fix(deps): update patch updates

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@homebridge/ciao	1.3.10 → 1.3.12
@vitest/coverage-v8 (source)	4.1.10 → 4.1.11
@whiskeysockets/baileys	7.0.0-rc13 → 7.0.0-rc14
esbuild	0.28.1 → 0.28.2
hono (source)	4.13.0 → 4.13.7
hono-rate-limiter (source)	0.5.3 → 0.5.4
ignore	7.0.6 → 7.0.8
impit (source)	0.14.3 → 0.14.4
jose	6.2.4 → 6.2.12
mailparser	3.9.16 → 3.9.22
sharp (source, changelog)	0.35.3 → 0.35.4
typebox	1.3.7 → 1.3.27
undici (source)	8.10.0 → 8.10.2
vitest (source)	4.1.10 → 4.1.11
ws	8.21.1 → 8.21.3

---

Release Notes

homebridge/ciao (@​homebridge/ciao)

v1.3.12

Compare Source

Changes

• fix: send the missing-address bind warning to debug instead of the console (#​72)
• chore(deps): dependency updates

v1.3.11

Compare Source

Changes

• fix: stop advertising a service under another service's name
• fix: don't crash the process when a probe query can't be built
• fix: unref the txt debounce timer so it can't delay shutdown
• fix: split a known-answer list across packets instead of looping forever
• chore(lint): migrate to eslint 10 flat config
• chore(deps): dependency updates
• fix: send the probe and announce retry chatter to debug instead of the console (#​72)
• fix: let an empty DEBUG decline a prerelease build's automatic debug output (#​72)
• fix: read DEBUG before the debug package erases an empty one (#​72)
• fix: cancel queued advertisement after service destruction (#​73)

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.11

Compare Source

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in #​10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in #​10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in #​10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in #​10974 (fe5a1)

    View changes on GitHub

WhiskeySockets/Baileys (@​whiskeysockets/baileys)

v7.0.0-rc14

Compare Source

evanw/esbuild (esbuild)

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#​4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#​4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#​4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#​4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#​4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})
  }
  
  // Old output (with --minify-syntax --target=es6)
  function foo() {
    bar(void 0 || (x = {}));
  }
  
  // New output (with --minify-syntax --target=es6)
  function foo() {
    let x;
    bar(x || (x = {}));
  }

• Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

  The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

  Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

  This fix was submitted by @​ZuBB.

• Handle target collisions (#​4509)

  It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

• Force .mp3 files to use the audio/mpeg MIME type (#​4485)

  MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

• Add a new TypeScript syntax warning

  TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

  ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]
  
      example.ts:1:28:
        1 │ console.log(1 + 2 as number * 3)
          ╵                             ^
  
    This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
    precedence in this case. Surround the inner expression in parentheses to silence this warning:
  
      example.ts:1:12:
        1 │ console.log(1 + 2 as number * 3)
          │             ~~~~~~~~~~~~~~~
          ╵             (             )

  See microsoft/TypeScript#63527 for more information.

• Add support for formatting errors for Visual Studio (#​4460)

  Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

  With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

  $ esbuild example.ts --log-style=visualstudio
  /Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator
  

  This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

• Fix a bug with CSS gamut mapping (#​4488)

  Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

  This fix was submitted by @​chatman-media.

honojs/hono (hono)

v4.13.7

Compare Source

v4.13.6

Compare Source

v4.13.5

Compare Source

v4.13.4

Compare Source

v4.13.3

Compare Source

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #​5227
• fix(etag): copy pending stream bytes in #​5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #​5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #​5235
• docs(context): add custom headers append option example to Context JSDoc in #​5248
• fix(trie-router): match suffix wildcard routes in #​5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #​5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #​5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #​5247
• feat(pretty-json): support structured JSON content-types (+json) in #​5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

Compare Source

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #​5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in #​5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in #​5199
• fix(client): serialize multiple cookies correctly in #​5202
• fix(etag): stabilize digest across stream chunks in #​5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #​5209
• perf(cors): pre-join static array header options during initialization in #​5210
• fix(client): send falsy JSON bodies in #​5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in #​5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

Compare Source

rhinobase/hono-rate-limiter (hono-rate-limiter)

v0.5.4

Compare Source

Bug Fixes 🐛

• (websocket) Only skip counting on the real message outcome by @​MathurAditya724 in #​69
• Guard RedisStore.decrement against going below zero by @​MathurAditya724 in #​67
• Handle SCRIPT LOAD rejection in RedisStore constructor by @​jcross in #​65

Documentation 📚

• Warn that UnstorageStore is not concurrency-safe by @​MathurAditya724 in #​68
• Fix 'succesful' typo in JSDoc in #​63

Internal Changes 🔧

• Add craft release system by @​MathurAditya724 in #​66

kaelzhang/node-ignore (ignore)

v7.0.8

Compare Source

PATCH Brings pattern matching closer to git:

• PATCH A backslash now makes the next character a literal, exactly as git does: \* matches a literal * rather than acting as a wildcard, \? matches a literal ?, and \d, \b, \/ and the like are the plain characters instead of regular-expression escapes.
• PATCH Only a trailing run of spaces is stripped from a pattern — never tabs or other whitespace — and a line of only tabs is treated as a pattern rather than a blank line, matching git.

An upgrade is recommended for all dependents.

v7.0.7

Compare Source

panva/jose (jose)

v6.2.12

Compare Source

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Compare Source

v6.2.10

Compare Source

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Compare Source

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Compare Source

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #​879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

nodemailer/mailparser (mailparser)

v3.9.22

Compare Source

Bug Fixes

• declare the Node 20 floor this package already has (e9de771)

v3.9.21

Compare Source

Bug Fixes

• deps: move to nodemailer 10 (a83474e)

v3.9.20

Compare Source

Bug Fixes

• deps: update nodemailer to 9.1.1 (36233e6)

v3.9.19

Compare Source

Bug Fixes

• deps: update libmime and mailsplit for the CP932 extended areas (0bbe7a3)

v3.9.18

Compare Source

Bug Fixes

• deps: update nodemailer to 9.1.0 (b812c54)

v3.9.17

Compare Source

Bug Fixes

• deps: update nodemailer to 9.0.6 (26c7ccb)

lovell/sharp (sharp)

v0.35.4

Compare Source

:::note[Dependency versions]
https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3
:::

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit.
  #​4564
  @​metsw24-max

• Round palette bit depth up for png and gif colours.
  #​4569
  @​metsw24-max

• Ensure tiff.subifd input option is used.
  #​4572
  @​metsw24-max

• Ensure info.pages is correct when limiting input page range.
  #​4578
  @​metsw24-max

• Improve support for input Streams finishing before output is requested.
  #​4584
  @​Jaybhade

sinclairzx81/typebox (typebox)

v1.3.27

Compare Source

v1.3.26

Compare Source

v1.3.25

Compare Source

v1.3.24

Compare Source

v1.3.23

Compare Source

v1.3.22

Compare Source

v1.3.21

Compare Source

v1.3.20

Compare Source

v1.3.19

Compare Source

v1.3.18

Compare Source

v1.3.17

Compare Source

v1.3.16

Compare Source

v1.3.15

Compare Source

v1.3.14

Compare Source

v1.3.13

Compare Source

v1.3.12

Compare Source

v1.3.11

Compare Source

v1.3.10

Compare Source

v1.3.9

Compare Source

v1.3.8

Compare Source

nodejs/undici (undici)

v8.10.2

Compare Source

⚠️ Security fixes

High severity

• GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
• GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
• GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
• GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
• GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
• GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

• GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
• GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

• build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in #​5653
• build(deps-dev): bump jest from 30.4.2 to 30.5.0 by @​dependabot[bot] in #​5750
• build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 by @​dependabot[bot] in #​5752
• build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 by @​dependabot[bot] in #​5754
• test(h2): cover stream reset with NGHTTP2_INTERNAL_ERROR by @​zeexzeex in #​5725
• fix(retry): reject invalid resumed responses by @​mcollina in #​5724
• test: make stale-while-revalidate cache update test deterministic by @​mcollina in #​5722
• fix: avoid unbounded recursion in Set-Cookie attribute parser by @​mcollina in #​5757
• fix: honor SOCKS5 connection timeout by @​mcollina in #​5733
• fix(eventsource): validate Last-Event-ID on reconnect by @​mcollina in #​5746
• fix: avoid duplicate release attempts by @​mcollina in #​5745
• fix(cache): refetch when 304 adds vary fields by @​mcollina in #​5732
• types: expose PendingInterceptor and PendingInterceptorsFormatter on the MockAgent namespace by @​RaphaelFakhri in #​5721
• ci(codeql): align CodeQL action versions to v4.37.9 by @​mcollina in #​5759
• build(deps-dev): bump @​humanfs/node from 0.16.7 to 0.16.8 by @​dependabot[bot] in #​5760
• fix(proxy-agent): guard Proxy-Authorization in iterable header containers by @​mcollina in #​5758
• docs: name the parameters these two blocks describe by @​darkdi in #​5735
• fix(websocket): fail the connection on a non-200 h2 extended CONNECT response by @​kjsik11 in #​5751
• test(node-fetch): re-enable the set-cookie header combining test by @​pacocartones in #​5730
• fix(retry): forward rawHeaders writes through RetryController by @​official-burak in #​5727
• fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs by @​kjsik11 in #​5738

New Contributors

• @​darkdi made their first contribution in #​5735
• @​kjsik11 made their first contribution in #​5751
• @​official-burak made their first contribution in #​5727

Full Changelog: <nodejs/undici@v8.10.1...v8.

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	esbuild@​0.28.2
	hono-rate-limiter@​0.5.3 ⏵ 0.5.4	+1		+1	+6
	@​vitest/​coverage-v8@​4.1.10 ⏵ 4.1.11
	vitest@​4.1.10 ⏵ 4.1.11		+2	+1
	mailparser@​3.9.16 ⏵ 3.9.22				+1
	impit@​0.14.3 ⏵ 0.14.4				+4
	ignore@​7.0.6 ⏵ 7.0.8	+1		+1	+2
	ws@​8.21.1 ⏵ 8.21.3
	@​whiskeysockets/​baileys@​7.0.0-rc13 ⏵ 7.0.0-rc14			+1
	undici@​8.10.0 ⏵ 8.10.2			+1
	sharp@​0.35.3 ⏵ 0.35.4	+1	+16	+1
	jose@​6.2.4 ⏵ 6.2.12
	hono@​4.13.0 ⏵ 4.13.7	+1	+4	+1	+1
	typebox@​1.3.7 ⏵ 1.3.27			+1	+1
	@​homebridge/​ciao@​1.3.10 ⏵ 1.3.12	+1			+5

View full report