chore(deps): bump the npm-deps group across 1 directory with 4 updates

[dependabot]

Bumps the npm-deps group with 4 updates in the / directory: @hono/node-server, hono, eslint and prettier.

Updates @hono/node-server from 2.0.8 to 2.0.10

Release notes

Sourced from @​hono/node-server's releases.

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in honojs/node-server#371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in honojs/node-server#372
• fix: recover complete request bodies after client disconnect by @​usualoma in honojs/node-server#375

New Contributors

• @​otnc made their first contribution in honojs/node-server#371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

Commits

• 7c1457e 2.0.10
• 3a21938 Merge commit from fork
• 9842021 2.0.9
• 51f3bf5 fix: recover complete request bodies after client disconnect (#375)
• fdb87ba fix(serve-static): correct Range header parsing edge cases (#372)
• 912e3fd fix(websocket): polyfill missing ErrorEvent global (#371)
• See full diff in compare view

Updates hono from 4.12.28 to 4.12.30

Release notes

Sourced from hono's releases.

v4.12.30

What's Changed

• chore(benchmark/routers): bump deps in honojs/hono#5107
• chore(benchmark): remove not used benchmarks in honojs/hono#5108
• chore: update to ts6 in prep for ts7 in honojs/hono#5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025
• fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020
• fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096
• fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in honojs/hono#5092
• chore: fix no-op tsc in test script by @​yusukebe in honojs/hono#5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in honojs/hono#5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in honojs/hono#5081
• test(workerd): add compatibilityDate by @​yusukebe in honojs/hono#5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in honojs/hono#5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in honojs/hono#5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in honojs/hono#5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in honojs/hono#5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in honojs/hono#5084

New Contributors

• @​codebybilal18 made their first contribution in honojs/hono#5081
• @​Arman-Luthra made their first contribution in honojs/hono#5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

Commits

• b2ae3a2 4.12.30
• e0cdeb0 fix(method-override): set duplex when forwarding a stream body in query mode ...
• 653025e fix(client): replaceUrlParam should not match a param that prefixes another (...
• 67efb27 fix(compress): do not compress 206 Partial Content responses (#5020)
• a48c8bf fix(cache): deduplicate Cache-Control directives case-insensitively (#5025)
• 3bb9a0e chore: update to ts6 in prep for ts7 (#5104)
• d3f97ca chore(benchmark): remove not used benchmarks (#5108)
• 29a3f73 chore(benchmark/routers): bump deps (#5107)
• cda1af2 4.12.29
• 2126289 fix(etag): treat If-None-Match: * as a match (#5084)
• Additional commits viewable in compare view

Updates eslint from 10.6.0 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

Commits

• fabd99b 10.7.0
• 37c5e75 Build: changelog update for 10.7.0
• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076)
• 81a4774 chore: updates for v9.39.5 release
• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
• c30d808 docs: Update README
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
• Additional commits viewable in compare view

Updates prettier from 3.9.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view