Skip to content

deps(deps): bump the production-minor-patch group across 1 directory with 24 updates - #44

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-minor-patch-752d505506
Open

deps(deps): bump the production-minor-patch group across 1 directory with 24 updates#44
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-minor-patch-752d505506

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026 •
edited by sourcery-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 24 updates in the / directory:

Package From To
@cloudflare/puppeteer 1.1.0 1.3.0
@cloudflare/workers-oauth-provider 0.8.1 0.10.3
agents 0.17.4 0.20.1
hono 4.12.25 4.13.2
yjs 13.6.31 13.6.32
@modelcontextprotocol/sdk 1.29.0 1.30.0
@fontsource/fraunces 5.2.9 5.3.0
@fontsource/public-sans 5.2.7 5.3.0
@isomorphic-git/lightning-fs 4.6.2 4.7.0
@tsparticles/engine 4.3.0 4.3.2
@tsparticles/plugin-emitters 4.3.0 4.3.2
@tsparticles/react 4.3.0 4.3.2
@tsparticles/shape-text 4.3.0 4.3.2
@tsparticles/slim 4.3.0 4.3.2
dompurify 3.4.12 3.4.13
isomorphic-git 1.38.7 1.41.4
lucide-react 1.24.0 1.31.0
radix-ui 1.6.2 1.6.7
react-i18next 17.0.10 17.0.11
react-router-dom 7.16.0 7.18.2
sonner 2.0.7 2.0.8
@supabase/supabase-js 2.106.2 2.112.3
fuse.js 7.4.0 7.5.0
mammoth 1.12.0 1.12.1

Updates @cloudflare/puppeteer from 1.1.0 to 1.3.0

Release notes

Sourced from @​cloudflare/puppeteer's releases.

v1.3.0

What's Changed

Full Changelog: cloudflare/puppeteer@v1.2.0...v1.3.0

v1.2.0

What's Changed

Full Changelog: cloudflare/puppeteer@v1.1.0...v1.2.0

Commits
  • 64b3255 Merge pull request #232 from cloudflare/scardita/add_browser_option
  • fdc19f0 feat(cloudflare): add browser launch option to select kitesurf
  • 08707e0 Merge pull request #231 from cloudflare/scardita/enable-trusted-publishing
  • 0bde29c Enable trusted publishing of packages
  • fb2979b Merge pull request #223 from cloudflare/ruskin/brapi-cdp-types
  • f0aee62 fix(types): make Cloudflare.* CDP commands type-check correctly
  • e4b373c chore(lint): fix pre-existing prettier violations blocking CI
  • 27a7bb7 style: fix pre-existing prettier violation in PuppeteerWorkers.ts
  • f0918b8 fix(cloudflare): satisfy lint on Cloudflare.* CDP types
  • e26649b fix(cloudflare): drop unused ProtocolMapping import
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cloudflare/puppeteer since your current version.


Updates @cloudflare/workers-oauth-provider from 0.8.1 to 0.10.3

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.10.3

Patch Changes

  • #299 dc63ec8 Thanks @​mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

v0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

v0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

v0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

v0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

v0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable metadata_resolution_failed reason, and underlying diagnostic detail. The token endpoint still returns the same generic invalid_client / "Client not found" response, but reports the failure through the onError hook's internal field (category client-id-metadata-document) together with a new optional request field. Breaking for callers of OAuthHelpers.lookupClient (and methods built on it) that relied on null for CIMD fetch failures: catch

... (truncated)

Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.10.3

Patch Changes

  • #299 dc63ec8 Thanks @​mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

0.10.2

Patch Changes

  • #295 3a41fd7 Thanks @​mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

    DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

0.10.1

Patch Changes

  • #287 30b1f4f Thanks @​mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

  • #285 737dfa2 Thanks @​mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

  • #288 7a6baf9 Thanks @​mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

    Deprecate resourceMatchOriginOnly without changing its behavior.

0.10.0

Minor Changes

  • #283 b36f841 Thanks @​mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

0.9.1

Patch Changes

  • #280 43b9fa4 Thanks @​mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

0.9.0

Minor Changes

  • #253 f4e026c Thanks @​mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

  • #248 194154e Thanks @​ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable

... (truncated)

Commits
  • d83b2e7 Version Packages (#300)
  • dc63ec8 fix(cimd): scope default grant revocation to the authorizing redirect URI (#299)
  • f3b8b27 Version Packages (#296)
  • 3a41fd7 fix(cimd): centralize client metadata resolution (#295)
  • a316ce8 Version Packages (#286)
  • 9e3f44d chore: release resource compatibility as patch (#291)
  • a3e69f7 refactor(auth): simplify client auth storage (#290)
  • 7a6baf9 fix(resource): preserve omission and legacy grants (#288)
  • 30b1f4f fix(auth): preserve legacy client-secret transports (#287)
  • 737dfa2 fix(cimd): negotiate optional client capabilities (#285)
  • Additional commits viewable in compare view

Updates agents from 0.17.4 to 0.20.1

Release notes

Sourced from agents's releases.

agents@0.20.1

Patch Changes

  • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

  • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

    Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

    chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

    v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

agents@0.20.0

Minor Changes

  • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

    Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

    The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

    The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

    The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

    The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

    @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

    Deprecations in this release:

    • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
    • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
    • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

    experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

  • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

agents@0.19.0

Minor Changes

  • #1922 cb4c1c7 Thanks @​cjol! - Support both AI SDK v6 and v7.

    The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when

... (truncated)

Changelog

Sourced from agents's changelog.

0.20.1

Patch Changes

  • #1987 ad015c2 Thanks @​mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

  • #1982 e983026 Thanks @​mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

    Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

    chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

    v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

0.20.0

Minor Changes

  • #1557 447013d Thanks @​mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

    Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

    The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

    The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

    The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

    The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

    @cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

    Deprecations in this release:

    • McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.
    • Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.
    • The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

    experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

  • #1981 6c01c8d Thanks @​agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

0.19.0

Minor Changes

... (truncated)

Commits

Updates hono from 4.12.25 to 4.13.2

Release notes

Sourced from hono's releases.

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
ping — GET / 165.83 ns 163.99 ns 1.01x
query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
json — GET /user 528.99 ns 422.44 ns 1.25x
body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

... (truncated)

Commits
  • 41bdc42 4.13.2
  • 6ea514d feat(secure-headers): add missing W3C Permissions-Policy directives (#5214)
  • 329b6f4 fix(client): send falsy JSON bodies (#5215)
  • a1e4ac7 perf(cors): pre-join static array header options during initialization (#5210)
  • d982f63 fix(url): strip trailing question mark correctly for optional params with reg...
  • 26de731 fix(etag): stabilize digest across stream chunks (#5205)
  • 7075369 Revert " fix(etag): resolve incorrect incremental hashing for chunked respons...
  • f2a72d3 fix(client): serialize multiple cookies correctly (#5202)
  • 8a5852d fix(etag): resolve incorrect incremental hashing for chunked responses (#5199)
  • 765d13b fix(jsx): render async children of document metadata tags instead of [object ...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates yjs from 13.6.31 to 13.6.32

Release notes

Sourced from yjs's releases.

v13.6.32

  • fix #797 - undomanager clears destroy handler 95e890d9

yjs/yjs@v13.6.31...v13.6.32

Commits

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates @fontsource/fraunces from 5.2.9 to 5.3.0

Commits

Updates @fontsource/public-sans from 5.2.7 to 5.3.0

Commits

Updates @isomorphic-git/lightning-fs from 4.6.2 to 4.7.0

Release notes

Sourced from @​isomorphic-git/lightning-fs's releases.

v4.7.0

4.7.0 (2026-07-25)

Features

v4.6.3

4.6.3 (2026-07-20)

Bug Fixes

Commits
Maintainer changes

This version was pushed to npm by jcubic, a new releaser for @​isomorphic-git/lightning-fs since your current version.

...

Description has been truncated

@dependabot
deps(deps): bump the production-minor-patch group across 1 directory …
4310ab1 
…with 24 updates

Bumps the production-minor-patch group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/puppeteer](https://github.com/cloudflare/puppeteer) | `1.1.0` | `1.3.0` |
| [@cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider) | `0.8.1` | `0.10.3` |
| [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.17.4` | `0.20.1` |
| [hono](https://github.com/honojs/hono) | `4.12.25` | `4.13.2` |
| [yjs](https://github.com/yjs/yjs) | `13.6.31` | `13.6.32` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [@fontsource/fraunces](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/fraunces) | `5.2.9` | `5.3.0` |
| [@fontsource/public-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/public-sans) | `5.2.7` | `5.3.0` |
| [@isomorphic-git/lightning-fs](https://github.com/isomorphic-git/lightning-fs) | `4.6.2` | `4.7.0` |
| [@tsparticles/engine](https://github.com/tsparticles/tsparticles/tree/HEAD/engine) | `4.3.0` | `4.3.2` |
| [@tsparticles/plugin-emitters](https://github.com/tsparticles/tsparticles/tree/HEAD/plugins/emitters) | `4.3.0` | `4.3.2` |
| [@tsparticles/react](https://github.com/tsparticles/tsparticles/tree/HEAD/wrappers/react) | `4.3.0` | `4.3.2` |
| [@tsparticles/shape-text](https://github.com/tsparticles/tsparticles/tree/HEAD/shapes/text) | `4.3.0` | `4.3.2` |
| [@tsparticles/slim](https://github.com/tsparticles/tsparticles/tree/HEAD/bundles/slim) | `4.3.0` | `4.3.2` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.13` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.38.7` | `1.41.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.24.0` | `1.31.0` |
| [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.2` | `1.6.7` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.10` | `17.0.11` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.16.0` | `7.18.2` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.106.2` | `2.112.3` |
| [fuse.js](https://github.com/krisk/Fuse) | `7.4.0` | `7.5.0` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.0` | `1.12.1` |



Updates `@cloudflare/puppeteer` from 1.1.0 to 1.3.0
- [Release notes](https://github.com/cloudflare/puppeteer/releases)
- [Commits](cloudflare/puppeteer@v1.1.0...v1.3.0)

Updates `@cloudflare/workers-oauth-provider` from 0.8.1 to 0.10.3
- [Release notes](https://github.com/cloudflare/workers-oauth-provider/releases)
- [Changelog](https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md)
- [Commits](cloudflare/workers-oauth-provider@v0.8.1...v0.10.3)

Updates `agents` from 0.17.4 to 0.20.1
- [Release notes](https://github.com/cloudflare/agents/releases)
- [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/agents/commits/agents@0.20.1/packages/agents)

Updates `hono` from 4.12.25 to 4.13.2
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.2)

Updates `yjs` from 13.6.31 to 13.6.32
- [Release notes](https://github.com/yjs/yjs/releases)
- [Commits](yjs/yjs@v13.6.31...v13.6.32)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `@fontsource/fraunces` from 5.2.9 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/fraunces)

Updates `@fontsource/public-sans` from 5.2.7 to 5.3.0
- [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/public-sans)

Updates `@isomorphic-git/lightning-fs` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/isomorphic-git/lightning-fs/releases)
- [Commits](isomorphic-git/lightning-fs@v4.6.2...v4.7.0)

Updates `@tsparticles/engine` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/engine/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/engine)

Updates `@tsparticles/plugin-emitters` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/plugins/emitters/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/plugins/emitters)

Updates `@tsparticles/react` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/wrappers/react/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/wrappers/react)

Updates `@tsparticles/shape-text` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/shapes/text/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/shapes/text)

Updates `@tsparticles/slim` from 4.3.0 to 4.3.2
- [Release notes](https://github.com/tsparticles/tsparticles/releases)
- [Changelog](https://github.com/tsparticles/tsparticles/blob/main/bundles/slim/CHANGELOG.md)
- [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/bundles/slim)

Updates `dompurify` from 3.4.12 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.13)

Updates `isomorphic-git` from 1.38.7 to 1.41.4
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.38.7...v1.41.4)

Updates `lucide-react` from 1.24.0 to 1.31.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react)

Updates `radix-ui` from 1.6.2 to 1.6.7
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui)

Updates `react-i18next` from 17.0.10 to 17.0.11
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.10...v17.0.11)

Updates `react-router-dom` from 7.16.0 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `@supabase/supabase-js` from 2.106.2 to 2.112.3
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.112.3/packages/core/supabase-js)

Updates `fuse.js` from 7.4.0 to 7.5.0
- [Release notes](https://github.com/krisk/Fuse/releases)
- [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md)
- [Commits](krisk/Fuse@v7.4.0...v7.5.0)

Updates `mammoth` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.0...1.12.1)

---
updated-dependencies:
- dependency-name: "@cloudflare/puppeteer"
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@cloudflare/workers-oauth-provider"
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: agents
  dependency-version: 0.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: hono
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: yjs
  dependency-version: 13.6.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@fontsource/fraunces"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@fontsource/public-sans"
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@isomorphic-git/lightning-fs"
  dependency-version: 4.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/engine"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/plugin-emitters"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/react"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/shape-text"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@tsparticles/slim"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: isomorphic-git
  dependency-version: 1.41.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: lucide-react
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: radix-ui
  dependency-version: 1.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: react-i18next
  dependency-version: 17.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.112.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: fuse.js
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: mammoth
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants