Skip to content

chore(deps): update all non-major dependencies#49

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#49
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 17, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@rslib/core (source) ^0.21.4 → ^0.21.5 age confidence
@rslint/core ^0.5.2 → ^0.5.3 age confidence
@rspack/core (source) 2.0.3 → 2.0.4 age confidence
@rstest/core (source) 0.9.10 → 0.10.2 age confidence
@types/node (source) ^24.12.3 → ^24.12.4 age confidence
hono (source) ^4.12.18 → ^4.12.22 age confidence
koa (source) ^3.2.0 → ^3.2.1 age confidence
pnpm (source) 11.1.2 → 11.2.2 age confidence

Release Notes

web-infra-dev/rslib (@​rslib/core)

v0.21.5

Compare Source

What's Changed
New Features 🎉
Bug Fixes 🐞
Other Changes
New Contributors

Full Changelog: web-infra-dev/rslib@v0.21.4...v0.21.5

web-infra-dev/rslint (@​rslint/core)

v0.5.3

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Refactor 🔨
Documentation 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rslint@v0.5.2...v0.5.3

web-infra-dev/rspack (@​rspack/core)

v2.0.4

Compare Source

Highlights 💡

  • Inline const with module declarations (#​14032): Previously, Rspack only inlined constant exports from leaf modules in the module graph. Now constant exports from any module can be inlined, even when that module also imports or re-exports other modules. In rare circular-reference cases this can make a TDZ error disappear, but we do not expect real projects to rely on TDZ errors, so Rspack prioritizes the optimization.

    // constants.js
import './setup';

export const ENABLE_EXPERIMENT = false;

// entry.js
import { ENABLE_EXPERIMENT } from './constants';

if (ENABLE_EXPERIMENT) {
  runExperiment();
}

// Before: constants.js is not a leaf module, so the branch could keep
// reading the imported binding.
if (ENABLE_EXPERIMENT) {
  runExperiment();
}

// Now: the constant can still be inlined, so dead branches are easier
// to remove.
if (false) {
  runExperiment();
}

  • Tree shake namespace default reexport (#​13980): Previously, the import * as a from './a'; export default a; pattern did not tree-shake a through the default export. Now Rspack further analyzes the default-exported namespace object and can remove unused exports from the original namespace module.

    // a.js
export function used() {}
export function unused() {}

// bridge.js
import * as a from './a';
export default a;

// app.js
import a from './bridge';

a.used();

// Before: both used and unused could be kept in the bundle.
// Now: unused can be tree-shaken.

  • CSS global module type (#​13988): css/global is useful when most selectors in a stylesheet should stay global, but you still want CSS Modules features for selected local selectors. This makes it easier to migrate existing global CSS gradually without turning every class name into a local scoped name.

    export default {
  module: {
    rules: [{ test: /\.global\.css$/i, type: 'css/global' }],
  },
};
    /* style.global.css */
.button {
  color: red;
}

:local(.title) {
  font-weight: 600;
}

    .button stays global, while .title is renamed as a local class.

  • CSS Modules local ident options (#​14009): CSS Modules now support local ident hash options such as hash function, digest, digest length, and salt. These options make generated class names more configurable and better aligned with webpack-compatible CSS Modules setups.

    export default {
  module: {
    rules: [{ test: /\.module\.css$/i, type: 'css/module' }],
    generator: {
      'css/module': {
        localIdentName: '[name]__[local]__[hash]',
        localIdentHashFunction: 'xxhash64',
        localIdentHashDigest: 'hex',
        localIdentHashDigestLength: 8,
        localIdentHashSalt: 'my-salt',
      },
    },
  },
};
What's Changed
New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rspack@v2.0.3...v2.0.4

web-infra-dev/rstest (@​rstest/core)

v0.10.2

Compare Source

Highlights

Auto-restore mocks with using (#​1293)

Mock instances now implement Symbol.dispose, so spies are automatically restored when a using block exits — no more manual mockRestore() in afterEach.

import { test, rstest } from '@​rstest/core';

test('reads config', () => {
  using readSpy = rstest.spyOn(fs, 'readFileSync');
  // ...
}); // readSpy is restored here

What's Changed

New Features 🎉
Performance 🚀
  • perf(coverage-istanbul): optimize sourcemap URL scanning by @​9aoy in #​1296
  • perf(coverage-v8): skip unnecessary coverage conversion by @​9aoy in #​1298
Bug Fixes 🐞
Document 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rstest@v0.10.1...v0.10.2

v0.10.1

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rstest@v0.10.0...v0.10.1

v0.10.0

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rstest@v0.9.10...v0.10.0

honojs/hono (hono)

v4.12.22

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.12.21...v4.12.22

v4.12.21

Compare Source

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

v4.12.20

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.12.19...v4.12.20

v4.12.19

Compare Source

What's Changed

  • ci: pin GitHub Actions to SHAs by @​yusukebe in #​4932
  • fix(serveStatic): make options parameter optional in all adapters by @​mixelburg in #​4934
  • fix(cookie): return the first cookie when there are multiple cookies with the same name by @​usualoma in #​4922
  • feat(bearer-auth): make bearerAuth generic for typed context in verifyT

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from da6b8c8 to b27a9f0 Compare May 22, 2026 18:29
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from b27a9f0 to 90e6b96 Compare May 24, 2026 11:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants