chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #730 · platform-mesh/provider-quickstart

renovate · 2026-10-18T14:30:58Z

This PR contains the following updates:

Package	Change	Type	Update	Pending
@hono/node-server	`2.1.1` → `2.1.4`	overrides	patch	`2.1.5`
@ui5/webcomponents (source)	`2.25.1` → `2.27.2`	dependencies	minor
@ui5/webcomponents-fiori (source)	`2.25.1` → `2.27.2`	dependencies	minor
ghcr.io/platform-mesh/provider-quickstart-armament-sync	`860b7b9` → `3051e43`		digest
ghcr.io/platform-mesh/provider-quickstart-portal	`adc0fa3` → `82a33d1`		digest
vite (source)	`8.2.2` → `8.3.4`	overrides	minor

Release Notes

honojs/node-server (@hono/node-server)

`v2.1.4`

Compare Source

What's Changed

chore: allow hono v5 as a peer dependency by @yusukebe in #406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

`v2.1.3`

Compare Source

Security fixes

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

`v2.1.2`

Compare Source

What's Changed

ci: add autofix.ci by @yusukebe in #392
fix: type error in early hints and add typecheck to CI by @BlankParticle in #390
chore: add better benchmarks by @BlankParticle in #391
docs(readme): update the benchmark by @yusukebe in #394
test(request): accept asynchronous body read errors by @usualoma in #403
fix(listener): avoid mutating response headers when setting Content-Length by @usualoma in #402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

UI5/webcomponents (@ui5/webcomponents)

`v2.27.2`

Compare Source

Fixes

framework: use hasOwnProperty for asyncFinished guard to prevent inherited value from skipping define() await (#14093) (15d5c9d), closes #14087

`v2.27.1`

Compare Source

Bug Fixes

framework: guard languageAware renders against in-flight language changes (#13840) (4487894)

`v2.27.0`

Compare Source

Bug Fixes

ui5-calendar: add calendar header hover border in HCB (#14069) (38096ec)
ui5-dynamic-date-range: correct off-by-one-day date shift in negative UTC offsets (#14017) (8fd845f)
ui5-multi-combobox: mobile focus support (#14056) (35ac49a)
ui5-rating-indicator: mobile focus support (#14050) (73ee19a)
ui5-shellbar-item: show count badge after item text in overflow popover (#13849) (be8fee0), closes #12490
ui5-token: mobile focus support (#14047) (f058464)

`v2.26.0`

Compare Source

Bug Fixes

ui5-icon: replace size containment with font-size for icon sizing (#13986) (52ff411)

Features

ui5-list: add InactiveSelectable list item type (#13962) (fc75e84)

`v2.25.5`

Compare Source

Bug Fixes

ui5-calendar: add calendar header hover border in HCB [2.25.x] (#14070) (11aa506)
ui5-dynamic-page: toggle button reading fixed [2.25.x] (#13990) (#14090) (31c8627)

`v2.25.4`

Compare Source

Bug Fixes

ui5-list: restore keyboard and body selection for InactiveSelectable items (#14045) (962ca12), closes #14037

`v2.25.3`

Compare Source

Bug Fixes

ui5-calendar: translate week number aria-label in DayPicker [2.25.x] (#14064) (d2c52ba), closes #14014

`v2.25.2`

Compare Source

Bug Fixes

ui5-list: suppress hidden text announcement for InactiveSelectable items [2.25.1] (#14022) (10cb0de), closes #14011

vitejs/vite (vite)

`v8.3.4`

Compare Source

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
client: skip rewriting unchanged adopted styles (#23697) (fa71469)
css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
deps: update all non-major dependencies (#23648) (8a4c19c)
deps: update rolldown-related dependencies (#23649) (794516d)
dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
don't treat modules ending with js-like query as js (#23687) (fcb6f12)
html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
optimizer: scan deep imports with custom extensions (#23678) (8579189)
remove input option unescaping for now (#23694) (facc2fb)
server: match static aliases on path boundaries (#23643) (b28db28)
watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

`v8.3.3`

Compare Source

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

`v8.3.2`

Compare Source

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
deps: update all non-major dependencies (#23601) (9944fa6)
deps: update rolldown-related dependencies (#23602) (88c1741)
html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
limit size of object and array printing via forwardConsole (#23565) (e64a587)
merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
pass queries to renderBuiltUrl (#23586) (744269e)
server: handle file watcher errors without crashing (#23503) (6894f5c)
server: release previous environments after initialization (#23499) (5a3a010)
ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

avoid encoding intermediate source maps (#23461) (89574f6)
build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

`v8.3.1`

Compare Source

Bug Fixes

deps: update all non-major dependencies (#23482) (3c752c8)
deps: update all non-major dependencies (#23537) (e8990c4)
deps: update rolldown-related dependencies (#23483) (9aecbbf)
handle server.ws: false in mergeConfig (#23511) (f68c0d5)
merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)
optimizer: resolve pending discovered dep processing on close before init (#23567) (5f89433)
server: avoid reinitializing watcher when adding file after server close (#23572) (6f831f9)
sourcemap: skip URL source roots when injecting sources content (#23519) (04fc30a)

Miscellaneous Chores

merge prereleases in changelog (#23466) (99bd9d1)
optimizer: add debug log when waiting for dep before init (#23566) (63567c7)
update optimizeDeps.include comment (#23489) (6a84c72)

Code Refactoring

assets regexp use non-capture (#23491) (f4b4431)
remove duplicate configurations (#23532) (9abd99b)
replace find with some (#23554) (af7cdf6)

`v8.3.0`

Compare Source

Features

build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
devtools: enable dev server integration (#23333) (68aeb8a)
accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
add top-level tsconfig option (#23310) (93164c3)
add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
config: warn on named imports from JSON modules (#23378) (472385e)
css: minify style tag (#23183) (8156684)
searched params attached to workers are now preserved (#22280) (517b97f)
support subpath imports in dynamic import statements (#23185) (b78e2f1)
use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

handle CRLF line endings in code frame positions (#23219) (9913672)
only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
deps: update all non-major dependencies (#23445) (fc7c104)
html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
shortcuts extend error (#23447) (4ec58d1)
config: close bundles when generation fails (#23256) (6bacc95)
css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
deps: update all non-major dependencies (#23337) (d550815)
deps: update all non-major dependencies (#23404) (238ad81)
deps: update rolldown-related dependencies (#23338) (76e8082)
deps: update rolldown-related dependencies (#23405) (b882566)
dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

introducing @e18e/eslint-plugin (#23357) (f794133)
remove unnecessary comment (#23448) (b919a1a)
delete unused PluginContainerOptions (#23382) (ee64401)
use oxfmt sortImports (#23319) (97ad042)

Code Refactoring

delete unused esbuildPlugin (#23381) (f40efef)
exclude postfix from __VITE_ASSET__ (#22886) (a6c08e1)
remove HmrUrl concept (#23172) (67a6807)
use urlId of import.meta.ROLLDOWN_FILE_URL in wasm plugin (#22962) (92bd2a7)

Tests

add renderBuiltUrl change changes hash (#23118) (0291408)

Beta Changelogs

Please refer to CHANGELOG.md for details.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- Only on Sunday (* * * * 0)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate · 2026-10-18T14:31:02Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: portal/package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EOVERRIDE
npm error Override for @hono/node-server@2.1.4 conflicts with direct dependency
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-18T14_30_48_510Z-debug-0.log

chore(deps): update all non-major dependencies

f23cf40

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot enabled auto-merge (squash) October 18, 2026 14:30

renovate-approve Bot approved these changes Oct 18, 2026

View reviewed changes

renovate Bot merged commit c611754 into main Oct 18, 2026
9 of 11 checks passed

Navigation Menu

Repository navigation

chore(deps): update all non-major dependencies - #730

chore(deps): update all non-major dependencies#730
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Oct 18, 2026

Uh oh!

renovate Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 18, 2026

Release Notes

What's Changed

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

What's Changed

Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Performance Improvements

Code Refactoring

Bug Fixes

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Bug Fixes

Miscellaneous Chores

Code Refactoring

Features

Bug Fixes

Performance Improvements

Miscellaneous Chores

Code Refactoring

Tests

Beta Changelogs

8.3.0-beta.1 (2026-09-07)

8.3.0-beta.0 (2026-09-02)

Configuration

Uh oh!

renovate Bot commented Oct 18, 2026

⚠️ Artifact update problem

File name: portal/package-lock.json

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths