Skip to content

chore(deps): bump the all-dependencies group across 2 directories with 5 updates - #441

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/x402-facilitator-node/all-dependencies-3e19939b06
Closed

chore(deps): bump the all-dependencies group across 2 directories with 5 updates#441
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/x402-facilitator-node/all-dependencies-3e19939b06

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 4 updates in the /packages/x402-facilitator-node directory: viem, hono, @types/node and vitest.
Bumps the all-dependencies group with 1 update in the /script/gasless-tests directory: dotenv.

Updates viem from 2.56.3 to 2.56.8

Release notes

Sourced from viem's releases.

viem@2.56.8

Patch Changes

viem@2.56.7

Patch Changes

viem@2.56.6

Patch Changes

viem@2.56.5

Patch Changes

Commits

Updates hono from 4.13.7 to 4.13.8

Release notes

Sourced from hono's releases.

v4.13.8

What's Changed

Full Changelog: honojs/hono@v4.13.7...v4.13.8

Commits
  • 098e119 4.13.8
  • e8c8c21 perf(jsx/dom): optimize matching-head child lookup during reconciliation (#5329)
  • 8755b17 docs(combine): fix except() JSDoc param and add missing @​returns (#5346)
  • edd138e fix(request): keep the request media type when reusing a cached body (#5366)
  • 9b4e9c2 fix(accept): clamp a negative q to 0, not 1 (#5357)
  • 65cff90 fix(accept): treat the q parameter name as case-insensitive (#5349)
  • f147de5 fix(accepts, language): skip accept entries with quality 0 when matching (#5311)
  • 90e1b94 fix(aws-lambda): respect backpressure when streaming the response body (#5351)
  • 7792f5d perf(jsx/dom): reduce lookup work for large keyed updates (#5340)
  • e7b38ee docs: fix typos in code comments and link third-party middleware section (#5343)
  • See full diff in compare view

Updates @types/node from 26.5.1 to 26.6.1

Commits

Updates vitest from 5.0.0 to 5.0.1

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 03630a5 chore: release v5.0.1 (#11275)
  • a47d790 fix(fakeTimers): force queueMicrotask and nextTick in toNotFake (#11261)
  • 2ce29d5 fix: warn when deprecated deps.optimizer.web is used (#11214)
  • ccd6d05 docs: fix typecheck exclude default in documentation (#11223)
  • 91ab158 fix(doctor): measure vm pools for custom environments (#11212)
  • 23dda73 fix: share the server on self-referencing extends (#11034)
  • 498fbe9 fix: resolve ResolvedConfig exactOptionalPropertyTypes errors (#11175)
  • 115c3f6 fix: correct typos in error message and comments (#11187)
  • 7361465 fix: keep metadata file when clearing the cache (#11199)
  • 972e24b fix(browser): avoid double quotes in config.define (#11198)
  • Additional commits viewable in compare view

Updates dotenv from 17.4.2 to 18.0.0

Changelog

Sourced from dotenv's changelog.

18.0.0 (2026-09-17)

Added

  • NEW: Dotenv now has a CLI. (#1022)
$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
  • NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)
$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

  • Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

  • Remove tips (#1031)
  • Remove skill files (#1032)
  • Remove Spanish README (#1034)
  • Remove .env.vault support (#1033)
  • Remove preloading. Instead use cli dotenv run -- your-command (#1035)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all-dependencies group across 2 directories wit…
b39e4a1 
…h 5 updates

Bumps the all-dependencies group with 4 updates in the /packages/x402-facilitator-node directory: [viem](https://github.com/wevm/viem), [hono](https://github.com/honojs/hono), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).
Bumps the all-dependencies group with 1 update in the /script/gasless-tests directory: [dotenv](https://github.com/motdotla/dotenv).


Updates `viem` from 2.56.3 to 2.56.8
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.56.3...viem@2.56.8)

Updates `hono` from 4.13.7 to 4.13.8
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.7...v4.13.8)

Updates `@types/node` from 26.5.1 to 26.6.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/vitest)

Updates `dotenv` from 17.4.2 to 18.0.0
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.4.2...v18.0.0)

---
updated-dependencies:
- dependency-name: viem
  dependency-version: 2.56.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: hono
  dependency-version: 4.13.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: vitest
  dependency-version: 5.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: dotenv
  dependency-version: 18.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
@github-actions github-actions Bot added the major-update Dependabot major version bump — needs human review, never auto-merged label Sep 21, 2026
clestons
clestons approved these changes Sep 23, 2026
View reviewed changes

@clestons clestons left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verdict: APPROVE

Dependabot group bump across 2 directories: viem 2.56.3→2.56.8, hono 4.13.7→4.13.8, @types/node 26.5.1→26.6.1, vitest 5.0.0→5.0.1 (all patch, packages/x402-facilitator-node), and dotenv 17→18 (major, script/gasless-tests).

Verified, not just read

  • dotenv is a major version bump — checked it specifically since patch/minor bumps get less scrutiny by default. All 14 call sites in script/gasless-tests use the same simple require('dotenv').config({ path: ... }) pattern; installed dotenv 18.0.0 directly and smoke-tested that exact call shape — works unchanged, returns the expected { parsed } result shape.
  • Built and tested x402-facilitator-node on the bumped deps: tsc clean, vitest run → 21/21 tests pass.
  • viem/hono/vitest are all patch releases (bug fixes only per their release notes, no API changes) — appropriately low-scrutiny given the version-bump semantics.

R1a/R1b

Both clean — correctly triaged as a mechanical dependency bump.

[2-round] R1a/R1b: no findings. The one thing worth independently verifying (dotenv's major bump) was checked directly rather than assumed safe from CI alone.

Self-assessment

  • DeepSeek 0/2 useful on substance (correctly quiet, but neither flagged that one of the five bumps was a major version — worth noting as a prompt gap: major-version bumps in a dependency-group PR deserve a call-out even when the diff itself looks mechanical).

@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 28, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/packages/x402-facilitator-node/all-dependencies-3e19939b06 branch September 28, 2026 15:16
@github-actions github-actions Bot locked and limited conversation to collaborators Sep 28, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@clestons clestons clestons approved these changes
@fanhousanbu fanhousanbu Awaiting requested review from fanhousanbu fanhousanbu is a code owner
@jhfnetboy jhfnetboy Awaiting requested review from jhfnetboy jhfnetboy is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code major-update Dependabot major version bump — needs human review, never auto-merged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@clestons