Skip to content

chore(deps): bump the npm_and_yarn group across 7 directories with 16 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-aff25a0837
Open

chore(deps): bump the npm_and_yarn group across 7 directories with 16 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-aff25a0837

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 9, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
@hono/node-server 1.19.14 2.1.0
@opentelemetry/propagator-jaeger 2.7.1 2.10.0
brace-expansion 2.1.0 2.1.4
fast-uri 3.1.2 3.1.5
hono 4.12.22 4.13.1
ip-address 10.2.0 10.4.0
react-router 7.15.1 7.18.2
shell-quote 1.8.3 1.10.0
tar 7.5.15 7.5.22

Bumps the npm_and_yarn group with 9 updates in the /agentic-flow directory:

Package From To
axios 1.13.5 1.18.0
postcss 8.5.6 8.5.26
@hono/node-server 1.19.9 2.1.0
body-parser 2.2.1 2.3.0
fast-uri 3.1.0 3.1.5
hono 4.11.9 4.13.1
ip-address 10.0.1 10.4.0
sharp 0.32.6 0.35.0
undici 7.21.0 7.29.0

Bumps the npm_and_yarn group with 5 updates in the /examples/research-swarm directory:

Package From To
axios 1.13.1 1.19.0
brace-expansion 2.0.2 2.1.4
fast-uri 3.1.0 3.1.5
protobufjs 6.11.4 7.6.5
undici 7.16.0 7.29.0

Bumps the npm_and_yarn group with 1 update in the /packages/agentdb-onnx directory: postcss.
Bumps the npm_and_yarn group with 2 updates in the /packages/agentic-jujutsu directory: js-yaml and brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /src/controller/test/e2e directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /tests/e2b-sandbox/swarm-coordination directory: brace-expansion.

Updates @hono/node-server from 1.19.14 to 2.1.0

Release notes

Sourced from @​hono/node-server's releases.

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

New Contributors

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates @opentelemetry/propagator-jaeger from 2.7.1 to 2.10.0

Release notes

Sourced from @​opentelemetry/propagator-jaeger's releases.

v2.10.0

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

v2.9.0

2.9.0

💥 Breaking Changes

  • docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

  • feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
    • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
  • feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
  • feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
    • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
    • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
    • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
  • feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

  • fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

  • perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
  • chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
  • perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

... (truncated)

Changelog

Sourced from @​opentelemetry/propagator-jaeger's changelog.

2.10.0

🚀 Features

  • feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
  • feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
  • feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
    • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

  • fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
  • fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

2.9.0

💥 Breaking Changes

  • docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
    • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

  • feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
    • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
  • feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
  • feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
    • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
    • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
    • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
  • feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

  • fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

  • perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
  • chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
  • perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

2.8.0

🚀 Features

... (truncated)

Commits
  • 76fa6b5 chore: prepare next release (#6942)
  • 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
  • be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
  • f6d8fbe chore(deps): lock file maintenance (#6559)
  • 9612732 chore: remove examples/dice from workspaces (#6937)
  • 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
  • a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
  • af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
  • b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
  • cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
  • Additional commits viewable in compare view

Updates brace-expansion from 2.1.0 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

Updates hono from 4.12.22 to 4.13.1

Release notes

Sourced from hono's releases.

v4.13.1

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
ping — GET / 165.83 ns 163.99 ns 1.01x
query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
json — GET /user 528.99 ns 422.44 ns 1.25x
body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
</tr></table>

... (truncated)

Commits
  • cf78528 4.13.1
  • f6aa913 fix(etag): skip unsafe methods or error responses on non-* case (#5196)
  • cd31bc1 fix(utils/stream): re-acquire writer lock when pipe() throws (#4988)
  • 569b419 fix(trie-router): count every slash a pattern consumes (#5189)
  • 192768f 4.13.0
  • b0c2d90 Merge pull request #5154 from honojs/next
  • 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
  • 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
  • 3feb355 fix(jsx): allow a function component to return an array (#5179)
  • 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates ip-address from 10.2.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • fbb8db2 10.4.0
  • 45a2b11 Validate the byte arrays Address6 is given (#217)
  • bac8810 Keep the package loadable on node 12, and enforce it (#216)
  • 9b3d848 Add a security policy and a README section on security posture
  • e84a7b3 Order the README API reference Address4, Address6, AddressError
  • 015160b Collapse each class in the README API reference
  • 34061a8 Pin checkout and setup-node to commits in the release job
  • c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
  • e0ef048 Replace CircleCI with GitHub Actions
  • 5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates react-router from 7.15.1 to 7.18.2

Release notes

Sourced from react-router's releases.

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

v7.16.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160

Changelog

Sourced from react-router's changelog.

v7.18.2

Patch Changes

  • Harden RSC CSRF codepaths. (#15353)

v7.18.1

Patch Changes

  • No changes

v7.18.0

Patch Changes

  • Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)
  • Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)
  • Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)
  • Precompute route branch matchers to avoid recompiling route path regexes during matching (#15186)
  • Use the constructed request URL host when validating action request origins. (#15185)
  • Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)
  • Validate protocols in RSC render redirects (#15177)
  • Consolidate url normalization logic and better handle mixed slashes (#15176)

v7.17.0

Minor Changes

  • Ship a subset of the official documentation inside the react-router package (#15121)
    • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
    • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Minor Changes

  • Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#15098)

Patch Changes

  • Disable manifest path when lazy route dicovery is disabled (#15068)

  • Fix browser URL creation to use the configured history window instead of the global window. (#15066)

    • Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.

  • Fix useNavigation() return type to preserve discriminated union across navigation states (#15095)

  • Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#15082)

Commits

Updates shell-quote from 1.8.3 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

Commits

  • [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
  • [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
  • [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
  • [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
  • [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
  • [readme] document parse's supported parameter-expansion subset e1c75cd
  • [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
  • [readme] fix stale example outputs 2de86f5
  • [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
  • [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
  • [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
  • [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
  • [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
  • [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
  • [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

  • [New] add types dca6e21
  • [Dev Deps] update eslint 9aa9e8f
  • [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
  • [actions] update workflows 75e8497
  • [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
  • [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
  • [actions] Windows + node 5/7: install deps with a modern node b4bafa2
  • [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
  • [Dev Deps] update auto-changelog, tape 7184b44
  • [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

  • [Fix] quote: validate object-token shapes 4378a6e
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
  • [Tests] increase coverage 9f3caa3
  • [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
  • [Dev Deps] update @ljharb/eslint-config 699c511
Commits
  • 64988d9 v1.10.0
  • 617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
  • 59bbf8b [types] fix an error TS v6 ignores but v7 fails on
  • 190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
  • a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
  • b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
  • 1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
  • 1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
  • e1c75cd [readme] document parse's supported parameter-expansion subset
  • c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
  • Additional commits viewable in compare view

Updates tar from 7.5.15 to 7.5.22

Commits

Updates axios from 1.13.5 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

  • Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

  • URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

  • Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

  • Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

  • Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, ...

    Description has been truncated

@dependabot
chore(deps): bump the npm_and_yarn group across 7 directories with 16…
8e9bf53 
… updates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `2.1.0` |
| [@opentelemetry/propagator-jaeger](https://github.com/open-telemetry/opentelemetry-js) | `2.7.1` | `2.10.0` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.1.0` | `2.1.4` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` |
| [hono](https://github.com/honojs/hono) | `4.12.22` | `4.13.1` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.4.0` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.15.1` | `7.18.2` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.22` |

Bumps the npm_and_yarn group with 9 updates in the /agentic-flow directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.13.5` | `1.18.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.26` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.9` | `2.1.0` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.1` | `2.3.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.5` |
| [hono](https://github.com/honojs/hono) | `4.11.9` | `4.13.1` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.0.1` | `10.4.0` |
| [sharp](https://github.com/lovell/sharp) | `0.32.6` | `0.35.0` |
| [undici](https://github.com/nodejs/undici) | `7.21.0` | `7.29.0` |

Bumps the npm_and_yarn group with 5 updates in the /examples/research-swarm directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.13.1` | `1.19.0` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.1.4` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.5` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `6.11.4` | `7.6.5` |
| [undici](https://github.com/nodejs/undici) | `7.16.0` | `7.29.0` |

Bumps the npm_and_yarn group with 1 update in the /packages/agentdb-onnx directory: [postcss](https://github.com/postcss/postcss).
Bumps the npm_and_yarn group with 2 updates in the /packages/agentic-jujutsu directory: [js-yaml](https://github.com/nodeca/js-yaml) and [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 1 update in the /src/controller/test/e2e directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 1 update in the /tests/e2b-sandbox/swarm-coordination directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `@hono/node-server` from 1.19.14 to 2.1.0
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v2.1.0)

Updates `@opentelemetry/propagator-jaeger` from 2.7.1 to 2.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.7.1...v2.10.0)

Updates `brace-expansion` from 2.1.0 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `fast-uri` from 3.1.2 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.5)

Updates `hono` from 4.12.22 to 4.13.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.22...v4.13.1)

Updates `ip-address` from 10.2.0 to 10.4.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0)

Updates `react-router` from 7.15.1 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router@7.18.2/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.18.2/packages/react-router)

Updates `shell-quote` from 1.8.3 to 1.10.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.10.0)

Updates `tar` from 7.5.15 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.15...v7.5.22)

Updates `axios` from 1.13.5 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.18.0)

Updates `postcss` from 8.5.6 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.26)

Updates `@hono/node-server` from 1.19.9 to 2.1.0
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.14...v2.1.0)

Updates `body-parser` from 2.2.1 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.1...v2.3.0)

Updates `fast-uri` from 3.1.0 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.5)

Updates `hono` from 4.11.9 to 4.13.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.22...v4.13.1)

Updates `ip-address` from 10.0.1 to 10.4.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0)

Updates `sharp` from 0.32.6 to 0.35.0
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.32.6...v0.35.0)

Updates `undici` from 7.21.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.21.0...v7.29.0)

Updates `axios` from 1.13.1 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.18.0)

Updates `body-parser` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.1...v2.3.0)

Updates `brace-expansion` from 2.0.2 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `fast-uri` from 3.1.0 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.5)

Updates `protobufjs` from 6.11.4 to 7.6.5
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.5/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@v6.11.4...protobufjs-v7.6.5)

Updates `sharp` from 0.32.6 to 0.34.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.32.6...v0.35.0)

Updates `undici` from 7.16.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.21.0...v7.29.0)

Updates `postcss` from 8.5.6 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.26)

Updates `js-yaml` from 4.1.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.1)

Updates `brace-expansion` from 2.0.2 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `brace-expansion` from 1.1.12 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `brace-expansion` from 1.1.12 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/propagator-jaeger"
  dependency-version: 2.10.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.13.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: react-router
  dependency-version: 7.18.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.13.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 7.6.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.34.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants