chore(deps): bump the npm-security group across 1 directory with 4 updates

[dependabot]

Bumps the npm-security group with 4 updates in the /docs directory: brace-expansion, devalue, hono and ip-address.

Updates brace-expansion from 2.1.4 to 2.1.7

Commits

• 714b622 2.1.7
• bdff773 Merge commit from fork
• 5a5c07b 2.1.6
• 6463f2f update lockfile
• 1ba3c71 Merge commit from fork
• aae3387 2.1.5
• 5171e68 Merge commit from fork
• See full diff in compare view

Updates devalue from 5.9.2 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Commits

• 434358a Version Packages (#202)
• 067b125 perf: annotate module-level Object.freeze calls as pure (#200)
• 53cd3db Version Packages (#201)
• 46dc877 Merge commit from fork
• 84f6f67 Merge commit from fork
• 6861dbb Merge commit from fork
• 8f8d78e Merge commit from fork
• dae8153 Merge commit from fork
• 9ec5130 Merge commit from fork
• 8ade61d chore: fix bench:compare script (#198)
• See full diff in compare view

Updates hono from 4.13.5 to 4.13.12

Release notes

Sourced from hono's releases.

v4.13.12

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
• test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
• fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
• chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in honojs/hono#5433
• chore(package.json): invoke package scripts through pnpm instead of bun in honojs/hono#5434
• chore: replace prettier with oxfmt in honojs/hono#5435
• chore(deps): upgrade vitest to 5.0.1 in honojs/hono#5437
• chore: let oxfmt sort imports instead of eslint in honojs/hono#5442
• chore: replace eslint with oxlint in honojs/hono#5443
• chore: introduce Vite+ in honojs/hono#5444
• fix(types): allow returning a Blob as a response body in honojs/hono#5446
• chore: convert build scripts into plugins in honojs/hono#5448
• chore: stop editorconfig-checker from checking Markdown indent size in honojs/hono#5455
• ci: remove empty step left in cr.yml by the pnpm migration in honojs/hono#5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in honojs/hono#5459
• feat(adapters): add @​hono/bun as a workspace package in honojs/hono#5447

... (truncated)

Commits

• 6abd35b 4.13.12
• 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
• afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
• e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
• c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
• c437d75 test(build): type-check the bundled declarations from a consumer project (#5486)
• be1f749 fix(build): keep internal types private in bundled d.ts and avoid a self-refe...
• 37ce069 4.13.11
• 1e1207c test(serve-static): fix the test (#5479)
• 8b05c77 Merge commit from fork
• Additional commits viewable in compare view

Updates ip-address from 10.7.0 to 10.7.3

Release notes

Sourced from ip-address's releases.

v10.7.3

What's Changed

• Reject an in-addr.arpa name longer than 32 characters before splitting it by @​beaugunderson in beaugunderson/ip-address#228

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

• Accept an arpa suffix in any case and without the root dot in fromArpa by @​beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

• Bump js-yaml and brace-expansion in the lockfile by @​beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

Commits

• c7f838e 10.7.3
• 09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
• 974b48d 10.7.2
• 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
• f0c25df 10.7.1
• 8b34a21 Merge commit from fork
• 13b6155 Merge commit from fork
• 469ead1 Reject an address longer than the family allows before parsing it
• 1343629 Report an address of the other family as not contained
• 4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
• See full diff in compare view