Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates - #1

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-d70b38f481
Closed

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-d70b38f481

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 12, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
next 15.0.7 15.5.18
turbo 2.4.4 2.9.14
@hono/node-server 1.13.7 1.19.13
hono 4.6.9 4.12.21
effect 3.18.4 3.20.0
fastify 5.1.0 5.8.5
@nestjs/core 10.4.22 11.1.18
nuxt 3.14.159 3.21.6

Updates next from 15.0.7 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.16

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

Commits
  • 9ff92ce v15.5.18
  • 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
  • 62c97ab v15.5.17
  • 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
  • fa78739 Turbopack: Fix middleware matcher suffix (#93590)
  • 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
  • 36589b5 [backport][test] Pin package manager to patch versions (#93596)
  • ad6fd4e v15.5.16
  • 79d7dff Ignore malformed CSP nonce headers (#103)
  • c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates turbo from 2.4.4 to 2.9.14

Release notes

Sourced from turbo's releases.

Turborepo v2.9.14

[!NOTE] This release contains important security fixes.

High:

Low:

What's Changed

Changelog

New Contributors

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

Turborepo v2.9.13-canary.1

What's Changed

Changelog

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for turbo since your current version.


Updates @hono/node-server from 1.13.7 to 1.19.13

Release notes

Sourced from @​hono/node-server's releases.

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

New Contributors

Full Changelog: honojs/node-server@v1.19.7...v1.19.8

v1.19.7

What's Changed

... (truncated)

Commits

Updates hono from 4.6.9 to 4.12.21

Release notes

Sourced from hono's releases.

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.18...v4.12.19

... (truncated)

Commits

Updates effect from 3.18.4 to 3.20.0

Release notes

Sourced from effect's releases.

effect@3.20.0

Minor Changes

Patch Changes

  • #6107 fc82e81 Thanks @​gcanti! - Backport Types.VoidIfEmpty to 3.x

  • #6088 82996bc Thanks @​taylorOntologize! - Schema: fix Schema.omit producing wrong result on Struct with optionalWith({ default }) and index signatures

    getIndexSignatures now handles Transformation AST nodes by delegating to ast.to, matching the existing behavior of getPropertyKeys and getPropertyKeyIndexedAccess. Previously, Schema.omit on a struct combining Schema.optionalWith (with { default }, { as: "Option" }, etc.) and Schema.Record would silently take the wrong code path, returning a Transformation with property signatures instead of a TypeLiteral with index signatures.

  • #6086 4d97a61 Thanks @​taylorOntologize! - Schema: fix getPropertySignatures crash on Struct with optionalWith({ default }) and other Transformation-producing variants

    SchemaAST.getPropertyKeyIndexedAccess now handles Transformation AST nodes by delegating to ast.to, matching the existing behavior of getPropertyKeys. Previously, calling getPropertySignatures on a Schema.Struct containing Schema.optionalWith with { default }, { as: "Option" }, { nullable: true }, or similar options would throw "Unsupported schema (Transformation)".

  • #6097 f6b0960 Thanks @​gcanti! - Fix TupleWithRest post-rest validation to check each tail index sequentially.

Changelog

Sourced from effect's changelog.

3.20.0

Minor Changes

Patch Changes

  • #6107 fc82e81 Thanks @​gcanti! - Backport Types.VoidIfEmpty to 3.x

  • #6088 82996bc Thanks @​taylorOntologize! - Schema: fix Schema.omit producing wrong result on Struct with optionalWith({ default }) and index signatures

    getIndexSignatures now handles Transformation AST nodes by delegating to ast.to, matching the existing behavior of getPropertyKeys and getPropertyKeyIndexedAccess. Previously, Schema.omit on a struct combining Schema.optionalWith (with { default }, { as: "Option" }, etc.) and Schema.Record would silently take the wrong code path, returning a Transformation with property signatures instead of a TypeLiteral with index signatures.

  • #6086 4d97a61 Thanks @​taylorOntologize! - Schema: fix getPropertySignatures crash on Struct with optionalWith({ default }) and other Transformation-producing variants

    SchemaAST.getPropertyKeyIndexedAccess now handles Transformation AST nodes by delegating to ast.to, matching the existing behavior of getPropertyKeys. Previously, calling getPropertySignatures on a Schema.Struct containing Schema.optionalWith with { default }, { as: "Option" }, { nullable: true }, or similar options would throw "Unsupported schema (Transformation)".

  • #6097 f6b0960 Thanks @​gcanti! - Fix TupleWithRest post-rest validation to check each tail index sequentially.

3.19.19

Patch Changes

3.19.18

Patch Changes

3.19.17

Patch Changes

  • #6040 a8c436f Thanks @​jacobconley! - Fix Stream.decodeText to correctly handle multi-byte UTF-8 characters split across chunk boundaries.

3.19.16

Patch Changes

  • #6018 e71889f Thanks @​codewithkenzo! - fix(Match): handle null/undefined in Match.tag and Match.tagStartsWith

    Added null checks to discriminator and discriminatorStartsWith predicates to prevent crashes when matching nullable union types.

... (truncated)

Commits
  • aa47393 Version Packages (#6089)
  • 8798a84 fix(effect): isolate scheduler runners per fiber (#6124)
  • fc82e81 Backport Types.VoidIfEmpty to 3.x (#6107)
  • f6b0960 Backport: Fix TupleWithRest post-rest index drift validation bug (#6097)
  • 82996bc fix(Schema): handle Transformation in getIndexSignatures for correct omit beh...
  • 4d97a61 Schema: fix getPropertySignatures crash on Struct with optionalWith({ default...
  • ab3b64c Version Packages (#6080)
  • 2d2bb13 fix semaphore race condition where permits could be leaked (#6081)
  • 4eb5c00 build ManagedRuntime synchronously if possible (#6079)
  • 4f21075 Version Packages (#6063)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for effect since your current version.


Updates fastify from 5.1.0 to 5.8.5

Release notes

Sourced from fastify's releases.

v5.8.5

⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.4...v5.8.5

v5.8.4

Full Changelog: fastify/fastify@v5.8.3...v5.8.4

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

... (truncated)

Commits
  • 3983cce Bumped v5.8.5
  • 3ce3ae6 Merge commit from fork
  • b06a196 docs(ecosystem): add @​pompelmi/fastify-plugin (#6610)
  • 909c5d5 chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 (#6630)
  • 4db21a3 chore: Bump borp from 0.21.0 to 1.0.0 (#6633)
  • 0f4e544 chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 (#6632)
  • 33a2fcd chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 (#6629)
  • fd35d82 ci: reduce cron schedules from daily/weekly to monthly (#6623)
  • 8dee9be fix: restore trustProxy function for number and string types, add null check ...
  • d457aed chore: upgrade to typescript v6.0.2 (#6605)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by climba03003, a new releaser for fastify since your current version.


Updates @nestjs/core from 10.4.22 to 11.1.18

Release notes

Sourced from @​nestjs/core's releases.

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Dependencies

Committers: 3

... (truncated)

Commits
  • 3c1cc5f chore(release): publish v11.1.18 release
  • 0f962c7 fix(core): sanitize sse message
  • 94aa424 Merge pull request #16679 from nestjs/renovate/path-to-regexp-8.x
  • 368691c fix(core): prevent injector hang when design:paramtypes is missing
  • 25d4fde fix(deps): update dependency path-to-regexp to v8.4.2
  • 5c0b11e fix(deps): update dependency path-to-regexp to v8.4.1
  • f7d4460 Merge pull request #16637 from JakobStaudinger/moduleref-create-transient-sco...
  • d0a9dc9 fix(deps): update dependency path-to-regexp to v8.4.0
  • 4677434 feat(core): export IEntryNestModule type
  • 7493b94 fix(core): dependency injection edge case with moduleref.create
  • Additional commits viewable in compare view

Updates nuxt from 3.14.159 to 3.21.6

Release notes

Sourced from nuxt's releases.

v3.21.6

3.21.6 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

  • nuxt: Prefer our own builder/server deps (#35029)
  • nitro: Add json extension to payload cache items (#35043)
  • nuxt: Handle errors fetching app manifest (#35050)
  • nuxt: Preserve setPageLayout props on same-path navigation (#35055)
  • vite: Don't strip buildAssetsDir from vite-node SSR ids (#35040)
  • nuxt: Mark useLoadingIndicator properties as readonly (#35062)
  • vite: Strip queries in css inline styles map (#35067)
  • nuxt: Encode html-significant characters in external redirect body (#35052)
  • nitro: Validate island request hash matches props (#35077)
  • nitro: Use regexp to strip query (042b615e6)
  • nitro: Use statusCode for nitro v2 compatibility (82dcd6a31)
  • nuxt: Render component-less parent routes during client-side nav (#35036)
  • nuxt: Run middleware for page islands (#35092)

💅 Refactors

  • rspack,webpack: Extract same-origin check for dev middleware (#35051)

📖 Documentation

  • Remove CSB, set node 22 and use steps for clarity (#35066)

🏡 Chore

✅ Tests

  • Relax relative time assertion (256513eb0)
  • Move build assets dir fixture out of app/ (6d2ac69ff)

🤖 CI

  • Clean up agent-scan workflow (31590cf07)
  • Continue autofix workflow when test:engines fails (958abb882)
  • Improve workflows (#35088)

❤️ Contributors

v3.21.5

3.21.5 is the next patch release.

👉 Changelog

... (truncated)

Commits

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 12 u…
e12b1bc 
…pdates

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `15.0.7` | `15.5.18` |
| [turbo](https://github.com/vercel/turborepo) | `2.4.4` | `2.9.14` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.13.7` | `1.19.13` |
| [hono](https://github.com/honojs/hono) | `4.6.9` | `4.12.21` |
| [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `3.18.4` | `3.20.0` |
| [fastify](https://github.com/fastify/fastify) | `5.1.0` | `5.8.5` |
| [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `10.4.22` | `11.1.18` |
| [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `3.14.159` | `3.21.6` |



Updates `next` from 15.0.7 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.0.7...v15.5.18)

Updates `turbo` from 2.4.4 to 2.9.14
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.4.4...v2.9.14)

Updates `@hono/node-server` from 1.13.7 to 1.19.13
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.13.7...v1.19.13)

Updates `hono` from 4.6.9 to 4.12.21
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.6.9...v4.12.21)

Updates `effect` from 3.18.4 to 3.20.0
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/effect/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/effect@3.20.0/packages/effect)

Updates `fastify` from 5.1.0 to 5.8.5
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.1.0...v5.8.5)

Updates `@nestjs/core` from 10.4.22 to 11.1.18
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v11.1.18/packages/core)

Updates `nuxt` from 3.14.159 to 3.21.6
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v3.21.6/packages/nuxt)

Updates `@grpc/grpc-js` from 1.14.3 to 1.14.4
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4)

Updates `@opentelemetry/exporter-prometheus` from 0.210.0 to 0.219.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.210.0...experimental/v0.219.0)

Updates `tar` from 6.2.1 to 7.5.15
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.1...v7.5.15)

Updates `unhead` from 1.11.20 to 2.1.15
- [Release notes](https://github.com/unjs/unhead/releases)
- [Commits](https://github.com/unjs/unhead/commits/v2.1.15/packages/unhead)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.18
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: turbo
  dependency-version: 2.9.14
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.21
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: effect
  dependency-version: 3.20.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.8.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@nestjs/core"
  dependency-version: 11.1.18
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nuxt
  dependency-version: 3.21.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/exporter-prometheus"
  dependency-version: 0.219.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.15
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: unhead
  dependency-version: 2.1.15
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 14, 2026

Copy link
Copy Markdown
Author

Superseded by #2.

@dependabot dependabot Bot closed this Jun 14, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-d70b38f481 branch June 14, 2026 01:33
karamouche pushed a commit that referenced this pull request Jun 29, 2026
@dinmukhamedm
(docs) update Laminar observability integration for v7 (#1) (vercel#1…
5e9ea7f 
…6235)

<!--
Welcome to contributing to AI SDK! We're excited to see your changes.

We suggest you read the following contributing guide we've created
before submitting:

https://github.com/vercel/ai/blob/main/CONTRIBUTING.md
-->

## Background

<!-- Why was this change necessary? -->

Updating Laminar integration docs for native integration with v7 instead
of the legacy OTEL path.

## Summary

<!-- What did you change? -->

Documentation only. Update examples for AI SDK v7, update outdated doc
links and information about laminar

## Manual Verification

<!--
For features & bugfixes.
Please explain how you *manually* verified that the change works
end-to-end as expected (excluding automated tests).
Remove the section if it's not needed (e.g. for docs).
-->

Proofreading

## Checklist

<!--
Do not edit this list. Leave items unchecked that don't apply. If you
need to track subtasks, create a new "## Tasks" section

Please check if the PR fulfills the following requirements:
-->

- [x] All commits are signed (PRs with unsigned commits cannot be
merged)
- [ ] Tests have been added / updated (for bug fixes / features)
- [ ] Documentation has been added / updated (for bug fixes / features)
- [ ] A _patch_ changeset for relevant packages has been added (for bug
fixes / features - run `pnpm changeset` in the project root)
- [X] I have reviewed this pull request (self-review)

## Future Work

<!--
Feel free to mention things not covered by this PR that can be done in
future PRs.
Remove the section if it's not needed.
 -->

## Related Issues

<!--
List related issues here, e.g. "Fixes vercel#1234".
Remove the section if it's not needed.
-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants