Skip to content

chore(deps): bump the npm-minor-and-patch group across 2 directories with 15 updates - #17

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-dd7e851e91
Closed

chore(deps): bump the npm-minor-and-patch group across 2 directories with 15 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-dd7e851e91

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 6 updates in the / directory:

Package From To
hono 4.13.1 4.13.8
@cloudflare/vitest-pool-workers 0.20.3 0.22.0
@cloudflare/workers-types 5.20260810.1 5.20260917.1
@types/node 26.2.0 26.6.1
sharp 0.35.3 0.35.4
wrangler 4.120.0 4.134.0
@types/node 26.2.0 26.6.1

Bumps the npm-minor-and-patch group with 10 updates in the /frontend directory:

Package From To
@types/node 26.2.0 26.6.1
axios 1.19.0 1.20.0
element-plus 2.14.4 2.14.5
pinia 4.0.2 4.0.3
vue 3.5.41 3.5.43
vue-router 5.2.0 5.3.1
@types/node 26.2.0 26.6.1
@vitejs/plugin-vue 6.0.8 6.0.9
sass 1.102.0 1.104.1
vite 8.2.1 8.3.0
vue-tsc 3.3.9 3.3.11

Updates hono from 4.13.1 to 4.13.8

Release notes

Sourced from hono's releases.

v4.13.8

What's Changed

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

... (truncated)

Commits
  • 098e119 4.13.8
  • e8c8c21 perf(jsx/dom): optimize matching-head child lookup during reconciliation (#5329)
  • 8755b17 docs(combine): fix except() JSDoc param and add missing @​returns (#5346)
  • edd138e fix(request): keep the request media type when reusing a cached body (#5366)
  • 9b4e9c2 fix(accept): clamp a negative q to 0, not 1 (#5357)
  • 65cff90 fix(accept): treat the q parameter name as case-insensitive (#5349)
  • f147de5 fix(accepts, language): skip accept entries with quality 0 when matching (#5311)
  • 90e1b94 fix(aws-lambda): respect backpressure when streaming the response body (#5351)
  • 7792f5d perf(jsx/dom): reduce lookup work for large keyed updates (#5340)
  • e7b38ee docs: fix typos in code comments and link third-party middleware section (#5343)
  • Additional commits viewable in compare view

Updates @cloudflare/vitest-pool-workers from 0.20.3 to 0.22.0

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

0.21.3

Patch Changes

0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

... (truncated)

Commits
  • 8ee43f6 Version Packages (#15175)
  • 3ddd3ce Fix module resolution for relative require() inside CJS deps when the proje...
  • 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
  • 2cf3143 [vitest-pool-workers] Restore typed inject() keys (#15150)
  • 49d4e00 [vitest-pool-workers] Adopt @​msw/cloudflare and remove MSW workarounds (#13830)
  • c576a82 Version Packages (#15154)
  • e5d56e9 Version Packages (#15145)
  • d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
  • 90dd5e5 chore: bump capnp-es to 0.0.15 (#15131)
  • 15fc568 Version Packages (#15118)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260810.1 to 5.20260917.1

Commits

Updates @types/node from 26.2.0 to 26.6.1

Commits

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view

Updates wrangler from 4.120.0 to 4.134.0

Release notes

Sourced from wrangler's releases.

wrangler@4.134.0

Minor Changes

  • #15684 6874aa9 Thanks @​Ankcorn! - Add support for configuring real-time Issues with observability.issues.enabled

    Wrangler now validates and uploads the Issues setting alongside the existing logs and traces observability options. The experimental configuration format supports the equivalent observability.issues.enabled option.

  • #15681 d96b319 Thanks @​podonnell-dev! - Mark wrangler preview commands as open beta

    Wrangler now labels Preview commands as open beta in help output and command warnings, matching the feature's public availability.

  • #15673 2b39fc2 Thanks @​ghostwriternr! - Support explicit named Container image selection in Wrangler local development

    Wrangler builds or pulls named images configured through Wrangler JSON or TOML and exposes their local tags through ctx.container.images. Pass one of those references to ctx.container.start({ image }) to select the image.

    This extends the experimental Durable Object-managed Containers interface. Named images are opt-in and do not become the Container's default image. A Container without a default image must supply an image or full Container snapshot when starting.

Patch Changes

wrangler@4.133.0

Minor Changes

  • #15600 bac0c6a Thanks @​podonnell-dev! - Add placement configuration for Previews

    You can now configure placement in the previews block. Preview-specific placement overrides the top-level placement configuration for Preview Defaults and deployments.

  • #15600 bac0c6a Thanks @​podonnell-dev! - Improve onboarding guidance for Previews (when previews block is missing from configuration file)

    When a local previews block is absent, Wrangler writes the Preview Base configuration to the local config file. When no Preview Base configuration exists, Wrangler prints a placeholder configuration derived from production bindings and warns against reusing production binding configuration.

Patch Changes

  • #15483 71b6f10 Thanks @​tpmmorris! - Align Local Explorer Workflow instance status requests with production

    Local Explorer and Wrangler local mode now use the production-compatible status request field for pausing, resuming, restarting, and terminating Workflow instances. Direct Local Explorer API consumers must replace the previous action field with status.

    Successful Local Explorer status updates now return the production-compatible instance status and response timestamp instead of the local-only result.success acknowledgement.

... (truncated)

Commits

Updates @types/node from 26.2.0 to 26.6.1

Commits

Updates @types/node from 26.2.0 to 26.6.1

Commits

Updates axios from 1.19.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view

Updates element-plus from 2.14.4 to 2.14.5

Release notes

Sourced from element-plus's releases.

2.14.5

2026-08-21

Features

Bug fixes

  • Components [form-item] add alert role to validation message (#24680 by @​lazerg)
  • Components [input] expose word limit count to screen readers (#24679 by @​lazerg)
  • Components [date-picker] keep disabled-date reactive in panels (#24708 by @​lazerg)
  • Components [textarea] prevent autosize scroll reset in Firefox (#24724 by @​rzzf)
  • Components [date-picker] remove keyboard navigation for quarters (#24726 by @​keeplearning66)
  • Components [loading] loading spinner jiggling issue on chrome (#24737 by @​jiangyi1985)
  • Components [tabs] ssr env setting the default value causes tab to flicker (#24742 by @​btea)
  • Components [select] match input wrapper transition (#24709 by @​lazerg)
  • Components [tree-v2] sync checked state after clearing keys (#24756 by @​rzzf)
Changelog

Sourced from element-plus's changelog.

2.14.5

2026-08-21

Features

Bug fixes

  • Components [form-item] add alert role to validation message (#24680 by @​lazerg)
  • Components [input] expose word limit count to screen readers (#24679 by @​lazerg)
  • Components [date-picker] keep disabled-date reactive in panels (#24708 by @​lazerg)
  • Components [textarea] prevent autosize scroll reset in Firefox (#24724 by @​rzzf)
  • Components [date-picker] remove keyboard navigation for quarters (#24726 by @​keeplearning66)
  • Components [loading] loading spinner jiggling issue on chrome (#24737 by @​jiangyi1985)
  • Components [tabs] ssr env setting the default value causes tab to flicker (#24742 by @​btea)
  • Components [select] match input wrapper transition (#24709 by @​lazerg)
  • Components [tree-v2] sync checked state after clearing keys (#24756 by @​rzzf)
Commits
  • ba62d63 Merge pull request #24761 from element-plus/dev
  • bd5662e chore: Update changelog 2.14.5 (#24762)
  • 56cecb1 fix(components): [tree-v2] sync checked state after clearing keys (#24756)
  • e34196a fix(components): [select] match input wrapper transition (#24709)
  • 147d870 fix(components): [tabs] ssr env setting the default value causes tab to flick...
  • 23d35d6 chore(deps): update dependency @​vueuse/core to v14.4.0 (#24634)
  • 72bea3f feat(theme-chalk): expose form item margin bottom variable (#24752)
  • 3b155df chore(deps): update dependency vue-tsc to v3.3.10 (#24745)
  • c42c1bd fix(components): [loading] loading spinner jiggling issue on chrome (#24737)
  • ebe5edb chore(deps): update pnpm to v11.22.0 (#24734)
  • Additional commits viewable in compare view

