Skip to content

build(deps): bump the runtime-dependencies group across 1 directory with 6 updates - #14

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-dependencies-442b5172c1
Closed

build(deps): bump the runtime-dependencies group across 1 directory with 6 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-dependencies-442b5172c1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the runtime-dependencies group with 6 updates in the / directory:

Package From To
svelte 5.55.5 5.56.2
@anthropic-ai/sdk 0.91.1 0.101.0
hono 4.12.15 4.12.23
yaml 2.8.3 2.9.0
electron-updater 6.8.3 6.8.9
openapi-fetch 0.13.8 0.17.0

Updates svelte from 5.55.5 to 5.56.2

Release notes

Sourced from svelte's releases.

svelte@5.56.2

Patch Changes

  • fix: properly track effect end node for async sibling component (#18371)

  • fix: prevent false-positive reactivity loss warning (#18373)

  • chore: bump esrap dependency (#18372)

  • fix: ignore declaration tags for animation directive (#18366)

  • fix: reject pending async deriveds on discard (#18308)

svelte@5.56.1

Patch Changes

  • fix: error at compile time on duplicate snippet/declaration tag definitions (#18351)

  • fix: parse declaration tag contents more robustly (#18353)

  • fix: correctly transform references to earlier declarators in a declaration tag (e.g. {let a = $state(0), b = $derived(a * 2)}) (#18348)

  • fix: avoid spurious state_referenced_locally warnings for $derived declarations in declaration tags (#18348)

  • fix: tolerate whitespace before let/const in declaration tags (#18348)

  • fix: prevent infinite loop when a tag's expression ends with a trailing / at the end of the input (#18350)

  • fix: more robust parsing of declaration tags with regards to type (#18330)

  • fix: preserve newlines in spread input values when the type attribute is applied after value (#18345)

  • fix: update SvelteURLSearchParams when setting duplicate keys to the same joined value (#18336)

  • fix: check references for blockers on server, too (#18352)

svelte@5.56.0

Minor Changes

  • feat: allow declarations in the template (#18282)

Patch Changes

  • perf: use createElement instead of createElementNS for HTML elements (#18262)

  • perf: store current_sources as a Set for O(1) membership checks (#18278)

  • perf: deduplicate identical hoisted templates within a component (#18320)

  • perf: hoist rest_props exclude list as a module-scope Set (#18252)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.2

Patch Changes

  • fix: properly track effect end node for async sibling component (#18371)

  • fix: prevent false-positive reactivity loss warning (#18373)

  • chore: bump esrap dependency (#18372)

  • fix: ignore declaration tags for animation directive (#18366)

  • fix: reject pending async deriveds on discard (#18308)

5.56.1

Patch Changes

  • fix: error at compile time on duplicate snippet/declaration tag definitions (#18351)

  • fix: parse declaration tag contents more robustly (#18353)

  • fix: correctly transform references to earlier declarators in a declaration tag (e.g. {let a = $state(0), b = $derived(a * 2)}) (#18348)

  • fix: avoid spurious state_referenced_locally warnings for $derived declarations in declaration tags (#18348)

  • fix: tolerate whitespace before let/const in declaration tags (#18348)

  • fix: prevent infinite loop when a tag's expression ends with a trailing / at the end of the input (#18350)

  • fix: more robust parsing of declaration tags with regards to type (#18330)

  • fix: preserve newlines in spread input values when the type attribute is applied after value (#18345)

  • fix: update SvelteURLSearchParams when setting duplicate keys to the same joined value (#18336)

  • fix: check references for blockers on server, too (#18352)

5.56.0

Minor Changes

  • feat: allow declarations in the template (#18282)

Patch Changes

  • perf: use createElement instead of createElementNS for HTML elements (#18262)

  • perf: store current_sources as a Set for O(1) membership checks (#18278)

... (truncated)

Commits

Updates @anthropic-ai/sdk from 0.91.1 to 0.101.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.101.0

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

  • client: add support for middleware (9b01120)

Bug Fixes

  • apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
  • streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
  • streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

  • internal: fix artifact url (925ec27)
  • internal: fix branch names (fa3cf2c)
  • internal: update private repo name (a8ac213)

Documentation

  • point security reports to Anthropic's HackerOne program (#16) (5c7912c)

sdk: v0.100.1

0.100.1 (2026-05-29)

Full Changelog: sdk-v0.100.0...sdk-v0.100.1

Bug Fixes

  • streaming: carry encrypted_content on beta compaction blocks (#1025) (eccddf3)

Chores

  • client: update lockfiles to have proper dependencies on standardwebhooks (5e9b523)

sdk: v0.100.0

0.100.0 (2026-05-28)

Full Changelog: sdk-v0.99.0...sdk-v0.100.0

Features

  • api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (bb0bf27)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

  • client: add support for middleware (9b01120)

Bug Fixes

  • apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
  • streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
  • streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

  • internal: fix artifact url (925ec27)
  • internal: fix branch names (fa3cf2c)
  • internal: update private repo name (a8ac213)

Documentation

  • point security reports to Anthropic's HackerOne program (#16) (5c7912c)

0.100.1 (2026-05-29)

Full Changelog: sdk-v0.100.0...sdk-v0.100.1

Bug Fixes

  • streaming: carry encrypted_content on beta compaction blocks (#1025) (eccddf3)

Chores

  • client: update lockfiles to have proper dependencies on standardwebhooks (5e9b523)

0.100.0 (2026-05-28)

Full Changelog: sdk-v0.99.0...sdk-v0.100.0

Features

  • api: Add support for claude-opus-4-8, mid-conversation system blocks, and usage.output_tokens_details (bb0bf27)

Documentation

... (truncated)

Commits
  • 185ec06 chore: release main
  • fab8910 codegen metadata
  • 7ff4036 fix: apply request timeout to inner fetch only, not middleware chain (#40)
  • 257bc1f feat(client): add support for middleware
  • 5b3ace5 chore(internal): fix artifact url
  • 70966be fix(streaming): correctly parse json numbers with scientific notation (#9)
  • 7e22f20 docs: point security reports to Anthropic's HackerOne program (#16)
  • e569db5 chore(internal): fix branch names
  • 4725328 fix(streaming): carry stop_details through beta message_delta accumulation
  • f90eb81 chore(internal): update private repo name
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.


Updates hono from 4.12.15 to 4.12.23

Release notes

Sourced from hono's releases.

v4.12.23

What's Changed

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.21...v4.12.22

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

... (truncated)

Commits
  • 83bfb3b 4.12.23
  • bcd290a fix(utils/ipaddr): do not compress a single 0 group to :: (#4971)
  • c968177 feat(compress): add contentTypeFilter option and `COMPRESSIBLE_CONTENT_TYPE_R...
  • 0265a54 docs(contribution): add AI Usage Policy (#4970)
  • c84c5d2 feat(context): export the Context class publicly (#4543)
  • 82dad62 fix(serve-static): normalize all backslashes in file paths, not just the firs...
  • 2f01b77 4.12.22
  • 6bc0dff feat: add msgpack as a compressible content type (#4957)
  • 7e0555d fix(deno): echo negotiated WebSocket subprotocol in upgrade response (#4955)
  • f0ed246 fix(compress): respect Accept-Encoding when encoding option is set (#4951)
  • Additional commits viewable in compare view

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

  • fix: Avoid calling Array.prototype.push.apply() with large source array
  • fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

  • Disable alias resolution with maxAliasCount:0 (#677)
  • Handle invalid unicode escapes (e1a1a77)
  • Apply minFractionDigits only to decimal strings (#676)
Commits
  • ddb21b0 2.9.0
  • 167365b docs: Clarify that not all errors can be avoided
  • 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
  • 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
  • ccdf743 2.8.4
  • f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
  • e1a1a77 fix: Handle invalid unicode escapes
  • a163ea0 style: Satify Prettier
  • b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
  • 93c951b chore: Bump JSR version to v2.8.3 (#673)
  • Additional commits viewable in compare view

Updates electron-updater from 6.8.3 to 6.8.9

Release notes

Sourced from electron-updater's releases.

electron-updater@6.8.9

Patch Changes

198c10c 22a7532

  • builder-util-runtime@9.7.0

electron-updater@6.8.8

Patch Changes

59efef1

  • builder-util-runtime@9.6.3

electron-updater@6.8.7

Patch Changes

d6a5aee 4866737

  • builder-util-runtime@9.6.2

... (truncated)

Changelog

Sourced from electron-updater's changelog.

6.8.9

Patch Changes

198c10c 22a7532

  • builder-util-runtime@9.7.0

6.8.8

Patch Changes

59efef1

  • builder-util-runtime@9.6.3

6.8.7

Patch Changes

d6a5aee 4866737

... (truncated)

Commits
  • bed3a9c chore(deploy): Release v26.15.0 (electron-updater@6.8.9) (#9825)
  • 22a7532 fix: holistic field detection for \<text> (sha256 hash) redaction (#9834)
  • ffd11c7 chore(deploy): Release v26.13.0 (electron-updater@6.8.8) (#9793)
  • ac45083 fix(updater): ensure full changelog includes only release notes up to the lat...
  • d664ed0 chore: expand test coverage for updater and Windows build targets (#9794)
  • 2dc409f fix: harden the auto-update flow from relative paths and env var intercepts (...
  • 2c8c71a chore(deploy): Release v26.12.1 (electron-updater@6.8.7) (#9782)
  • 9120507 chore(deploy): Release v26.11.0 (electron-updater@6.8.6) (#9726)
  • d846315 chore(docs): docusaurus migration (#9744)
  • bea19a5 chore(deps): update dependency electron to v39 [security] (#9693)
  • Additional commits viewable in compare view

Updates openapi-fetch from 0.13.8 to 0.17.0

Release notes

Sourced from openapi-fetch's releases.

openapi-fetch@0.17.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

  • #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

  • Updated dependencies [a690e52]:

    • openapi-typescript-helpers@0.1.0

openapi-fetch@0.16.0

Minor Changes

  • #2362 9002418 Thanks @​luxass! - Added support for setting a custom path serializers either globally or per request. This allows you to customize how path parameters are serialized in the URL. E.g. you can use a custom serializer to prevent encoding of a path parameter, if you need to pass a value that should not be encoded.

openapi-fetch@0.15.2

Patch Changes

  • #2508 89843b0 Thanks @​srbarba! - Use text() when no content-length is provided to avoid errors parsing empty bodies (200 with no content)

openapi-fetch@0.15.0

Minor Changes

openapi-fetch@0.14.1

Patch Changes

openapi-fetch@0.14.0

Minor Changes

  • #2310 e66b5ce Thanks @​drwpow! - Build package with unbuild. Also remove the minified version (openapi-fetch is only useful in a TypeScript/bundler environment, so there’s no sense in loading it from a CDN clientside).
Changelog

Sourced from openapi-fetch's changelog.

0.17.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

  • #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

  • Updated dependencies [a690e52]:

    • openapi-typescript-helpers@0.1.0

0.16.0

Minor Changes

  • #2362 9002418 Thanks @​luxass! - Added support for setting a custom path serializers either globally or per request. This allows you to customize how path parameters are serialized in the URL. E.g. you can use a custom serializer to prevent encoding of a path parameter, if you need to pass a value that should not be encoded.

0.15.2

Patch Changes

  • #2508 89843b0 Thanks @​srbarba! - Use text() when no content-length is provided to avoid errors parsing empty bodies (200 with no content)

0.15.1

Patch Changes

0.15.0

Minor Changes

0.14.1

Patch Changes

0.14.0

Minor Changes

  • #2310 e66b5ce Thanks @​drwpow! - Build package with unbuild. Also remove the minified version (openapi-fetch is only useful in a TypeScript/bundler environment, so there’s no sense in loading it from a CDN clientside).
Commits
  • 5709d33 [ci] release (#2611)
  • 9350ddf Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked (#2572)
  • a690e52 feat(openapi-typescript): add readOnly/writeOnly support via markers (#2549)
  • a06e6c3 chore(deps): update dependency superagent to v10.3.0 (#2595)
  • 7318f82 [ci] release (#2604)
  • 33b83c4 chore(deps): update dependency express to v5.2.1 (#2591)
  • 66556d0 chore(deps): update dependency axios to v1.13.5 (#2590)
  • 9002418 feat(openapi-fetch): add support for pathSerializer option (#2362)
  • ed0c26c feat(openapi-fetch): enable middleware request param module augmentation (#2527)
  • 47ba213 ci: fix npm publish permissions (#2601)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openapi-fetch since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the runtime-dependencies group across 1 directory w…
f7ded65 
…ith 6 updates

Bumps the runtime-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.55.5` | `5.56.2` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.91.1` | `0.101.0` |
| [hono](https://github.com/honojs/hono) | `4.12.15` | `4.12.23` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.3` | `2.9.0` |
| [electron-updater](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater) | `6.8.3` | `6.8.9` |
| [openapi-fetch](https://github.com/openapi-ts/openapi-typescript/tree/HEAD/packages/openapi-fetch) | `0.13.8` | `0.17.0` |



Updates `svelte` from 5.55.5 to 5.56.2
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.2/packages/svelte)

Updates `@anthropic-ai/sdk` from 0.91.1 to 0.101.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.91.1...sdk-v0.101.0)

Updates `hono` from 4.12.15 to 4.12.23
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.23)

Updates `yaml` from 2.8.3 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.3...v2.9.0)

Updates `electron-updater` from 6.8.3 to 6.8.9
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/electron-updater/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-updater@6.8.9/packages/electron-updater)

Updates `openapi-fetch` from 0.13.8 to 0.17.0
- [Release notes](https://github.com/openapi-ts/openapi-typescript/releases)
- [Changelog](https://github.com/openapi-ts/openapi-typescript/blob/main/packages/openapi-fetch/CHANGELOG.md)
- [Commits](https://github.com/openapi-ts/openapi-typescript/commits/openapi-fetch@0.17.0/packages/openapi-fetch)

---
updated-dependencies:
- dependency-name: svelte
  dependency-version: 5.56.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.101.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: hono
  dependency-version: 4.12.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: electron-updater
  dependency-version: 6.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: openapi-fetch
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 6, 2026
@dependabot
dependabot Bot requested a review from jimdou as a code owner June 6, 2026 09:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 13, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/runtime-dependencies-442b5172c1 branch June 13, 2026 09:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jimdou jimdou Awaiting requested review from jimdou jimdou is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants