chore(deps): bump the runtime-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #2 · glastor-core/hyper-flow

dependabot · 2026-11-07T22:46:22Z

Bumps the runtime-dependencies group with 8 updates in the / directory:

Package	From	To
@hono/zod-openapi	`0.18.4`	`1.6.3`
@libsql/client	`0.14.0`	`0.18.0`
@scalar/hono-api-reference	`0.5.184`	`0.12.18`
hono	`4.13.13`	`4.13.16`
zod	`3.25.76`	`4.6.7`
@types/bun	`1.4.3`	`1.4.4`
drizzle-kit	`0.30.6`	`0.31.11`
typescript	`5.9.3`	`7.0.2`

Updates @hono/zod-openapi from 0.18.4 to 1.6.3

Release notes

Sourced from @hono/zod-openapi's releases.

@hono/zod-openapi@1.6.3

Patch Changes

#2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

@hono/zod-openapi@1.6.2

Patch Changes

#2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

#2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

#1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

@hono/zod-openapi@1.6.1

Patch Changes

#1988 4fce28c6fbba41795b316becaf7d8cffa11fb521 Thanks @thekiwi! - Reduce route-typing type instantiations (~54% on TS6, ~48% on TS7 in a 100-route benchmark) by binding expensive sub-expressions once and sharing the input intersection / response-shape conditional.

@hono/zod-openapi@1.6.0

Minor Changes

#2086 1dc1a4a5418be24d571652e1013b8a6a925824c0 Thanks @WolfieLeader! - feat: support the HTTP QUERY method in createRoute() by bumping @asteasolutions/zod-to-openapi to v9

@hono/zod-openapi@1.5.3

Patch Changes

#2084 9a9324937cfa77db210a966be33e8c73bbbe33e3 Thanks @kamaal111! - Revert the local z binding export because it causes zod types to degrade to any when built with tsdown.

@hono/zod-openapi@1.5.2

Patch Changes

#2069 fc0377c5595bde3147d181e5013a3fc710175e40 Thanks @edenbuilds! - fix(zod-openapi): keep the z import edge so .openapi() survives bundling

Re-exporting zod's z as a pass-through let esbuild code-splitting resolve import { z } from '@hono/zod-openapi' straight to zod and drop the edge to the module that runs extendZodWithOpenApi(z), so schemas could be built before the patch applied and .openapi() was undefined at runtime. Export z as an alias declaration instead: it compiles to a binding local to the module, which keeps that edge, while still carrying zod's type namespace so z.infer, z.ZodType and the rest continue to work. Fixes #2051.

@hono/zod-openapi@1.5.1

Patch Changes

Updated dependencies [7bc11dffa7dd5b639c614b12c34bd76722d76354]:

@hono/zod-validator@0.9.0

@hono/zod-openapi@1.5.0

Minor Changes

... (truncated)

Changelog

Sourced from @hono/zod-openapi's changelog.

1.6.3

Patch Changes

#2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

1.6.2

Patch Changes

#2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

#2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

#1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

1.6.1

Patch Changes

#1988 4fce28c6fbba41795b316becaf7d8cffa11fb521 Thanks @thekiwi! - Reduce route-typing type instantiations (~54% on TS6, ~48% on TS7 in a 100-route benchmark) by binding expensive sub-expressions once and sharing the input intersection / response-shape conditional.

1.6.0

Minor Changes

#2086 1dc1a4a5418be24d571652e1013b8a6a925824c0 Thanks @WolfieLeader! - feat: support the HTTP QUERY method in createRoute() by bumping @asteasolutions/zod-to-openapi to v9

1.5.3

Patch Changes

#2084 9a9324937cfa77db210a966be33e8c73bbbe33e3 Thanks @kamaal111! - Revert the local z binding export because it causes zod types to degrade to any when built with tsdown.

1.5.2

Patch Changes

#2069 fc0377c5595bde3147d181e5013a3fc710175e40 Thanks @edenbuilds! - fix(zod-openapi): keep the z import edge so .openapi() survives bundling

Re-exporting zod's z as a pass-through let esbuild code-splitting resolve import { z } from '@hono/zod-openapi' straight to zod and drop the edge to the module that runs extendZodWithOpenApi(z), so schemas could be built before the patch applied and .openapi() was undefined at runtime. Export z as an alias declaration instead: it compiles to a binding local to the module, which keeps that edge, while still carrying zod's type namespace so z.infer, z.ZodType and the rest continue to work. Fixes #2051.

1.5.1

... (truncated)

Commits

bc7d9e6 Version Packages (#2123)
3b08600 fix(zod-openapi): return 415 for request bodies with undeclared content type ...
b125de5 Version Packages (#2121)
28f1d39 fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler (#...
525564d perf(zod-openapi): Flatten batched route schemas (#2115)
38232db perf(zod-openapi): Reuse route response projections (#2116)
fdad95a Version Packages (#2101)
4fce28c fix(zod-openapi): reduce route type instantiations (#1988)
eb5f75d Version Packages (#2088)
1dc1a4a feat(zod-openapi): support the HTTP QUERY method (#2086)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/zod-openapi since your current version.

Updates @libsql/client from 0.14.0 to 0.18.0

Changelog

Sourced from @libsql/client's changelog.

Changelog

0.15.10 -- 2025-07-16

Bump to latest libsql package.

0.15.9 -- 2025-06-09

Bump to latest libsql package.

0.15.7 -- 2025-05-20

Bump to latest libsql package.

0.15.6 -- 2025-05-14

Bump to latest libsql package.

0.15.5 -- 2025-05-11

Bump to latest libsql package.

0.15.4 -- 2025-04-15

Bump to latest libsql package.

0.15.3 -- 2025-04-11

Bump to latest libsql package.

0.15.2 -- 2025-04-01

Bump to latest libsql package.

0.15.1 -- 2025-03-24

Bump to latest libsql package.

0.15.0 -- 2025-03-17

Bump to latest libsql package.

0.15.0-pre.3 -- 2025-03-11

Fix Bun complaint about duplicate "prepare" key in package.json

0.15.0-pre.2 -- 2024-02-11

Bump to latest libsql package.

... (truncated)

Commits

9496c78 0.18.0
f336495 fix(sqlite3): settle in-flight operations when the pool is torn down
1174d51 fix(sqlite3): give a client a connection pool, like the hrana clients
05e3344 fix(sqlite3): keep connection handle for in-memory databases across transactions
889a2ec 0.17.4
916fdf3 Add timeout config option for local sqlite3 connections
9d158a7 0.17.3
db72126 0.17.3-pre.2
e5d5841 Drop removed hrana-client re-exports from client test
82b63c0 0.17.3-pre.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @libsql/client since your current version.

Updates @scalar/hono-api-reference from 0.5.184 to 0.12.18

Changelog

Sourced from @scalar/hono-api-reference's changelog.

0.12.18

0.12.17

0.12.16

0.12.15

0.12.14

0.12.13

Patch Changes

#10629: Document AsyncAPI support in the Hono integration and use format-neutral types and JSDoc for Scalar.serve().

0.12.12

Patch Changes

#10529: Align import and export ordering with the Biome checks.

#10520: Sort imports and exports to satisfy the Biome checks.

#10526: Align import and export ordering with the repository CI checks.

0.12.11

Patch Changes

#10493: Floating surfaces now paint their own background, border, and shadow instead of using an absolutely positioned backdrop layer. The #backdrop slot on ScalarDropdown, ScalarPopover, ScalarListbox, and ScalarCombobox is removed; style the floating element with class instead. ScalarFloatingBackdrop, --scalar-lifted-brightness, and the brightness-lifted utility are deprecated in favor of bg-b-1 dark:bg-b-1.5. ScalarFloatingBackdrop itself now uses the same surface styles, so it no longer clips its slot or draws a real border. A new inset-shadow-border utility draws the hairline border so it can stack with shadow-* without taking up layout space; Tailwind's default inset-shadow-* sizes are reset, matching the other theme namespaces.

0.12.10

0.12.9

0.12.8

0.12.7

Patch Changes

#10375: Raise muted text, code-string blue and the deprecated schema row to the 4.5:1 text contrast minimum across the shipped themes

An accessibility audit turned up text that is legible in the default theme but not in several of the presets, which pair the default greys and blues with an off-white page background. Nine presets and four integration themes get a hue-preserving nudge:

Light --scalar-color-2 now clears 4.5:1 on both the page background and the grey card background in every preset. That covers alternate, bluePlanet, mars and saturn, which paired the default grey with an off-white page, and custom-theme-starter, deepSpace, elysiajs, fastify, kepler and purple, which copied the default grey and were left behind when the default moved.

Light --scalar-color-blue, which colours code strings, now clears 4.5:1 on the grey example background in alternate, bluePlanet, deepSpace, elysiajs, fastify, kepler and moon, and in the Docusaurus, NestJS, Next.js and SvelteKit themes.

Dark --scalar-color-blue now clears 4.5:1 in purple and saturn, and in the Hono and Docusaurus dark themes.

Deprecated schema rows no longer fade their contents to 75% opacity, which had dropped their muted text to 3.0:1. The diagonal stripes, the strikethrough on the property name and the Deprecated badge still mark the row.

The AsyncAPI send and receive pills blend their label further toward the body text colour, so they read against the tinted fill in every preset but laserwave.

--scalar-focus-color sits further from the accent so a keyboard focus ring clears 3:1 on --scalar-background-3 as well, which some presets use for the selected sidebar item.

... (truncated)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @scalar/hono-api-reference since your current version.

Updates hono from 4.13.13 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

fix(auth): escape backslashes in the WWW-Authenticate realm by @yusukebe in honojs/hono#5590

docs(contributing): drop the note about linking a fork branch by @yusukebe in honojs/hono#5593

fix(context): allow c.header() after the response body is consumed by @yusukebe in honojs/hono#5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

What's Changed

docs(contributing): ask for issues instead of RPs honojs/hono#5526

docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527

fix(adapters): accept Hono v5 prereleases in the hono peer range honojs/hono#5537

chore: unified oxfmt and oxlint config honojs/hono#5518

docs(readme): remove the deepwiki badge honojs/hono#5548

... (truncated)

Commits

c91b60a 4.13.16
e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
bf16471 Merge commit from fork
d88fab3 Merge commit from fork
34f9043 Merge commit from fork
8a103aa Merge commit from fork
15bbd96 Merge commit from fork
3cb29de 4.13.15
17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
Additional commits viewable in compare view

Updates zod from 3.25.76 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5

59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)

ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)

2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump

f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

75d63ee1 docs: show only the .properties() method form in the 4.6 post

46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits

b500a2e 4.6.7
9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates @types/bun from 1.4.3 to 1.4.4

Commits

See full diff in compare view

Updates drizzle-kit from 0.30.6 to 0.31.11

Release notes

Sourced from drizzle-kit's releases.

drizzle-kit@0.31.11

Warn about silent migration skips on drizzle-kit checks - thanks @shaneikennedy

drizzle-kit@0.31.10

Updated to hanji@0.0.8 - native bun stringWidth, stripANSI support, errors for non-TTY environments

We've migrated away from esbuild-register to tsx loader, it will now allow to use drizzle-kit seamlessly with both ESM and CJS modules

We've also added native Bun and Deno launch support, which will not trigger tsx loader and utilise native bun and deno imports capabilities and faster startup times

drizzle-kit@0.31.9

drizzle-kit api improvements for D1 connections

drizzle-kit@0.31.8

Bug fixes

Fixed algorythm => algorithm typo.

Fixed external dependencies in build configuration.

drizzle-kit@0.31.6

Bug fixes

[BUG]: Importing drizzle-kit/api fails in ESM modules

drizzle-kit@0.31.5

Add casing support to studio configuration and related functions

drizzle-kit@0.31.4

Fixed halfvec, bit and sparsevec type generation bug in drizzle-kit

drizzle-kit@0.31.3

Internal changes to Studio context. Added databaseName and packageName properties for Studio

drizzle-kit@0.31.2

Bug fixes

Fixed relations extraction to not interfere with Drizzle Studio.

drizzle-kit@0.31.1

Fixed drizzle-kit pull bugs when using Gel extensions.

Because Gel extensions create schema names containing :: (for example, ext::auth), Drizzle previously handled these names incorrectly. Starting with this release, you can use Gel extensions without any problems. Here’s what you should do:

Enable extensions schemas in drizzle.config.ts
import  { defineConfig } from "drizzle-kit";
export default defineConfig({
dialect: 'gel',
schemaFilter: ['ext::auth', 'public']
});
</tr></table>

... (truncated)

Commits

15454db +
54e436f exclude gel from pull
0fd1cc6 remove gel
d028db7 skip gel
93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
f9fc5bf Add drizzle-kit announcement manifest and schema doc
9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for drizzle-kit since your current version.

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

npm

Commits

1e4744d Merge branch 'main' into ts7-release
a5a219cmicrosoft/typescript-go#4558
ecfe30d Update status localization
5de25b5 Hide executable name in TypeScript status
d7ce74a Show bundled TypeScript version for packaged servers
29be66a Correct TS 7 release version to 7.0.2
ed2bd1b Merge branch 'main' into ts7-release
8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
d4eaca5microsoft/typescript-go#4549
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

github-actions · 2026-11-07T22:46:39Z

🛡️ GLASTOR® Specter — Semantic API Contract & SemVer Audit

Metric	Value	Status
Audit Verdict	`PASSED`	🟢 PASSED
Mathematical SemVer Impact	`PATCH`	🟢 PATCH (Compatible)
Contract SHA-256 Fingerprint	`36ccf64cfb69` → `36ccf64cfb69`	🔒 Immutable (100% Identical)
Exported Public Symbols	`24` base → `24` head	📁 9 files (TypeScript)
Contract Findings	`0` breaking / `0` minor	⚡ `18` ms
Conventional Commit Guard	`Commit` chore(deps): bump the runtime-dependencies group across 1 directory with 8 updates `(PATCH) is mathematically aligned with AST impact (PATCH)`	🟢 ALIGNED

flowchart LR
    B["Base Contract<br/>SHA256: 36ccf64cfb69..."] --> E["GLASTOR® Specter<br/>Polyglot AST Differ"]
    H["Head Contract<br/>SHA256: 36ccf64cfb69..."] --> E
    E --> V["SemVer: PATCH<br/>Verdict: PASSED"]

✅ Zero Public API Surface Mutations: All exported functions, structs, interfaces, and types preserve 100% binary & semantic contract compatibility.

Powered by GLASTOR® Core (vortex → specter → byte-gauge → medusa)

_{⚡ Audited in 18ms by GLASTOR® Specter • ⭐ Star us on GitHub}

🏅 Add the official GLASTOR® Specter badge to your README

[![API Contract: Specter](https://img.shields.io/badge/API%20Contract-Specter%20AST-8b5cf6?style=for-the-badge)](https://github.com/glastor-core/specter)

github-actions · 2026-11-07T22:47:02Z

🛡️ Nemesis Security & Hygiene Audit Report

Audit Target: . | Date: 2026-11-09T06:43:12.182Z
Commit: 3b7c320

📊 Summary by Severity

Severity	Count	Indicator
CRITICAL	1	🚨 Requiere atención inmediata
HIGH	0	✅ Limpio
MEDIUM	0	✅ Limpio
LOW / INFO	0	ℹ️ Información
TOTAL ACTIVAS	1	🟢 APROBADO

🔍 Modulos de Escaneo

Scanner	Categoría	Estado	Tiempo	Hallazgos
GITLEAKS	SECRET	✅ OK	779ms	1
SEMGREP	SAST	✅ OK	4301ms	0
TRIVY	SCA	✅ OK	5598ms	0
HYGIENE	HYGIENE	✅ OK	103ms	0
LICENSE	LICENSE	✅ OK	284ms	0

🚨 Secretos Expuestos (1)

⚠️ Peligro: Se encontraron posibles credenciales o claves de acceso en el código.

Regla	Archivo	Línea	Severidad
`curl-auth-header`	`README.md`	174	🔴 CRITICAL

📄 SBOM: CycloneDX SBOM generado exitosamente en .nemesis-reports/sbom.cyclonedx.json

🛡️ Audited by GLASTOR® Nemesis • ⭐ Star us on GitHub!

🏅 Embed Nemesis badge in your README

[![Protected by Nemesis](https://img.shields.io/badge/Security-Protected%20by%20Nemesis-6C5CE7?style=flat&logo=shield)](https://github.com/glastor-core/nemesis)

…ith 8 updates Bumps the runtime-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/zod-openapi](https://github.com/honojs/middleware/tree/HEAD/packages/zod-openapi) | `0.18.4` | `1.6.3` | | [@libsql/client](https://github.com/tursodatabase/libsql-client-ts/tree/HEAD/packages/libsql-client) | `0.14.0` | `0.18.0` | | [@scalar/hono-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/hono) | `0.5.184` | `0.12.18` | | [hono](https://github.com/honojs/hono) | `4.13.13` | `4.13.16` | | [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.6.7` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.3` | `1.4.4` | | [drizzle-kit](https://github.com/drizzle-team/drizzle-orm) | `0.30.6` | `0.31.11` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `@hono/zod-openapi` from 0.18.4 to 1.6.3 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-openapi/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/zod-openapi@1.6.3/packages/zod-openapi) Updates `@libsql/client` from 0.14.0 to 0.18.0 - [Release notes](https://github.com/tursodatabase/libsql-client-ts/releases) - [Changelog](https://github.com/tursodatabase/libsql-client-ts/blob/main/CHANGELOG.md) - [Commits](https://github.com/tursodatabase/libsql-client-ts/commits/v0.18.0/packages/libsql-client) Updates `@scalar/hono-api-reference` from 0.5.184 to 0.12.18 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/hono/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/hono) Updates `hono` from 4.13.13 to 4.13.16 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.13...v4.13.16) Updates `zod` from 3.25.76 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.76...v4.6.7) Updates `@types/bun` from 1.4.3 to 1.4.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) Updates `drizzle-kit` from 0.30.6 to 0.31.11 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.30.6...drizzle-kit@0.31.11) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: "@hono/zod-openapi" dependency-version: 1.6.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: runtime-dependencies - dependency-name: "@libsql/client" dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime-dependencies - dependency-name: "@scalar/hono-api-reference" dependency-version: 0.12.17 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime-dependencies - dependency-name: "@types/bun" dependency-version: 1.4.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: runtime-dependencies - dependency-name: drizzle-kit dependency-version: 0.31.11 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: runtime-dependencies - dependency-name: hono dependency-version: 4.13.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: runtime-dependencies - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: runtime-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 7, 2026

github-actions Bot added the area:docs-config label Nov 7, 2026

dependabot Bot changed the title ~~chore(deps): bump the runtime-dependencies group with 8 updates~~ chore(deps): bump the runtime-dependencies group across 1 directory with 8 updates Nov 9, 2026

dependabot Bot force-pushed the dependabot/bun/runtime-dependencies-872d170d7a branch from ef8e1f3 to 1e296ec Compare November 9, 2026 06:42

Navigation Menu

Repository navigation

chore(deps): bump the runtime-dependencies group across 1 directory with 8 updates - #2

chore(deps): bump the runtime-dependencies group across 1 directory with 8 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/runtime-dependencies-872d170d7a

dependabot Bot commented on behalf of github Nov 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​hono/zod-openapi@​1.6.3

Patch Changes

@​hono/zod-openapi@​1.6.2

Patch Changes

@​hono/zod-openapi@​1.6.1

Patch Changes

@​hono/zod-openapi@​1.6.0

Minor Changes

@​hono/zod-openapi@​1.5.3

Patch Changes

@​hono/zod-openapi@​1.5.2

Patch Changes

@​hono/zod-openapi@​1.5.1

Patch Changes

@​hono/zod-openapi@​1.5.0

Minor Changes

1.6.3

Patch Changes

1.6.2

Patch Changes

1.6.1

Patch Changes

1.6.0

Minor Changes

1.5.3

Patch Changes

1.5.2

Patch Changes

1.5.1

Changelog

0.15.10 -- 2025-07-16

0.15.9 -- 2025-06-09

0.15.7 -- 2025-05-20

0.15.6 -- 2025-05-14

0.15.5 -- 2025-05-11

0.15.4 -- 2025-04-15

0.15.3 -- 2025-04-11

0.15.2 -- 2025-04-01

0.15.1 -- 2025-03-24

0.15.0 -- 2025-03-17

0.15.0-pre.3 -- 2025-03-11

0.15.0-pre.2 -- 2024-02-11

0.12.18

0.12.17

0.12.16

0.12.15

0.12.14

0.12.13

Patch Changes

0.12.12

Patch Changes

0.12.11

Patch Changes

0.12.10

0.12.9

0.12.8

0.12.7

Patch Changes

v4.13.16

Security fixes

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

validator('form') skips validation for multipart/form-data requests with extra parameters

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

csrf() does not check requests sent by hyperlink auditing (text/ping)

What's Changed

v4.13.15

What's Changed

v4.13.14

What's Changed

v4.6.7

Commits:

v4.6.6

Commits:

v4.6.5

Commits:

v4.6.4

dependabot Bot commented on behalf of github Nov 7, 2026 •

edited

Loading

`@hono/zod-openapi@1`.6.3

`@hono/zod-openapi@1`.6.2

`@hono/zod-openapi@1`.6.1

`@hono/zod-openapi@1`.6.0

`@hono/zod-openapi@1`.5.3

`@hono/zod-openapi@1`.5.2

`@hono/zod-openapi@1`.5.1

`@hono/zod-openapi@1`.5.0

`mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

`validator('form')` skips validation for `multipart/form-data` requests with extra parameters

`css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

`csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

Fixed `drizzle-kit pull` bugs when using Gel extensions.

github-actions Bot commented Nov 7, 2026 •

edited

Loading

github-actions Bot commented Nov 7, 2026 •

edited

Loading