Updates pinia from 4.0.2 to 4.0.3

Commits

Updates vue from 3.5.41 to 3.5.43

Release notes

Sourced from vue's releases.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.43 (2026-09-17)

Bug Fixes

  • compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
  • compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
  • compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
  • compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
  • hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
  • reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
  • runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
  • shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
  • shared: preserve comment-like text in style values (#15471) (b9456cb)
  • suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
  • suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
  • suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
  • suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
  • types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

Bug Fixes

  • hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
  • hydration: handle moving unresolved async fragment (#15263) (a72036f)
  • runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
  • runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
  • runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
  • runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
  • server-renderer: reject CR in attribute names (#15266) (a2b40db)
  • shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
  • suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
  • v-model: re-sync select when model is overridden in change handler (#15298) (

@dependabot
chore(deps): bump the npm-minor-and-patch group across 2 directories …
e357f59 
…with 15 updates

Bumps the npm-minor-and-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.8` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.20.3` | `0.22.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260810.1` | `5.20260917.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.1` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.120.0` | `4.134.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.1` |

Bumps the npm-minor-and-patch group with 10 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.1` |
| [axios](https://github.com/axios/axios) | `1.19.0` | `1.20.0` |
| [element-plus](https://github.com/element-plus/element-plus) | `2.14.4` | `2.14.5` |
| [pinia](https://github.com/vuejs/pinia) | `4.0.2` | `4.0.3` |
| [vue](https://github.com/vuejs/core) | `3.5.41` | `3.5.43` |
| [vue-router](https://github.com/vuejs/router) | `5.2.0` | `5.3.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.1` |
| [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue) | `6.0.8` | `6.0.9` |
| [sass](https://github.com/sass/dart-sass) | `1.102.0` | `1.104.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.3.0` |
| [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.9` | `3.3.11` |



Updates `hono` from 4.13.1 to 4.13.8
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.8)

Updates `@cloudflare/vitest-pool-workers` from 0.20.3 to 0.22.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 5.20260810.1 to 5.20260917.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/node` from 26.2.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `wrangler` from 4.120.0 to 4.134.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.134.0/packages/wrangler)

Updates `@types/node` from 26.2.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/node` from 26.2.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `axios` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.19.0...v1.20.0)

Updates `element-plus` from 2.14.4 to 2.14.5
- [Release notes](https://github.com/element-plus/element-plus/releases)
- [Changelog](https://github.com/element-plus/element-plus/blob/dev/CHANGELOG.en-US.md)
- [Commits](element-plus/element-plus@2.14.4...2.14.5)

Updates `pinia` from 4.0.2 to 4.0.3
- [Release notes](https://github.com/vuejs/pinia/releases)
- [Commits](vuejs/pinia@v4.0.2...v4.0.3)

Updates `vue` from 3.5.41 to 3.5.43
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.41...v3.5.43)

Updates `vue-router` from 5.2.0 to 5.3.1
- [Release notes](https://github.com/vuejs/router/releases)
- [Commits](vuejs/router@v5.2.0...v5.3.1)

Updates `@types/node` from 26.2.0 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-vue` from 6.0.8 to 6.0.9
- [Release notes](https://github.com/vitejs/vite-plugin-vue/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.9/packages/plugin-vue)

Updates `sass` from 1.102.0 to 1.104.1
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.102.0...1.104.1)

Updates `vite` from 8.2.1 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

Updates `vue-tsc` from 3.3.9 to 3.3.11
- [Release notes](https://github.com/vuejs/language-tools/releases)
- [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vuejs/language-tools/commits/v3.3.11/packages/tsc)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260917.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.134.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: element-plus
  dependency-version: 2.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: pinia
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: vue
  dependency-version: 3.5.43
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: vue-router
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitejs/plugin-vue"
  dependency-version: 6.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: sass
  dependency-version: 1.104.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: vue-tsc
  dependency-version: 3.3.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 22, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-dd7e851e91 branch September 22, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants