chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #1

dependabot · 2025-12-08T04:38:49Z

Bumps the npm_and_yarn group with 2 updates in the / directory: hono and vite.

Updates hono from 4.9.7 to 4.10.3

Release notes

v4.10.3

Securiy Fix

A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.

What's Changed

fix(aws-lambda): serve microsoft office files as binary in lambda handler by @matthiasfeist in honojs/hono#4469

fix(request-id): validation accepts = by @ryuapp in honojs/hono#4478

refactor(jwt): reduce the size of the code generated by minification by @usualoma in honojs/hono#4480

New Contributors

@matthiasfeist made their first contribution in honojs/hono#4469

Full Changelog: honojs/hono@v4.10.2...v4.10.3

v4.10.2

Security hardening improvement

If you are using JWT middleware, please read the following and consider applying the configuration.

Improper Authorization in Hono (JWT Audience Validation)

Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up).

The issue is addressed by adding a new verification.aud configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification.

Recommended secure configuration

You can enable RFC 7519–compliant audience validation using the new verification.aud option:
import { Hono } from 'hono'
import { jwt } from 'hono/jwt'
const app = new Hono()
app.use(
'/api/*',
jwt({
secret: 'my-secret',
verification: {
// Require this API to only accept tokens with aud = 'service-a'
aud: 'service-a',
},
})
)
What's Changed

tests: Fix test case of handlers without a path by @IAmSSH in honojs/hono#4472

... (truncated)

Commits

fcefd50 4.10.3
95ae4d3 refactor(jwt): reduce the size of the code generated by minification (#4480)
d9b8b4b Merge commit from fork
5216117 fix(request-id): validation accepts = (#4478)
253ec28 fix(aws-lambda): serve microsoft office files as binary in lambda handler (#4...
0c6455d 4.10.2
45ba3bf Merge commit from fork
4cbad8b tests: Fix test case of handlers without a path (#4472)
db764c2 4.10.1
8774bf9 fix(types): cannot .use non-return mw from createMiddleware (#4465)
Additional commits viewable in compare view

Updates vite from 6.3.6 to 6.4.1

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

Commits

5003434 fix(preview): use host url to open browser (#19836)
bf9728e release: v6.3.0-beta.2
380c10e fix(hmr): run HMR handler sequentially (#19793)
8bed1de fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794)
0a0c50a refactor: simplify pluginFilter implementation (#19828)
59d0b35 perf(css): avoid constructing renderedModules (#19775)
175a839 fix: reject requests with # in request-target (#19830)
e2e11b1 fix(module-runner): allow already resolved id as entry (#19768)
7200dee fix: correct the behavior when multiple transform filter options are specifie...
b125172 fix(css): remove empty chunk imports correctly when chunk file name contained...
Additional commits viewable in compare view

Updates estree-util-value-to-estree from 3.3.2 to 3.5.0

Release notes

Sourced from estree-util-value-to-estree's releases.

v3.5.0

af5a2bd Add support for serializing custom values in remcohaszing/estree-util-value-to-estree#6

ec6da00 Allow passing undefined as any option

Full Changelog: remcohaszing/estree-util-value-to-estree@v3.4.1...v3.5.0

v3.4.1

87309dc Use OIDC for publishing

8b3ea8d Update Temporal support

Full Changelog: remcohaszing/estree-util-value-to-estree@v3.4.0...v3.4.1

v3.4.0

23b636f Declare there are no side effects in package.json

471b4fe Add support for Float16Array

Full Changelog: remcohaszing/estree-util-value-to-estree@v3.3.3...v3.4.0

v3.3.3

652e019 Use singular Object.defineProperty if possible

d0c394f Fix __proto__ property emit

Full Changelog: remcohaszing/estree-util-value-to-estree@v3.3.2...v3.3.3

Commits

c845e04 3.5.0
2f6a020 Stricten tsconfig.json
ec6da00 Allow passing undefined as any option
af5a2bd Add support for serializing custom values (#6)
ecac810 Fix a typo
aa90de2 3.4.1
87309dc Use OIDC for publishing
db5911c Use Node.js 24 in CI
4e2914e Update the readme
8b3ea8d Update Temporal support
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for estree-util-value-to-estree since your current version.

Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

What's Changed

Migrate CI pipeline to GitHub actions by @carpasse in jshttp/on-headers#12

fix README.md badges by @carpasse in jshttp/on-headers#13

add OSSF scorecard action by @carpasse in jshttp/on-headers#14

fix: use ubuntu-latest as ci runner by @UlisesGascon in jshttp/on-headers#19

ci: apply OSSF Scorecard security best practices by @UlisesGascon in jshttp/on-headers#20

👷 add upstream change detection by @ctcpip in jshttp/on-headers#31

✨ add script to update known hashes by @ctcpip in jshttp/on-headers#32

💚 update CI - add newer node versions by @ctcpip in jshttp/on-headers#33

New Contributors

@carpasse made their first contribution in jshttp/on-headers#12

@UlisesGascon made their first contribution in jshttp/on-headers#19

@ctcpip made their first contribution in jshttp/on-headers#31

Full Changelog: jshttp/on-headers@v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

1.1.0 / 2025-07-17

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

4b017af 1.1.0
b636f2d ♻️ refactor header array code
3e2c2d4 ✨ ignore falsy header keys, matching node behavior
172eb41 ✨ support duplicate headers
c6e3849 🔒️ fix array handling
6893518 💚 update CI - add newer node versions
56a345d ✨ add script to update known hashes
175ab21 👷 add upstream change detection (#31)
ce0b2c8 ci: apply OSSF Scorecard security best practices (#20)
1a38c54 fix: use ubuntu-latest as ci runner (#19)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 2 updates in the / directory: [hono](https://github.com/honojs/hono) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `hono` from 4.9.7 to 4.10.3 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.9.7...v4.10.3) Updates `vite` from 6.3.6 to 6.4.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) Updates `estree-util-value-to-estree` from 3.3.2 to 3.5.0 - [Release notes](https://github.com/remcohaszing/estree-util-value-to-estree/releases) - [Commits](remcohaszing/estree-util-value-to-estree@v3.3.2...v3.5.0) Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) --- updated-dependencies: - dependency-name: hono dependency-version: 4.10.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: estree-util-value-to-estree dependency-version: 3.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #1

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #1

Uh oh!

dependabot bot commented on behalf of github Dec 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #1

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #1

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 8, 2025

v4.10.3

Securiy Fix

What's Changed

New Contributors

v4.10.2

Security hardening improvement

Improper Authorization in Hono (JWT Audience Validation)

Recommended secure configuration

What's Changed

[email protected]

v6.4.1

[email protected]

v6.4.0

v6.3.7

v3.5.0

v3.4.1

v3.4.0

v3.3.3

1.1.0

Important

What's Changed

New Contributors

1.1.0 / 2025-07-17

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant