Skip to content

chore(deps): Bump the npm_and_yarn group across 9 directories with 6 updates#331

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nuxt-api/npm_and_yarn-e44d1eb5bd
Closed

chore(deps): Bump the npm_and_yarn group across 9 directories with 6 updates#331
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nuxt-api/npm_and_yarn-e44d1eb5bd

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026

Bumps the npm_and_yarn group with 2 updates in the /nuxt-api directory: nuxt and ws.
Bumps the npm_and_yarn group with 1 update in the /angular-ui directory: ws.
Bumps the npm_and_yarn group with 1 update in the /angular-spring-ui directory: ws.
Bumps the npm_and_yarn group with 3 updates in the /svelte-ui directory: brace-expansion, ws and svelte.
Bumps the npm_and_yarn group with 2 updates in the /tanstack-start-ui directory: brace-expansion and @tanstack/start-server-core.
Bumps the npm_and_yarn group with 2 updates in the /hono-api directory: brace-expansion and hono.
Bumps the npm_and_yarn group with 2 updates in the /lambda-api directory: brace-expansion and hono.
Bumps the npm_and_yarn group with 1 update in the /api directory: hono.
Bumps the npm_and_yarn group with 1 update in the /ui directory: ws.

Updates nuxt from 4.4.2 to 4.4.6

Release notes

Sourced from nuxt's releases.

v4.4.6

4.4.6 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

  • vite: Use spa entry for vite-node fallback (#35037)
  • vite: Invalidate SSR module cache when modules are invalidated via plugin hooks (a86657a0e)
  • nuxt: Match deduplicated resolveComponent calls in jsx blocks (#35028)
  • nuxt: Prefer our own builder/server deps (#35029)
  • nuxt: Update useFetch key even with watch: false (#35002)
  • nitro: Mark @babel/plugin-syntax-typescript as optional peer dep (#35041)
  • nitro: Add json extension to payload cache items (#35043)
  • nuxt: Handle errors fetching app manifest (#35050)
  • nuxt: Encode html-significant characters in external redirect body (#35052)
  • nuxt: Preserve setPageLayout props on same-path navigation (#35055)
  • vite: Don't strip buildAssetsDir from vite-node SSR ids (#35040)
  • nuxt: Mark useLoadingIndicator properties as readonly (#35062)
  • vite: Strip queries in css inline styles map (#35067)
  • nitro: Validate island request hash matches props (#35077)
  • nitro: Use regexp to strip query (163e18d4b)
  • nitro: Use statusCode for nitro v2 compatibility (952f6841e)
  • nitro-server: Re-export h3 named symbols statically (cd99001c8)
  • nuxt: Render component-less parent routes during client-side nav (#35036)
  • kit: Respect tsConfig.exclude in legacy tsconfig.json (#35079)
  • nuxt: Run middleware for page islands (#35092)

💅 Refactors

  • rspack,webpack: Extract same-origin check for dev middleware (#35051)

📖 Documentation

  • Remove CSB, set node 22 and use steps for clarity (#35066)

🏡 Chore

✅ Tests

🤖 CI

  • Clean up agent-scan workflow (ab8317547)
  • Continue autofix workflow when test:engines fails (3025e561e)
  • Improve workflows (#35088)

❤️ Contributors

... (truncated)

Commits
  • 30a45f7 v4.4.6
  • e881fe8 fix(nuxt): run middleware for page islands (#35092)
  • 3310097 fix(nuxt): render component-less parent routes during client-side nav (#35036)
  • b29f805 chore(deps): update all non-major dependencies (4.x) (#35075)
  • e9cddf4 fix(nitro): validate island request hash matches props (#35077)
  • 7499721 fix(nuxt): mark useLoadingIndicator properties as readonly (#35062)
  • 38507a8 chore(deps): update dependency cssnano to v8 (4.x) (#35038)
  • 5abe6d3 chore(deps): update all non-major dependencies (4.x) (#35046)
  • 4bdd9dd fix(nuxt): preserve setPageLayout props on same-path navigation (#35055)
  • 1ca9c44 fix(nuxt): encode html-significant characters in external redirect body (#35052)
  • Additional commits viewable in compare view

Updates ws from 8.20.0 to 8.20.1

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

  • Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

Commits
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • See full diff in compare view

Updates ws from 8.20.0 to 8.20.1

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

  • Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

Commits
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • See full diff in compare view

Updates ws from 8.20.0 to 8.20.1

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

  • Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

Commits
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • See full diff in compare view

Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates ws from 8.20.0 to 8.20.1

Release notes

Sourced from ws's releases.

8.20.1

Bug fixes

  • Fixed an uninitialized memory disclosure issue in websocket.close() (c0327ec1).

Providing a TypedArray (e.g. Float32Array) as the reason argument for websocket.close(), rather than the supported string or Buffer types, caused uninitialized memory to be disclosed to the remote peer.

import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port}, {
skipUTF8Validation: true
});
ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});

}
);
wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});

The issue was privately reported by Nikita Skovoroda.

Commits
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • See full diff in compare view

Updates svelte from 5.53.12 to 5.55.9

Release notes

Sourced from svelte's releases.

svelte@5.55.9

Patch Changes

  • fix: don't unset batch when calling {#await ...} promise (#18243)

  • fix: promise-ify {#await await ...} expressions on the server and correctly hydrate them on the client (#18243)

  • fix: deduplicate dependencies that are added outside the init/update cycle (#18243)

  • fix: avoid false-positive batch invariant error (#18246)

  • fix: inline primitive constants in attribute values during SSR (#18232)

svelte@5.55.8

Patch Changes

  • fix(print): handle svelte:body and fix keyframe percentage double-printing (#18234)

  • fix: execute uninitialized derived even if it's destroyed (#18228)

  • fix: use named symbols everywhere (#18238)

  • fix: don't run teardown effects when deriveds are unfreezed (#18227)

  • fix: unset context synchronously in run (#18236)

svelte@5.55.7

Patch Changes

svelte@5.55.6

Patch Changes

  • fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

  • fix: keep dependencies of $state.eager/pending (#18218)

  • fix: reapply context after transforming error during SSR (#18099)

  • fix: don't rebase just-created batches (#18117)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.55.9

Patch Changes

  • fix: don't unset batch when calling {#await ...} promise (#18243)

  • fix: promise-ify {#await await ...} expressions on the server and correctly hydrate them on the client (#18243)

  • fix: deduplicate dependencies that are added outside the init/update cycle (#18243)

  • fix: avoid false-positive batch invariant error (#18246)

  • fix: inline primitive constants in attribute values during SSR (#18232)

5.55.8

Patch Changes

  • fix(print): handle svelte:body and fix keyframe percentage double-printing (#18234)

  • fix: execute uninitialized derived even if it's destroyed (#18228)

  • fix: use named symbols everywhere (#18238)

  • fix: don't run teardown effects when deriveds are unfreezed (#18227)

  • fix: unset context synchronously in run (#18236)

5.55.7

Patch Changes

5.55.6

Patch Changes

  • fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

  • fix: keep dependencies of $state.eager/pending (#18218)

... (truncated)

Commits

Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates @tanstack/start-server-core from 1.166.9 to 1.169.1

Release notes

Sourced from @​tanstack/start-server-core's releases.

@​tanstack/start-server-core@​1.169.1

Patch Changes

  • Updated dependencies [0300f87, 0300f87]:
    • @​tanstack/router-core@​1.171.4
    • @​tanstack/start-client-core@​1.170.1
    • @​tanstack/start-storage-context@​1.167.6

@​tanstack/start-server-core@​1.169.0

Minor Changes

  • Add deferred Hydrate boundary support for TanStack Start. (#7362)

    Hydrate boundaries can now be code-split by the Start compiler, preload their generated client chunks, preserve server-rendered fallback HTML, and replay interaction-triggered events after hydration. The compiler integration now uses a Start-owned compiler plugin for Hydrate virtual modules across Vite and Rsbuild, with dev invalidation for generated virtual modules.

    Shared AST utilities used by the router code-splitter and Hydrate virtual modules were moved into @tanstack/router-utils so both pipelines can retain referenced top-level declarations, unwrap local exports, and let dead-code elimination remove unused route module code.

Patch Changes

  • Updated dependencies [5fa9e55]:
    • @​tanstack/start-client-core@​1.170.0
    • @​tanstack/router-core@​1.171.3
    • @​tanstack/start-storage-context@​1.167.5

@​tanstack/start-server-core@​1.168.4

Patch Changes

  • Updated dependencies [b60eb36]:
    • @​tanstack/router-core@​1.171.2
    • @​tanstack/start-client-core@​1.169.4
    • @​tanstack/start-storage-context@​1.167.4
Changelog

Sourced from @​tanstack/start-server-core's changelog.

