chore(deps): bump the production-dependencies group across 1 directory with 11 updates by dependabot[bot] · Pull Request #153 · Agentplat/agentplat

dependabot · 2026-09-01T21:24:40Z

Bumps the production-dependencies group with 11 updates in the / directory:

Package	From	To
eslint-scope	`5.1.1`	`9.1.2`
pg	`8.22.0`	`8.23.0`
@types/pg	`8.20.0`	`8.23.1`
@types/node	`20.19.43`	`26.4.0`
@modelcontextprotocol/sdk	`1.29.0`	`1.30.0`
zod	`4.4.3`	`4.5.4`
@openai/agents	`0.13.3`	`0.17.0`
hono	`4.12.34`	`4.13.5`
@temporalio/workflow	`1.22.0`	`1.23.0`
@temporalio/worker	`1.22.0`	`1.23.0`
source-map	`0.7.6`	`0.8.0`

Updates eslint-scope from 5.1.1 to 9.1.2

Release notes

Sourced from eslint-scope's releases.

eslint-scope: v9.1.2

9.1.2 (2026-03-04)

Dependencies

The following workspace dependencies were updated

devDependencies

espree bumped from ^11.1.1 to ^11.2.0

eslint-scope: v9.1.1

9.1.1 (2026-02-20)

Dependencies

The following workspace dependencies were updated

devDependencies

eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1

espree bumped from ^11.1.0 to ^11.1.1

eslint-scope: v9.1.0

9.1.0 (2026-01-18)

Features

add types to ESLint Scope (#709) (98caac0)

Dependencies

The following workspace dependencies were updated

devDependencies

espree bumped from ^11.0.0 to ^11.1.0

eslint-scope: v9.0.0

9.0.0 (2025-11-07)

⚠ BREAKING CHANGES

Resolve references to global var/function, add addGlobals() (#682)

Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#696)

Features

Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#696) (9c84ecb)

Resolve references to global var/function, add addGlobals() (#682) (f007b46)

... (truncated)

Changelog

Sourced from eslint-scope's changelog.

9.1.2 (2026-03-04)

Dependencies

The following workspace dependencies were updated

devDependencies

espree bumped from ^11.1.1 to ^11.2.0

9.1.1 (2026-02-20)

Dependencies

The following workspace dependencies were updated

devDependencies

eslint-visitor-keys bumped from ^5.0.0 to ^5.0.1

espree bumped from ^11.1.0 to ^11.1.1

9.1.0 (2026-01-18)

Features

add types to ESLint Scope (#709) (98caac0)

Dependencies

The following workspace dependencies were updated

devDependencies

espree bumped from ^11.0.0 to ^11.1.0

9.0.0 (2025-11-07)

⚠ BREAKING CHANGES

Resolve references to global var/function, add addGlobals() (#682)

Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#696)

Features

Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#696) (9c84ecb)

Resolve references to global var/function, add addGlobals() (#682) (f007b46)

Dependencies

The following workspace dependencies were updated

... (truncated)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-scope since your current version.

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

[email protected]

Add support for query pipelineing.

Commits

df274d1 Publish
eb19d0f Add opt-in query pipelining (#3652)
See full diff in compare view

Updates @types/pg from 8.20.0 to 8.23.1

Commits

See full diff in compare view

Updates @types/pg from 8.20.0 to 8.23.1

Commits

See full diff in compare view

Updates @types/node from 20.19.43 to 26.4.0

Commits

See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

fix(server): prioritize zod issues and format them by @mozmo15 in modelcontextprotocol/typescript-sdk#1503

chore(ci): switch publish to OIDC trusted publishing by @felixweinberger in modelcontextprotocol/typescript-sdk#1839

Add end-to-end test suite by @felixweinberger in modelcontextprotocol/typescript-sdk#2167

v1 stdio buffer limit by @KKonstantinov in modelcontextprotocol/typescript-sdk#2239

fix: support Zod 3.25 method literals by @mattzcarey in modelcontextprotocol/typescript-sdk#2368

Validate Content-Type by parsed media type instead of substring match (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2444

fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @mattzcarey in modelcontextprotocol/typescript-sdk#2538

fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 by @arimu1 in modelcontextprotocol/typescript-sdk#2549

Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2547

chore: bump version to 1.30.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

@mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503

@arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

2d889f2 chore: bump version to 1.30.0 (#2563)
e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
bb5a718 fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
369513d fix: support Zod 3.25 method literals (#2368)
e7ee57c v1 stdio buffer limit (#2239)
c36e1ef Add end-to-end test suite (#2167)
bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
9edbab7 fix(server): prioritize zod issues and format them (#1503)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @modelcontextprotocol/sdk since your current version.

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)

e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema

87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines

99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)

e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open

7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar

eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)

d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)

212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)

e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)

fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator

6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)

6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution

019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates

652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller

571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card

9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm

8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.
npm install zod@latest
At a glance:

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

... (truncated)

Commits

e8e206f 4.5.4
84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
1a16102 4.5.3
eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
e3a695b docs(v4): record the email regex and container output-shape findings under Open
99fce39 bench(v4): z.compile() against zod-compiler (#6499)
87d6464 fix(docs): drop the OG description when the title wraps past two lines
e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
9a193aa 4.5.2
Additional commits viewable in compare view

Updates @openai/agents from 0.13.3 to 0.17.0

Release notes

Sourced from @openai/agents's releases.

v0.17.0

Key Changes

Output-guardrail replay safety

Serialized output-bearing approval checkpoints now fail closed with UserError when the SDK cannot prove which response owns a pending terminal tool output. Continue with the live RunState when possible, or start a new run from safe input instead of replaying ambiguous serialized items. When an output guardrail rejects a completed function-tool result used as final output, the SDK replaces rejected content in SDK-owned replay surfaces with Output withheld by an output guardrail., sanitizes current guardrail metadata, and preserves earlier accepted history. This does not undo external tool side effects or erase application-owned copies.

Complete guardrail batch results

Guardrails started in the same batch now settle before the runner surfaces a tripwire or execution failure. Completed sibling results remain available in run state while further run processing is halted.

Explicit OpenAI client configuration

OpenAIProvider now rejects organization or project when openAIClient is also supplied because provider-level values cannot modify an already-created client. Configure these values when constructing the OpenAI client, then pass that client through openAIClient.

What's Changed

fix(core): redact blocked tool outputs and aliases from replay state by @seratch in openai/openai-agents-js#1712

fix(openai): reject ignored explicit-client options by @seratch in openai/openai-agents-js#1718

Documentation & Other Changes

docs: v01.6.1 release by @seratch in openai/openai-agents-js#1696

docs: fix access token typo in connectors example by @Chair403 in openai/openai-agents-js#1716

fix: keep Codex verification for development sandboxed by @seratch in openai/openai-agents-js#1707

chore: update versions by @github-actions[bot] in openai/openai-agents-js#1717

New Contributors

@Chair403 made their first contribution in openai/openai-agents-js#1716

Full Changelog: openai/openai-agents-js@v0.16.1...v0.17.0

v0.16.1

What's Changed

feat(core): add model call timeouts by @seratch in openai/openai-agents-js#1679

feat(sandbox): add run-scoped sandbox working directories by @seratch in openai/openai-agents-js#1683

feat(sandbox): allow Docker sandboxes to disable networking by @seratch in openai/openai-agents-js#1695

feat(extensions): add Modal sandbox resource options by @seratch in openai/openai-agents-js#1693

fix(core): honor exact call approval decisions by @seratch in openai/openai-agents-js#1694

fix(sandbox): validate view_image raster content by @seratch in openai/openai-agents-js#1704

fix(sandbox): validate dynamic compaction ratios by @sylvesterkaczmarek in openai/openai-agents-js#1691

fix(sandbox): trace effective run-scoped sandbox paths by @sylvesterkaczmarek in openai/openai-agents-js#1697

Documentation & Other Changes

docs: prepare v0.16.0 release documentation by @seratch in openai/openai-agents-js#1646

docs: document Agent.clone list property sharing by @thegoodengineer in openai/openai-agents-js#1705

chore: update versions by @github-actions[bot] in openai/openai-agents-js#1688

... (truncated)

Commits

0319b65 chore: update versions (#1717)
d80736a fix(openai): reject ignored explicit-client options (#1718)
b9ecb03 docs: fix access token typo in connectors example (#1716)
33fe55c fix(core): redact blocked tool outputs and aliases from replay state (#1712)
2d68a10 test: remove flaky example process-group test
dcbb1e7 chore: move example and integration runners out of skills
272cb52 fix: keep Codex verification sandboxed (#1707)
42489cd fix: make runtime probe approval explicit in skills
823c14a chore: harden agent workflow validation
516659a docs: update translated pages
Additional commits viewable in compare view

Updates hono from 4.12.34 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Updates @temporalio/workflow from 1.22.0 to 1.23.0

Release notes

Sourced from @temporalio/workflow's releases.

v1.23.0

Breaking Changes

Major upgrade of protobufjs to v8 and protobufjs-cli to v2.

Temporal's protobuf messages types generated by protobufjs are exposed as part of our public API surface (mostly through @temporalio/proto and Client's raw gRPC interfaces). This upgrade introduces some minor changes in the protobuf types that are generated for them. The large majority of applications either don't reference those types directly or do not use those types in way that would be affected by these changes.

You may however want to consider the following user-facing and potentially breaking changes:

Applications that use the Protobuf Payload Converters with their own .proto files will need to upgrade their own protobufjs dependency to v8. A root built with v7 still works for binary payloads, but JSON-encoded payloads will fail at runtime with TypeError: type must be a Type.

The constructor on generated message types is no longer publicly accessible, which means that new SomeMessage() no longer compiles. Use SomeMessage.create({ ... }) instead. Use of the constructor was never officially supported, and would have previously resulted in a runtime error.

The getTypeUrl method on generated message types is no longer declared.

A field holding its default value is no longer materialized as an own property on decoded messages. This applies both to JSON-encoded payloads, which are now spec-compliant and omit such fields rather than writing them out, and to binary ones, since protobufjs v8 no longer sets them when decoding. Reading the field still yields its default (msg.someEnum is still 0), but it no longer shows up in Object.keys, object spreads, or a deep equality comparison against a message built with create({ someEnum: 0 }). Unknown fields are still ignored when parsing JSON.

protobufjs renamed the generated "properties" interfaces from IFoo to Foo.$Properties, and added a companion Foo.$Shape that narrows oneof fields. We still expose IFoo as an alias of Foo.$Properties preserving backward compatibility with type definitions that rely on the legacy spelling. Note that we may choose to deprecate the legacy spelling at some point in the future to encourage adoption of protobufjs' roadmap.

Added

createPayloadValidationError in @temporalio/common creates a non-retryable ApplicationFailure with structured Payload validation details when provided. Passing null or undefined produces a failure without details.

Experimental: Nexus operation definitions can provide TypeInfo for Workflow callers and operation handlers. Workflow-backed asynchronous handlers must configure matching TypeInfo on the backing Workflow.

Experimental: Standalone Nexus Clients can use operation TypeInfo, including output conversion on detached operation handles.

Experimental: Workflow and standalone Activities can use TypeInfo to convert inputs and results, including Local Activities, retained and detached Client handles, and asynchronous completion.

Core logs written directly to the console can now use compact, pretty, or newline-delimited JSON output via telemetryOptions.logging.console.format.

... (truncated)

Changelog

Sourced from @temporalio/workflow's changelog.

Changelog

[Unreleased]

Breaking Changes

@temporalio/openai-agents now requires @openai/agents-core and @openai/agents-openai ~0.14.3. A project pinned to 0.13.x or earlier hits a peer dependency conflict until it upgrades.

Experimental: External storage StorageDriverSelector now receives a StorageDriverSelectContext instead of a StorageDriverStoreContext. Update the parameter type; the new type carries the same abortSignal and target fields.

Major upgrade of protobufjs to v8 and protobufjs-cli to v2.

Temporal's protobuf messages types generated by protobufjs are exposed as part of our public API surface (mostly through @temporalio/proto and Client's raw gRPC interfaces). This upgrade introduces some minor changes in the protobuf types that are generated for them. The large majority of applications either don't reference those types directly or do not use those types in way that would be affected by these changes.

You may however want to consider the following user-facing and potentially breaking changes:

Applications that use the Protobuf Payload Converters with their own .proto files will need to upgrade their own protobufjs dependency to v8. A root built with v7 still works for binary payloads, but JSON-encoded payloads will fail at runtime with TypeError: type must be a Type.

The constructor on generated message types is no longer publicly accessible, which means that new SomeMessage() no longer compiles. Use SomeMessage.create({ ... }) instead. Use of the constructor was never officially supported, and would have previously resulted in a runtime error.

The getTypeUrl method on generated message types is no longer declared.

A field holding its default value is no longer materialized as an own property on decoded messages. This applies both to JSON-encoded payloads, which are now spec-compliant and omit

... (truncated)

Commits

2453adf release v1.23.0 (#2358)
af227dd feat: Event Groups support (experimental) (#2209)
be77f14 feat(activity): add TypeInfo support for activities (#2343)
bf054fd feat(nexus): apply TypeInfo in Workflow callers and handlers (#2334)
8ae7569 chore(deps): update nexus-rpc to 0.0.3 (#2351)
da1c29a feat(workflow): add TypeInfo to Updates (#2333)
3fd5f8f feat(workflow): add TypeInfo to Queries (#2332)
6df7e47 feat(workflow): support TypeInfo for string Signals (#2323)
b18105c feat(workflow): support TypeInfo for workflow transitions (#2248)
194e08f feat(workflow): support TypeInfo on Signal definitions (#2318)
Additional commits viewable in compare view

Updates @temporalio/worker from 1.22.0 to 1.23.0

Release notes

Sourced from @temporalio/worker's releases.

v1.23.0

Breaking Changes

Major upgrade of protobufjs to v8 and protobufjs-cli to v2.

Temporal's protobuf messages types generated by protobufjs are exposed as part of our public API surface (mostly through @temporalio/proto and Client's raw gRPC interfaces). This upgrade introduces some minor changes in the protobuf types that are generated for them. The large majority of applications either don't reference those types directly or do not use those types in way that would be affected by these changes.

You may however want to consider the following user-facing and potentially breaking changes:

Applications that use the Protobuf Payload Converters with their own .proto files will need to upgrade their own protobufjs dependency to v8. A root built with v7 still works for binary payloads, but JSON-encoded payloads will fail at runtime with TypeError: type must be a Type.

The constructor on generated message types is no longer publicly accessible, which means that new SomeMessage() no longer compiles. Use SomeMessage.create({ ... }) instead. Use of the constructor was never officially supported, and would have previously resulted in a runtime error.

The getTypeUrl method on generated message types is no longer declared.

A field holding its default value is no longer materialized as an own property on decoded messages. This applies both to JSON-encoded payloads, which are now spec-compliant and omit such fields rather than writing them out, and to binary ones, since protobufjs v8 no longer sets them when decoding. Reading the field still yields its default (msg.someEnum is still 0), but it no longer shows up in Object.keys, object spreads, or a deep equality comparison against a message built with create({ someEnum: 0 }). Unknown fields are still ignored when parsing JSON.

protobufjs renamed the generated "properties" interfaces from IFoo to Foo.$Properties, and added a companion Foo.$Shape that narrows oneof fields. We still expose IFoo as an alias of Foo.$Properties preserving backward compatibility with type definitions that rely on the legacy spelling. Note that we may choose to deprecate the legacy spelling at some point in the future to encourage adoption of protobufjs' roadmap.

Added

createPayloadValidationError in @temporalio/common creates a non-retryable ApplicationFailure with structured Payload validation details when provided. Passing null or undefined produces a failure without details.

Experimental: Nexus operation definitions can provide TypeInfo for Workflow callers and operation handlers. Workflow-backed asynchronous handlers must configure matching TypeInfo on the backing Workflow.

Experimental: Standalone Nexus Clients can use operation TypeInfoDescription has been truncated

…y with 11 updates Bumps the production-dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [eslint-scope](https://github.com/eslint/js/tree/HEAD/packages/eslint-scope) | `5.1.1` | `9.1.2` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` | | [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.20.0` | `8.23.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.43` | `26.4.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | | [@openai/agents](https://github.com/openai/openai-agents-js) | `0.13.3` | `0.17.0` | | [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.5` | | [@temporalio/workflow](https://github.com/temporalio/sdk-typescript/tree/HEAD/packages/workflow) | `1.22.0` | `1.23.0` | | [@temporalio/worker](https://github.com/temporalio/sdk-typescript/tree/HEAD/packages/worker) | `1.22.0` | `1.23.0` | | [source-map](https://github.com/mozilla/source-map) | `0.7.6` | `0.8.0` | Updates `eslint-scope` from 5.1.1 to 9.1.2 - [Release notes](https://github.com/eslint/js/releases) - [Changelog](https://github.com/eslint/js/blob/main/packages/eslint-scope/CHANGELOG.md) - [Commits](https://github.com/eslint/js/commits/eslint-scope-v9.1.2/packages/eslint-scope) Updates `pg` from 8.22.0 to 8.23.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/[email protected]/packages/pg) Updates `@types/pg` from 8.20.0 to 8.23.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg) Updates `@types/pg` from 8.20.0 to 8.23.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg) Updates `@types/node` from 20.19.43 to 26.4.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0) Updates `zod` from 4.4.3 to 4.5.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.4) Updates `@openai/agents` from 0.13.3 to 0.17.0 - [Release notes](https://github.com/openai/openai-agents-js/releases) - [Commits](openai/openai-agents-js@v0.13.3...v0.17.0) Updates `hono` from 4.12.34 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.34...v4.13.5) Updates `@temporalio/workflow` from 1.22.0 to 1.23.0 - [Release notes](https://github.com/temporalio/sdk-typescript/releases) - [Changelog](https://github.com/temporalio/sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/temporalio/sdk-typescript/commits/v1.23.0/packages/workflow) Updates `@temporalio/worker` from 1.22.0 to 1.23.0 - [Release notes](https://github.com/temporalio/sdk-typescript/releases) - [Changelog](https://github.com/temporalio/sdk-typescript/blob/main/CHANGELOG.md) - [Commits](https://github.com/temporalio/sdk-typescript/commits/v1.23.0/packages/worker) Updates `source-map` from 0.7.6 to 0.8.0 - [Release notes](https://github.com/mozilla/source-map/releases) - [Changelog](https://github.com/mozilla/source-map/blob/master/CHANGELOG.md) - [Commits](mozilla/source-map@0.7.6...v0.8.0) --- updated-dependencies: - dependency-name: eslint-scope dependency-version: 9.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: pg dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@types/pg" dependency-version: 8.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@types/pg" dependency-version: 8.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: zod dependency-version: 4.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@openai/agents" dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@temporalio/workflow" dependency-version: 1.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@temporalio/worker" dependency-version: 1.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: source-map dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

Navigation Menu

Uh oh!

chore(deps): bump the production-dependencies group across 1 directory with 11 updates - #153

chore(deps): bump the production-dependencies group across 1 directory with 11 updates#153
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-f668376d35

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

eslint-scope: v9.1.2

9.1.2 (2026-03-04)

Dependencies

eslint-scope: v9.1.1

9.1.1 (2026-02-20)

Dependencies

eslint-scope: v9.1.0

9.1.0 (2026-01-18)

Features

Dependencies

eslint-scope: v9.0.0

9.0.0 (2025-11-07)

⚠ BREAKING CHANGES

Features

9.1.2 (2026-03-04)

Dependencies

9.1.1 (2026-02-20)

Dependencies

9.1.0 (2026-01-18)

Features

Dependencies

9.0.0 (2025-11-07)

⚠ BREAKING CHANGES

Features

Dependencies

[email protected]

1.30.0

What's Changed

New Contributors

v4.5.4

Commits:

v4.5.3

Commits:

v4.5.2

Commits:

v4.5.1

Commits:

v4.5.0

v0.17.0

Key Changes

Output-guardrail replay safety

Complete guardrail batch results

Explicit OpenAI client configuration

What's Changed

Documentation & Other Changes

New Contributors

v0.16.1

What's Changed

Documentation & Other Changes

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.13.3

What's Changed

v1.23.0

Breaking Changes

Added

Changelog

[Unreleased]

Breaking Changes

v1.23.0

Breaking Changes

Added

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion