Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 8 updates - #50

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-0d28640c3e
Open

chore(deps): bump the npm_and_yarn group across 3 directories with 8 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-0d28640c3e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
file-type 21.3.0 21.3.2
hono 4.12.7 4.12.12
tar 7.5.10 7.5.11
undici 7.21.0 7.24.0
yaml 2.8.2 2.8.3
vite 5.4.21 6.4.2
music-metadata 11.11.2 11.12.3

Bumps the npm_and_yarn group with 1 update in the /extensions/zalo directory: undici.
Bumps the npm_and_yarn group with 1 update in the /ui directory: vite.

Updates file-type from 21.3.0 to 21.3.2

Release notes

Sourced from file-type's releases.

v21.3.2

  • Fix ZIP bomb in known-size ZIP probing (GHSA-j47w-4g3g-c36v) a155cd7
  • Fix bound recursive BOM and ID3 detection 370ed91

sindresorhus/file-type@v21.3.1...v21.3.2

v21.3.1

sindresorhus/file-type@v21.3.0...v21.3.1

Commits

Updates hono from 4.12.7 to 4.12.12

Release notes

Sourced from hono's releases.

v4.12.12

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4

Users who use Serve Static, Static Site Generation, Cookie utilities, or IP restriction middleware are strongly encouraged to upgrade to this version.

v4.12.11

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.10...v4.12.11

v4.12.10

What's Changed

New Contributors

... (truncated)

Commits

Updates tar from 7.5.10 to 7.5.11

Commits

Updates undici from 7.21.0 to 7.24.0

Release notes

Sourced from undici's releases.

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

Affected and patched ranges

References

v7.23.0

What's Changed

... (truncated)

Commits
  • 07a3906 Bumped v7.24.0 (#4887)
  • 74495c6 fix: reject duplicate content-length and host headers
  • 84235c6 Fix websocket 64-bit length overflow
  • 77594f9 fix: validate upgrade header to prevent CRLF injection
  • cb79c57 fix: validate server_max_window_bits range in permessage-deflate
  • 4147ce2 Merge commit '2ee00cb3'
  • 2ee00cb fix(websocket): add maxDecompressedMessageSize limit for permessage-deflate
  • 5890c7b fix(deduplicate): stream response chunks to waiting handlers
  • fbda3c1 Bumped v7.23.0 (#4884)
  • 07276c9 fix: remove unused kSocketPath symbol
  • Additional commits viewable in compare view

Updates yaml from 2.8.2 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

  • Add trailingComma ToString option for multiline flow formatting (#670)
  • Catch stack overflow during node composition (1e84ebb)
Commits
  • ce14587 2.8.3
  • 1e84ebb fix: Catch stack overflow during node composition
  • 6b24090 ci: Include Prettier check in lint action
  • 9424dee chore: Refresh lockfile
  • d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
  • 4321509 ci: Drop the branch filter from GitHub PR actions
  • 47207d0 chore: Update docs-slate
  • 5212fae chore: Update docs-slate
  • See full diff in compare view

Updates vite from 5.4.21 to 6.4.2

Release notes

Sourced from vite's releases.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

  • feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

  • fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

  • fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965
  • fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940
  • refactor: remove duplicate plugin context type (#19935) (d6d01c2), closes #19935

6.3.3 (2025-04-24)

... (truncated)

Commits

Updates music-metadata from 11.11.2 to 11.12.3

Release notes

Sourced from music-metadata's releases.

v11.12.3

Changes

🐛 Bug Fixes

📦 NPM release

NPM release: music-metadata@11.12.3

v11.12.2

⚠️ This release is missing TypeScript declarations, use v11.12.3 instead.

Changes

🐛 Bug Fixes

⬆️ Dependencies

📦 NPM release

NPM release: music-metadata@11.12.2

v11.12.1

Changes

🐛 Bug Fixes

📦 NPM release

NPM release: music-metadata@11.12.1

v11.12.0

Changes

🚀 Enhancements

📦 NPM release

NPM release: music-metadata@11.12.0

Commits
  • 894a9e8 11.12.3
  • 2beb45c Fix TypeScript decleration inclusion
  • 7f13e8e 11.12.2
  • 7e5be08 Upgrade @biomejs/biome to 2.4.6
  • 318e963 Fix CWE-85 by avoiding infinite loop in ASF
  • 5b7e69c Simplify tsconfig.prod.json by removing unused options
  • 1ffe9bf Bump tar from 7.5.7 to 7.5.11
  • 20f4683 Bump c8 from 10.1.3 to 11.0.0
  • cfcf152 Bump @​borewit/text-codec from 0.2.1 to 0.2.2
  • 2e4e40c Bump minimatch from 9.0.5 to 9.0.9
  • Additional commits viewable in compare view

Updates esbuild from 0.21.5 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12

  • Fix a minification regression with CSS media queries (#4315)

    The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.

  • Update the list of known JavaScript globals (#4310)

    This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

    From ES2017:

    • Atomics
    • SharedArrayBuffer

    From ES2020:

    • BigInt64Array
    • BigUint64Array

    From ES2021:

    • FinalizationRegistry
    • WeakRef

    From ES2025:

    • Float16Array
    • Iterator

    Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:

    // This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}

  • Add support for the new @view-transition CSS rule (#4313)

    With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):

    /* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@​view-transition { navigation: auto; types: check; }
/* New output */
@​view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits

    

  • 208f539 publish 0.25.12 to npm
    • 

  • 5f03afd update release notes
    • 

  • 6b2ee78 minify: remove css rules containing empty :is()
    • 

  • f361deb add some additional known static methods
    • 

  • 07aa646 automatically mark "RegExp.escape()" calls as pure
    • 

  • 9039c46 simplify some call expression checks
    • 

  • 188944d add some additional known static methods
    • 

  • d3c67f9 fix #4310: add Iterator and other known globals
    • 

  • 4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
    • 

  • 26b29ed fix #4315: @media deduplication bug edge case
    • 

  • Additional commits viewable in compare view
    • 







Updates undici from 7.21.0 to 7.24.0



Release notes

Sourced from undici's releases.




v7.24.0


Undici v7.24.0 Security Release Notes


This release addresses multiple security vulnerabilities in Undici.


Upgrade guidance


All users on v7 should upgrade to v7.24.0 or later.


Fixed advisories



Affected and patched ranges



References



v7.23.0


What's Changed





... (truncated)





Commits

    

  • 07a3906 Bumped v7.24.0 (#4887)
    • 

  • 74495c6 fix: reject duplicate content-length and host headers
    • 

  • 84235c6 Fix websocket 64-bit length overflow
    • 

  • 77594f9 fix: validate upgrade header to prevent CRLF injection
    • 

  • cb79c57 fix: validate server_max_window_bits range in permessage-deflate
    • 

  • 4147ce2 Merge commit '2ee00cb3'
    • 

  • 2ee00cb fix(websocket): add maxDecompressedMessageSize limit for permessage-deflate
    • 

  • 5890c7b fix(deduplicate): stream response chunks to waiting handlers
    • 

  • fbda3c1 Bumped v7.23.0 (#4884)
    • 

  • 07276c9 fix: remove unused kSocketPath symbol
    • 

  • Additional commits viewable in compare view
    • 







Updates vite from 5.4.21 to 6.4.2



Release notes

Sourced from vite's releases.




v6.4.2


Please refer to CHANGELOG.md for details.


v6.4.1


Please refer to CHANGELOG.md for details.


v6.4.0


Please refer to CHANGELOG.md for details.


v6.3.7


Please refer to CHANGELOG.md for details.


v6.3.6


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.2 (2026-04-06)



6.4.1 (2025-10-20)



6.4.0 (2025-10-15)


    

  • feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932
    • 



6.3.7 (2025-10-14)


    

  • fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940
    • 



6.3.6 (2025-09-08)



6.3.5 (2025-05-05)



6.3.4 (2025-04-30)


    

  • fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965
    • 

  • fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940
    • 

  • refactor: remove duplicate plugin context type (#19935) (d6d01c2), closes #19935
    • 



6.3.3 (2025-04-24)






... (truncated)





Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the npm_and_yarn group across 3 directories with 8 …
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          a0d237b
        
      

    

  

    

      
…updates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [file-type](https://github.com/sindresorhus/file-type) | `21.3.0` | `21.3.2` |
| [hono](https://github.com/honojs/hono) | `4.12.7` | `4.12.12` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.10` | `7.5.11` |
| [undici](https://github.com/nodejs/undici) | `7.21.0` | `7.24.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.2` |
| [music-metadata](https://github.com/Borewit/music-metadata) | `11.11.2` | `11.12.3` |

Bumps the npm_and_yarn group with 1 update in the /extensions/zalo directory: [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 1 update in the /ui directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `file-type` from 21.3.0 to 21.3.2
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v21.3.0...v21.3.2)

Updates `hono` from 4.12.7 to 4.12.12
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.7...v4.12.12)

Updates `tar` from 7.5.10 to 7.5.11
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.10...v7.5.11)

Updates `undici` from 7.21.0 to 7.24.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.21.0...v7.24.0)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `vite` from 5.4.21 to 6.4.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

Updates `music-metadata` from 11.11.2 to 11.12.3
- [Release notes](https://github.com/Borewit/music-metadata/releases)
- [Commits](Borewit/music-metadata@v11.11.2...v11.12.3)

Updates `esbuild` from 0.21.5 to 0.25.12
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.21.5...v0.25.12)

Updates `undici` from 7.21.0 to 7.24.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.21.0...v7.24.0)

Updates `vite` from 5.4.21 to 6.4.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

---
updated-dependencies:
- dependency-name: file-type
  dependency-version: 21.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.12
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.11
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.24.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: music-metadata
  dependency-version: 11.12.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.24.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Apr 10, 2026

    

  



  

  

    
  


  

      


  This was referenced Apr 10, 2026





  


  

      
   Closed

  






      







  


  

      
   Closed

  






  




    











  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews







    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    app: web-ui

  

    channel: matrix

  

    channel: zalo

  

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants