chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /docs directory: sharp.
Bumps the npm_and_yarn group with 1 update in the /infra/emdash-bot directory: hono.

Updates sharp from 0.34.5 to 0.35.0

Release notes

Sourced from sharp's releases.

v0.35.0

• Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

• Breaking: Remove install script from package.json file. Compiling from source is now opt-in via the build script.

• Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

• Breaking: Add limitInputChannels with a default value of 5.

• Breaking: Remove deprecated failOnError constructor property.

• Breaking: Remove deprecated paletteBitDepth from metadata response.

• Breaking: Remove deprecated properties from sharpen operation.

• Breaking: Rename format.jp2k as format.jp2 for API consistency.

• Upgrade to libvips v8.18.3 for upstream bug fixes.

• Remove experimental status from WebAssembly binaries.

• Add prebuilt binaries for FreeBSD (WebAssembly).

• Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

• Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

• Add AVIF/HEIF tune option for control over quality metrics. #4227

• Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps. #4314

• Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer. #4355

• Require prebuilt binaries using static paths to aid code bundling. #4380

• TypeScript: Ensure FormatEnum keys match reality. #4475

• Add margin option to trim operation. #4480 @​eddienubes

• Ensure HEIF primary item is used as default page/frame. #4487

... (truncated)

Commits

• 2ed5af4 Release v0.35.0
• 4475cf1 Tests: update locator hash for sharp-libvips v1.3.0
• deb22dd Upgrade to sharp-libvips v1.3.0
• 07f1be9 Prerelease v0.35.0-rc.8
• df1109b Prerelease v0.35.0-rc.7
• aca49b3 Upgrade to libvips v8.18.3
• e9e86f5 Type-check density option before range validation (#4536)
• 2f0bcf0 Docs: update supported image formats
• 98e03b8 Revert "Guard heif bitdepth property for prebuilt binaries"
• e4ea2f3 CI: Ignore package minimum age in smoke tests
• Additional commits viewable in compare view

Updates hono from 4.12.27 to 4.12.34

Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in honojs/hono#5164
• chore: bump @hono/node-server in honojs/hono#5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in honojs/hono#5166
• chore: remove undici in favor of global fetch in honojs/hono#5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

• ci: enable reports for type & bundle size check in honojs/hono#5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
• fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
• fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
• fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130

... (truncated)

Commits

• 734755a 4.12.34
• 9839ff3 chore: update bun.lock (#5182)
• 0c45036 Merge commit from fork
• 720b566 Merge commit from fork
• f70e2c3 Merge commit from fork
• 93fc250 Merge commit from fork
• 51db313 4.12.33
• aed1463 chore: remove undici in favor of global fetch (#5168)
• 224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
• df653ce chore: bump @hono/node-server (#5167)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

This PR has been inactive for 14 days. It will be closed automatically in 7 days if there is no further activity.

If you're still working on this, please push an update or leave a comment.