1.169.1

Patch Changes

  • Updated dependencies [0300f87, 0300f87]:
    • @​tanstack/router-core@​1.171.4
    • @​tanstack/start-client-core@​1.170.1
    • @​tanstack/start-storage-context@​1.167.6

1.169.0

Minor Changes

  • Add deferred Hydrate boundary support for TanStack Start. (#7362)

    Hydrate boundaries can now be code-split by the Start compiler, preload their generated client chunks, preserve server-rendered fallback HTML, and replay interaction-triggered events after hydration. The compiler integration now uses a Start-owned compiler plugin for Hydrate virtual modules across Vite and Rsbuild, with dev invalidation for generated virtual modules.

    Shared AST utilities used by the router code-splitter and Hydrate virtual modules were moved into @tanstack/router-utils so both pipelines can retain referenced top-level declarations, unwrap local exports, and let dead-code elimination remove unused route module code.

Patch Changes

  • Updated dependencies [5fa9e55]:
    • @​tanstack/start-client-core@​1.170.0
    • @​tanstack/router-core@​1.171.3
    • @​tanstack/start-storage-context@​1.167.5

1.168.4

Patch Changes

  • Updated dependencies [b60eb36]:
    • @​tanstack/router-core@​1.171.2
    • @​tanstack/start-client-core@​1.169.4
    • @​tanstack/start-storage-context@​1.167.4

1.168.3

Patch Changes

  • Updated dependencies [d9cf933]:
    • @​tanstack/router-core@​1.171.1
    • @​tanstack/start-client-core@​1.169.3
    • @​tanstack/start-storage-context@​1.167.3

1.168.2

Patch Changes

  • Updated dependencies [d533f87]:
    • @​tanstack/router-core@​1.171.0

... (truncated)

Commits

Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates hono from 4.12.15 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.18...v4.12.19

... (truncated)

Commits

Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates hono from 4.12.15 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.18...v4.12.19

... (truncated)

Commits

Updates brace-expansion from 5.0.5 to 5.0.6

Commits

Updates hono from 4.12.15 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.18...v4.12.19

... (truncated)

Commits

Updates hono from 4.12.15 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowi...

Description has been truncated

@dependabot
chore(deps): Bump the npm_and_yarn group across 9 directories with 6 …
5a7f716 
…updates

Bumps the npm_and_yarn group with 2 updates in the /nuxt-api directory: [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 1 update in the /angular-ui directory: [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 1 update in the /angular-spring-ui directory: [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 3 updates in the /svelte-ui directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [ws](https://github.com/websockets/ws) and [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte).
Bumps the npm_and_yarn group with 2 updates in the /tanstack-start-ui directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [@tanstack/start-server-core](https://github.com/TanStack/router/tree/HEAD/packages/start-server-core).
Bumps the npm_and_yarn group with 2 updates in the /hono-api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 2 updates in the /lambda-api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 1 update in the /api directory: [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 1 update in the /ui directory: [ws](https://github.com/websockets/ws).


Updates `nuxt` from 4.4.2 to 4.4.6
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v4.4.6/packages/nuxt)

Updates `ws` from 8.20.0 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.20.1)

Updates `ws` from 8.20.0 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.20.1)

Updates `ws` from 8.20.0 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.20.1)

Updates `brace-expansion` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.6)

Updates `ws` from 8.20.0 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.20.1)

Updates `svelte` from 5.53.12 to 5.55.9
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.55.9/packages/svelte)

Updates `brace-expansion` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.6)

Updates `@tanstack/start-server-core` from 1.166.9 to 1.169.1
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/start-server-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/start-server-core@1.169.1/packages/start-server-core)

Updates `brace-expansion` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.6)

Updates `hono` from 4.12.15 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.21)

Updates `brace-expansion` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.6)

Updates `hono` from 4.12.15 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.21)

Updates `brace-expansion` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.6)

Updates `hono` from 4.12.15 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.21)

Updates `hono` from 4.12.15 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.21)

Updates `ws` from 8.19.0 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.20.1)

---
updated-dependencies:
- dependency-name: nuxt
  dependency-version: 4.4.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svelte
  dependency-version: 5.55.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@tanstack/start-server-core"
  dependency-version: 1.169.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 21, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 21, 2026

Superseded by #332.

@dependabot dependabot Bot closed this May 21, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/nuxt-api/npm_and_yarn-e44d1eb5bd branch May 21, 2026 18:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants