feat(deps): bump the minor group across 1 directory with 13 updates

[dependabot]

Bumps the minor group with 4 updates in the / directory: @anthropic-ai/claude-agent-sdk, express-rate-limit, fast-uri and hono.

Updates @anthropic-ai/claude-agent-sdk from 0.2.126 to 0.2.131

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.2.131

What's changed

• Updated to parity with Claude Code v2.1.131

Update

npm install @anthropic-ai/claude-agent-sdk@0.2.131
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.131
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.131
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.131

v0.2.129

What's changed

• Updated to parity with Claude Code v2.1.129

Update

npm install @anthropic-ai/claude-agent-sdk@0.2.129
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.129
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.129
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.129

v0.2.128

What's changed

• Updated to parity with Claude Code v2.1.128

Update

npm install @anthropic-ai/claude-agent-sdk@0.2.128
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.128
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.128
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.128

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.2.131

• Updated to parity with Claude Code v2.1.131

0.2.130

• Updated to parity with Claude Code v2.1.130

0.2.129

• Updated to parity with Claude Code v2.1.129

0.2.128

• Updated to parity with Claude Code v2.1.128

0.2.127

• Updated to parity with Claude Code v2.1.127

Commits

• 0fe2005 chore: Update CHANGELOG.md
• 7bc3bd7 chore: Update CHANGELOG.md
• e76e325 chore: Update CHANGELOG.md
• See full diff in compare view

Updates @anthropic-ai/claude-agent-sdk-darwin-arm64 from 0.2.126 to 0.2.131

Updates @anthropic-ai/claude-agent-sdk-darwin-x64 from 0.2.126 to 0.2.131

Updates @anthropic-ai/claude-agent-sdk-linux-arm64 from 0.2.126 to 0.2.131

Updates @anthropic-ai/claude-agent-sdk-linux-arm64-musl from 0.2.126 to 0.2.131

Updates @anthropic-ai/claude-agent-sdk-linux-x64 from 0.2.126 to 0.2.131

Updates @anthropic-ai/claude-agent-sdk-linux-x64-musl from 0.2.126 to 0.2.131

Updates @anthropic-ai/claude-agent-sdk-win32-arm64 from 0.2.126 to 0.2.131

Updates @anthropic-ai/claude-agent-sdk-win32-x64 from 0.2.126 to 0.2.131

Updates express-rate-limit from 8.4.1 to 8.5.1

Release notes

Sourced from express-rate-limit's releases.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

Commits

• 50cc3f6 8.5.1
• 92c8e3e chore: bump ip-address library to latest (#626)
• 807e383 8.5.0
• b844137 v8.5.0 changelog
• ceaffab feat: async store init (#621)
• See full diff in compare view

Updates fast-uri from 3.1.1 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

• Fix for GHSA-v39h-62p7-jpjc

What's Changed

• Handle malformed fragment decoding as a parse error by @​mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

Commits

• 919dd8e Bumped v3.1.2
• c65ba57 fixup: linting
• 6c86c17 Merge commit from fork
• a95158a Handle malformed fragment decoding without throwing (#171)
• See full diff in compare view

Updates hono from 4.12.16 to 4.12.18

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

---

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

• fix(jsx): normalize SVG attributes on the root element by @​kfly8 in honojs/hono#4893
• fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @​yuintei in honojs/hono#4899
• fix(cors): make origin optional in CORSOptions by @​truffle-dev in honojs/hono#4905
• fix(types): propagate middleware response types to app.on overloads by @​T4ko0522 in honojs/hono#4906

New Contributors

• @​kfly8 made their first contribution in honojs/hono#4893
• @​truffle-dev made their first contribution in honojs/hono#4905

Full Changelog: honojs/hono@v4.12.16...v4.12.17

Commits

• f10dee8 4.12.18
• a5bd9eb Merge commit from fork
• 58d3d3a Merge commit from fork
• 568c2ec Merge commit from fork
• ff2b3d3 4.12.17
• 52aaaf9 fix(types): propagate middleware response types to app.on overloads (#4906)
• 76d5589 fix(cors): make origin optional in CORSOptions (#4905)
• 8f027e5 fix(ssg): add atom+xml and rss+xml to defaultExtensionMap (#4899)
• bfba97c fix(jsx): normalize SVG attributes on the <svg> root element (#4893)
• See full diff in compare view

Updates ip-address from 10.1.0 to 10.2.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.