Skip to content

chore(deps): bump the npm_and_yarn group across 4 directories with 6 updates#4763

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f0050b56d5
Open

chore(deps): bump the npm_and_yarn group across 4 directories with 6 updates#4763
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f0050b56d5

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 24, 2026 •
edited
Loading

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
@hono/node-server 1.14.2 1.19.13
hono 4.11.9 4.12.18
ai 4.3.19 5.0.52
elysia 1.4.12 1.4.27
next 16.1.1 16.2.6
yaml 2.8.2 2.8.3

Bumps the npm_and_yarn group with 1 update in the /examples/ai-and-user-generated-actors-freestyle/template directory: hono.
Bumps the npm_and_yarn group with 2 updates in the /examples/next-js directory: @hono/node-server and next.
Bumps the npm_and_yarn group with 2 updates in the /examples/react-vercel directory: @hono/node-server and hono.

Updates @hono/node-server from 1.14.2 to 1.19.13

Release notes

Sourced from @​hono/node-server's releases.

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

New Contributors

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

v1.19.7

What's Changed

... (truncated)

Commits

Updates hono from 4.11.9 to 4.12.18

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

v4.12.15

What's Changed

... (truncated)

Commits

Updates ai from 4.3.19 to 5.0.52

Changelog

Sourced from ai's changelog.

5.0.52

Patch Changes

  • c56822d: fix(ai): update uiMessageChunkSchema to satisfy the UIMessageChunk type
  • 930399b: fix(ai): download files when intermediate file cannot be downloaded
  • Updated dependencies [7ca78f1]
    • @​ai-sdk/gateway@​1.0.29

5.0.51

Patch Changes

  • 27645bb: Export parseJsonEventStream and uiMessageChunkSchema from "ai" package
  • Updated dependencies [322901b]
    • @​ai-sdk/gateway@​1.0.28

5.0.50

Patch Changes

  • Updated dependencies [c5f403a]
    • @​ai-sdk/gateway@​1.0.27

5.0.49

Patch Changes

  • Updated dependencies [e304478]
    • @​ai-sdk/gateway@​1.0.26

5.0.48

Patch Changes

  • Updated dependencies [4d3ff64]
    • @​ai-sdk/gateway@​1.0.25

5.0.47

Patch Changes

  • Updated dependencies [c86e0f7]
  • Updated dependencies [6bbae01]
    • @​ai-sdk/gateway@​1.0.24

5.0.46

Patch Changes

... (truncated)

Commits

Updates elysia from 1.4.12 to 1.4.27

Release notes

Sourced from elysia's releases.

1.4.27

What's changed

Bug fix:

  • getSchemaValidator: handle TypeBox as sub type
  • handle cookie prototype pollution when parsing cookie

Improvement:

  • conditional async on getSchemaValidator when schema is Standard Schema
  • use Response.json on Bun
  • export AnySchema, UnwrapSchema, ModelsToTypes from root

Full Changelog: elysiajs/elysia@1.4.26...1.4.27

1.4.26

What's changed

Bug fix:

  • #1755 deduplicate local handler from global event
  • #1752 system router with trailing path doesn't match with non-trailing
  • url format redos
  • #1747 parsing request from mount hang

Full Changelog: elysiajs/elysia@1.4.25...1.4.26

1.4.25

What's changed

Feature:

  • export ElysiaStatus

Bug fix:

  • macro with conflict literal value per status
  • recursive macro with conflict value per status

Full Changelog: elysiajs/elysia@1.4.24...1.4.25

1.4.24

What's Changed

Feature:

  • graceful unsigned cookie transition

Bug fix:

  • #1733 preserve multiple set-cookie headers in mounted handlers by @​cipher416
  • object cookie with secret doesn't deserialized after parsed

New Contributors

Full Changelog: elysiajs/elysia@1.4.23...1.4.24

... (truncated)

Changelog

Sourced from elysia's changelog.

1.4.27 - 1 Mar 2026

Bug fix:

  • getSchemaValidator: handle TypeBox as sub type
  • handle cookie prototype pollution when parsing cookie

Improvement:

  • conditional async on getSchemaValidator when schema is Standard Schema
  • use Response.json on Bun

1.4.26 - 25 Feb 2026

Bug fix:

  • #1755 deduplicate local handler from global event
  • #1752 system router with trailing path doesn't match with non-trailing
  • url format redos
  • #1747 parsing request from mount hang

1.4.25 - 12 Feb 2026

Feature:

  • export ElysiaStatus

Bug fix:

  • macro with conflict literal value per status
  • recursive macro with conflict value per status

1.4.24 - 11 Feb 2026

Feature:

  • graceful unsigned cookie transition

Bug fix:

  • #1733 preserve multiple set-cookie headers in mounted handlers
  • object cookie with secret doesn't deserialized after parsed

1.4.23 - 9 Feb 2026

Feature:

  • #1719 add t.Union/t.Intersection handling in property enumerations/checks
  • #1697 extend complex formdata support to StandardSchema
  • #1656 serialize custom array-like custom class with array sub class

Bug fix:

  • #1721 Promise with response schema
  • #1700 distinct union object
  • #1683 response validation returns 500 instead of 422 for nested schemas in dynamic mode
  • #1679 preserve headers when throwing from AsyncGenerator
  • #1595 stream reference should point to teed value
  • fix can't modify immutable headers error

Change:

  • update exact-mirror to 0.2.7

1.4.22 - 14 Jan 2026

... (truncated)

Commits
  • cc9159b 🎉 feat: 1.4.27
  • e9d6b17 🎉 feat: 1.4.27
  • 21dce4c 🎉 feat: use Response.json on Bun
  • 6b44646 🔧 fix(getSchemaValidator): handle TypeBox as sub type
  • bbaf6b7 🎉 feat: 1.4.26
  • e596dab 🔧 fix: #1747 parsing request from mount hang
  • 6561d61 🔧 fix: #1752 system router with trailing path doesn't match with non-t...
  • 3c9dabc 🔧 fix: #1752 system router with trailing path doesn't match with non-t...
  • d17a7aa 🔧 fix: #1755 deduplicate local handler from global event
  • e5c9449 🔧 fix: recursive macro with conflict value per status
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for elysia since your current version.


Updates next from 16.1.1 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

... (truncated)

Commits
  • ee6e79b v16.2.6
  • afa053d Turbopack: Match proxy matchers with webpack implementation (#93594)
  • 97a154e Turbopack: Fix middleware matcher suffix (#93590)
  • 83899bc [backport] Disable build caches for production/staging/force-preview deploys ...
  • 7b222b9 [backport][test] Pin package manager to patch versions (#93595)
  • a8dc24f [backport] Turbopack: more strict vergen setup (#93587)
  • 766148f v16.2.5
  • 0dd9483 fix: add explicit checks for RSC header (#83) (#98)
  • d166096 fix proxy matching for segment prefetch URLs (#89) (#96)
  • 9d50c0b Strip next-resume header from incoming requests (#92)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates yaml from 2.8.2 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

  • Add trailingComma ToString option for multiline flow formatting (#670)
  • Catch stack overflow during node composition (1e84ebb)
Commits
  • ce14587 2.8.3
  • 1e84ebb fix: Catch stack overflow during node composition
  • 6b24090 ci: Include Prettier check in lint action
  • 9424dee chore: Refresh lockfile
  • d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
  • 4321509 ci: Drop the branch filter from GitHub PR actions
  • 47207d0 chore: Update docs-slate
  • 5212fae chore: Update docs-slate
  • See full diff in compare view

Updates hono from 4.11.9 to 4.12.18

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

v4.12.15

What's Changed

... (truncated)

Commits

Updates @hono/node-server from 1.14.2 to 1.19.13

Release notes

Sourced from @​hono/node-server's releases.

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

New Contributors

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

v1.19.7

What's Changed

... (truncated)

Commits

Updates ai from 4.3.19 to 5.0.52

Changelog

Sourced from ai's changelog.

5.0.52

Patch Changes

  • c56822d: fix(ai): update uiMessageChunkSchema to satisfy the UIMessageChunk type
  • 930399b: fix(ai): download files when intermediate file cannot be downloaded
  • Updated dependencies [7ca78f1]
    • @​ai-sdk/gateway@​1.0.29

5.0.51

Patch Changes

  • 27645bb: Export parseJsonEventStream and uiMessageChunkSchema from "ai" package
  • Updated dependencies [322901b]
    • @​ai-sdk/gateway@​1.0.28

5.0.50

Patch Changes

  • Updated dependencies [c5f403a]
    • @​ai-sdk/gateway@​1.0.27

5.0.49

Patch Changes

  • Updated dependencies [e304478]
    • @​ai-sdk/gateway@​1.0.26

5.0.48

Patch Changes

  • Updated dependencies [4d3ff64]
    • @​ai-sdk/gateway@​1.0.25

5.0.47

Patch Changes

  • Updated dependencies [c86e0f7]
  • Updated dependencies [6bbae01]
    • @​ai-sdk/gateway@​1.0.24

5.0.46

Patch Changes

... (truncated)

Commits

Updates elysia from 1.4.12 to 1.4.27

Release notes

Sourced from elysia's releases.

1.4.27

What's changed

Bug fix:

  • getSchemaValidator: handle TypeBox as sub type
  • handle cookie prototype pollution when parsing cookie

Improvement:

  • conditional async on getSchemaValidator when schema is Standard Schema
  • use Response.json on Bun
  • export AnySchema, UnwrapSchema, ModelsToTypes from root

Full Changelog: elysiajs/elysia@1.4.26...1.4.27

1.4.26

What's changed

Bug fix:

  • #1755 deduplicate local handler from global event
  • #1752 system router with trailing path doesn't match with non-trailing
  • url format redos
  • #1747 parsing request from mount hang

Full Changelog: elysiajs/elysia@1.4.25...1.4.26

1.4.25

What's changed

Feature:

  • export ElysiaStatus

Bug fix:

  • macro with conflict literal value per status
  • recursive macro with conflict value per status

Full Changelog: elysiajs/elysia@1.4.24...1.4.25

1.4.24

What's Changed

Feature:

  • graceful unsigned cookie transition

Bug fix:

  • #1733 preserve multiple set-cookie headers in mounted handlers by @​cipher416
  • object cookie with secret doesn't deserialized after parsed

New Contributors

Full Changelog: elysiajs/elysia@1.4.23...1.4.24

... (truncated)

Changelog

Sourced from elysia's changelog.

1.4.27 - 1 Mar 2026

Bug fix:

  • getSchemaValidator: handle TypeBox as sub type
  • handle cookie prototype pollution when parsing cookie

Improvement:

  • conditional async on getSchemaValidator when schema is Standard Schema
  • use Response.json on Bun

1.4.26 - 25 Feb 2026

Bug fix:

  • #1755 deduplicate local handler from global event
  • #1752 system router with trailing path doesn't match with non-trailing
  • url format redos
  • #1747 parsing request from mount hang

1.4.25 - 12 Feb 2026

Feature:

  • export ElysiaStatus

Bug fix:

  • macro with conflict literal value per status
  • recursive macro with conflict value per status

1.4.24 - 11 Feb 2026

Feature:

  • graceful unsigned cookie transition

Bug fix:

  • #1733 preserve multiple set-cookie headers in mounted handlers
  • object cookie with secret doesn't deserialized after parsed

1.4.23 - 9 Feb 2026

Feature:

  • #1719 add t.Union/t.Intersection handling in property enumerations/checks
  • #1697 extend complex formdata support to StandardSchema
  • #1656 serialize custom array-like custom class with array sub class

Bug fix:

  • #1721 Promise with response schema
  • #1700 distinct union object
  • #1683 response validation returns 500 instead of 422 for nested schemas in dynamic mode
  • #1679 preserve headers when throwing from AsyncGenerator
  • #1595 stream reference should point to teed value
  • fix can't modify immutable headers error

Change:

  • update exact-mirror to 0.2.7

1.4.22 - 14 Jan 2026

... (truncated)

Commits
  • cc9159b 🎉 feat: 1.4.27
  • e9d6b17 🎉 feat: 1.4.27
  • 21dce4c 🎉 feat: use Response.json on Bun
  • 6b44646 🔧 fix(getSchemaValidator): handle TypeBox as sub type
  • bbaf6b7 🎉 feat: 1.4.26
  • e596dab 🔧 fix: #1747 parsing request from mount hang
  • 6561d61 🔧 fix: #1752 system router with trailing path doesn't match with non-t...
  • 3c9dabc 🔧 fix: #1752 system router with trailing path doesn't match with non-t...
  • d17a7aa 🔧 fix: #1755 deduplicate local handler from global event
  • e5c9449 🔧 fix: recursive macro with conflict value per status
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for elysia since your current version.


Updates next from 16.1.1 to 16.2.6

Release notes

Sourced from next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

Moderate:

Low:

Core Changes

  • fix: preserve HTTP access fallbacks during prerender recovery (#92231)
  • Fix fallback route params case in app-page handler (#91737)
  • Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
  • Patch setHeader for direct route handlers (#93101)
  • Include deployment id in cacheHandlers keys (#93453)
  • Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 24, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-f0050b56d5 branch 2 times, most recently from 5842350 to ba533f6 Compare May 5, 2026 16:25
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-f0050b56d5 branch from ba533f6 to b53c100 Compare May 15, 2026 20:42
@dependabot
chore(deps): bump the npm_and_yarn group across 4 directories with 6 …
a36b76d 
…updates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.14.2` | `1.19.13` |
| [hono](https://github.com/honojs/hono) | `4.11.9` | `4.12.18` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `4.3.19` | `5.0.52` |
| [elysia](https://github.com/elysiajs/elysia) | `1.4.12` | `1.4.27` |
| [next](https://github.com/vercel/next.js) | `16.1.1` | `16.2.6` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` |

Bumps the npm_and_yarn group with 1 update in the /examples/ai-and-user-generated-actors-freestyle/template directory: [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 2 updates in the /examples/next-js directory: [@hono/node-server](https://github.com/honojs/node-server) and [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 2 updates in the /examples/react-vercel directory: [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono).


Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `hono` from 4.11.9 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `ai` from 4.3.19 to 5.0.52
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.52/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.52/packages/ai)

Updates `elysia` from 1.4.12 to 1.4.27
- [Release notes](https://github.com/elysiajs/elysia/releases)
- [Changelog](https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md)
- [Commits](elysiajs/elysia@1.4.12...1.4.27)

Updates `next` from 16.1.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.1...v16.2.6)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `hono` from 4.11.9 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `ai` from 4.3.19 to 5.0.52
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.52/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.52/packages/ai)

Updates `elysia` from 1.4.12 to 1.4.27
- [Release notes](https://github.com/elysiajs/elysia/releases)
- [Changelog](https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md)
- [Commits](elysiajs/elysia@1.4.12...1.4.27)

Updates `next` from 16.1.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.1...v16.2.6)

Updates `yaml` from 2.8.2 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `next` from 16.1.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.1...v16.2.6)

Updates `ai` from 4.3.19 to 5.0.52
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@5.0.52/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@5.0.52/packages/ai)

Updates `elysia` from 1.4.12 to 1.4.27
- [Release notes](https://github.com/elysiajs/elysia/releases)
- [Changelog](https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md)
- [Commits](elysiajs/elysia@1.4.12...1.4.27)

Updates `hono` from 4.11.9 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `yaml` from 2.8.2 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `hono` from 4.11.9 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `yaml` from 2.8.2 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `hono` from 4.9.8 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `hono` from 4.9.8 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `hono` from 4.9.8 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `hono` from 4.9.8 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `next` from 16.1.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.1...v16.2.6)

Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `next` from 16.1.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.1...v16.2.6)

Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `next` from 16.1.1 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.1.1...v16.2.6)

Updates `@hono/node-server` from 1.14.2 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `@hono/node-server` from 1.19.7 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.14.2...v1.19.13)

Updates `hono` from 4.11.3 to 4.12.18
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.9...v4.12.18)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
- dependency-name: ai
  dependency-version: 5.0.52
  dependency-type: direct:production
- dependency-name: ai
  dependency-version: 5.0.52
  dependency-type: direct:production
- dependency-name: ai
  dependency-version: 5.0.52
  dependency-type: direct:production
- dependency-name: elysia
  dependency-version: 1.4.27
  dependency-type: direct:production
- dependency-name: elysia
  dependency-version: 1.4.27
  dependency-type: direct:production
- dependency-name: elysia
  dependency-version: 1.4.27
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: hono
  dependency-version: 4.12.14
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: next
  dependency-version: 16.2.3
  dependency-type: direct:production
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: direct:development
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: direct:development
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: direct:development
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-f0050b56d5 branch from b53c100 to a36b76d Compare May 15, 2026 21:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants