableObjectStorage is no longer supported. Scheduled callbacks now receive the documented parsed Schedule object as their second argument (previously the raw storage row, whose payload was an unparsed JSON string). The internal _cf_*ForFacet schedule RPC methods are replaced by the generic _cf_routeLifecycle capability aperture; facets always run the same deployed script, so no coordination is required.

  • #2161 ded09c6 Thanks @​mattzcarey! - Remove the published agents command-line binary. Its advertised init, dev, deploy, and mcp commands were placeholders that printed "not implemented yet" and exited successfully. Use the documented C3 starter, Vite and Wrangler commands, and MCP APIs instead.

  • #1895 4ba9a37 Thanks @​mattzcarey! - Make MCPClientManager a reusable Durable Object lifecycle capability. It now owns schema initialization, persisted HTTP and RPC connection restoration, and OAuth callback interception when installed with Lifecycle.use(), while preserving Agent.this.mcp and the existing Agent MCP APIs. agents/lifecycle exports the LifecycleObject host interface and canonical getCurrentAgent() accessor; Lifecycle supplies that context to host hooks while capability hooks remain self-contained.

Patch Changes

  • #2027 e87ad62 Thanks @​cjol! - Route asynchronous callable and streaming responses through the facet WebSocket frame that originated each RPC.

  • #1978 b7c7696 Thanks @​Ankcorn! - Add Agents SDK instrumentation and agent instance identity attributes to SDK-created spans.

  • #2050 3b43c33 Thanks @​ben-reitz! - Batch replayed chunks during stream resume so long turns do not exceed React's update limit and report a false error.

  • #2120 b038440 Thanks @​ben-reitz! - Keep Session compaction overlays scoped to their selected conversation branch and preserve deterministic ordering for overlays created in the same second.

  • #2090 2f957bc Thanks @​ben-reitz! - Keep sub-agent WebSocket operations routable and ordered across live and delayed contexts and before broadcasts, report routing failures, and preserve nested sub-agent broadcasts across RPC callbacks.

... (truncated)

Changelog

Sourced from agents's changelog.

0.22.0

Minor Changes

  • #2071 9620b58 Thanks @​ben-reitz! - Make durable chat recovery unconditional for AIChatAgent and Think.

    Every chat turn now runs in a recovery fiber, including WebSocket, programmatic, retry, and continuation paths. chatRecovery accepts true or a configuration object; false is no longer supported. Previously compiled JavaScript that still supplies false safely receives the default recovery configuration.

    To keep durable bookkeeping while preventing automatic inference after an interruption, return { continue: false } from onChatRecovery(). Use durable cancellation, side-effect, or spend state in that hook and tune chatRecovery budgets when retries must be bounded.

  • #2133

@dependabot
build(deps): bump the production-dependencies group across 1 director…
f51ebde 
…y with 11 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.3` | `14.3.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.1` | `7.3.1` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [@hono/zod-validator](https://github.com/honojs/middleware/tree/HEAD/packages/zod-validator) | `0.9.0` | `0.9.1` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.17.4` | `0.22.0` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.7` |
| [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.12` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.1` | `7.18.3` |



Updates `@astrojs/cloudflare` from 14.1.3 to 14.3.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.3.0/packages/integrations/cloudflare)

Updates `astro` from 7.1.1 to 7.3.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.1/packages/astro)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `@hono/zod-validator` from 0.9.0 to 0.9.1
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-validator/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/zod-validator@0.9.1/packages/zod-validator)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `agents` from 0.17.4 to 0.22.0
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.22.0/packages/agents)

Updates `hono` from 4.12.31 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.31...v4.13.7)

Updates `jose` from 6.2.3 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.3...v6.2.12)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `react-router-dom` from 7.18.1 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/zod-validator"
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: agents
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 8, 2026
@SenLief
SenLief merged commit 6c16efe into main Oct 15, 2026
1 check failed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-60afe431f8 branch October 15, 2026 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SenLief