chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #191 · supabase/server

dependabot · 2026-10-05T14:43:25Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
@nestjs/platform-fastify	`11.1.24`	`11.2.4`
hono	`4.13.5`	`4.13.7`
fast-uri	`3.1.2`	`3.1.8`
fastify	`5.8.5`	`5.11.3`
find-my-way	`9.6.0`	`9.7.0`

Updates @nestjs/platform-fastify from 11.1.24 to 11.2.4

Release notes

Sourced from @nestjs/platform-fastify's releases.

v11.2.4

What's changed

fix(microservices): handle unserializable patterns without crashing

fix(platform-fastify): absolute-form request target middleware bypass

v11.2.3

What's Changed

fix(core): circular durable providers issue by @kamilmysliwiec in nestjs/nest#17563

Full Changelog: nestjs/nest@v11.2.2...v11.2.3

v11.2.2

What's changed

fix(core): ObserveInstrument breaks app startup with @nestjs/core@11.2.x #17554 by @kamilmysliwiec

fix(core): Bootstrap crashes with nestjs-cls proxy providers (ProxyProviderNotResolvedException on CLS_REQ) #17553 by @kamilmysliwiec

v11.2.1

What's Changed

fix(core): early-return SSE abort issue by @kamilmysliwiec

Full Changelog: nestjs/nest@v11.2.0...v11.2.1

v11.2.0

What's Changed

fix(core): share existing singleton providers with lazily loaded modules by @shariyerShazan in nestjs/nest#17430

fix(common): match string file types containing regex metacharacters by @Jaybhade in nestjs/nest#17435

fix(core): convert adjacent wildcard segments in legacy route converter by @eeshsaxena in nestjs/nest#17416

fix(fastify): run middleware on routes excluded from global prefix by @Arun445 in nestjs/nest#17377

fix(fastify): avoid double prefixing inherited middleware by @GiHoon1123 in nestjs/nest#17350

fix(core): scan pre-registered dynamic imports of lazy modules by @johnnyhuirilef in nestjs/nest#17464

feat(core,common,platform-fastify): add query http method support by @gacardinal in nestjs/nest#17162

fix(common): exclude reverse-mapped keys from numeric enum validation in ParseEnumPipe by @LeSingh1 in nestjs/nest#17086

test(testing): Add e2e integration tests for HTTP QUERY method (RFC 10008) by @brayanjeshua in nestjs/nest#17310

feat(core): sse signal by @kamilmysliwiec in nestjs/nest#17469

chore(deps): update dependency fastify to v5.12.0 by @renovate[bot] in nestjs/nest#17473

New Contributors

@shariyerShazan made their first contribution in nestjs/nest#17430

@Jaybhade made their first contribution in nestjs/nest#17435

@eeshsaxena made their first contribution in nestjs/nest#17416

@Arun445 made their first contribution in nestjs/nest#17377

@GiHoon1123 made their first contribution in nestjs/nest#17350

@johnnyhuirilef made their first contribution in nestjs/nest#17464

@gacardinal made their first contribution in nestjs/nest#17162

@LeSingh1 made their first contribution in nestjs/nest#17086

@brayanjeshua made their first contribution in nestjs/nest#17310

... (truncated)

Commits

d504622 chore(release): publish v11.2.4 release
5226fe0 fix(platform-fastify): absolute-form request target middleware bypass
2b36ee5 chore(release): publish v11.2.3 release
7e65752 chore(release): publish v11.2.2 release
4535f43 chore(release): publish v11.2.1 release
f2a7e4b chore(release): publish v11.2.0 release
eac10cd Merge pull request #17162 from gacardinal/feat/query-http-method
674ac31 Merge pull request #17455 from nestjs/renovate/fastify-5.x
5303b81 Merge pull request #17350 from GiHoon1123/master
1def88d Merge pull request #17377 from Arun445/fix/fastify-middleware-global-prefix-e...
Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

eebdf7b 4.13.7
2b8ed40 Merge commit from fork
cac0c4d 4.13.6
dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
ec648d6 chore: bump editorconfig-checker (#5336)
e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
499c35e fix(client): normalize root WebSocket URLs (#5291)
50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
Additional commits viewable in compare view

Updates fastify from 5.8.5 to 5.11.3

Release notes

Sourced from fastify's releases.

v5.11.3

What's Changed

fix: clear trailer state when removing all trailers by @Ram-blip in fastify/fastify#6845

docs: document percent-decoded route params as untrusted input by @mcollina in fastify/fastify#6903

docs(errors): document what the default error handler sends by @basteez in fastify/fastify#6894

docs(readme): fix grammar and cjs capitalization by @minirang in fastify/fastify#6899

fix: pass null instead of undefined to requestCompleted on success by @lazerg in fastify/fastify#6837

docs(encapsulation): clarify nested plugin scopes by @jean-michelet in fastify/fastify#6893

chore: Bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in fastify/fastify#6916

chore: Bump fastify/workflows/.github/workflows/nested-quality.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in fastify/fastify#6917

fix: recognize constructor-assigned built-in properties as decorator … by @aquie00t in fastify/fastify#6892

fix: reset lastIndex before testing global/sticky content-type RegExp parsers by @zelinewang in fastify/fastify#6846

New Contributors

@minirang made their first contribution in fastify/fastify#6899

@lazerg made their first contribution in fastify/fastify#6837

@zelinewang made their first contribution in fastify/fastify#6846

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

fix fastify version in fastify.js

Full Changelog: fastify/fastify@v5.11.1...v5.11.2

v5.11.1

What's Changed

fix: add http method override warning by @jean-michelet in fastify/fastify#6879

fix(types): allow explicit http2: false in server options by @Tony133 in fastify/fastify#6888

docs: clarify what attachValidation exposes on request.validationError by @basteez in fastify/fastify#6891

fix: do not force close in-flight connections when forceCloseConnections is 'idle' by @aquie00t in fastify/fastify#6889

New Contributors

@basteez made their first contribution in fastify/fastify#6891

Full Changelog: fastify/fastify@v5.11.0...v5.11.1

v5.11.0

What's Changed

chore: Bump markdownlint-cli2 from 0.22.1 to 0.23.0 by @dependabot[bot] in fastify/fastify#6839

fix: normalize method in findRoute by @Ram-blip in fastify/fastify#6838

docs: fix incorrect description for validateInput in Request.md by @thePranav-kpk in fastify/fastify#6823

feat: rfc10008 http query method by @climba03003 in fastify/fastify#6832

perf: reuse cached content types for response serialization by @gurgunday in fastify/fastify#6854

chore(sponsor): add n-ix by @Eomm in fastify/fastify#6852

ci: pin actions to commit-hash by @Fdawgs in fastify/fastify#6853

ci(dependabot): temporarily ignore typescript updates by @Tony133 in fastify/fastify#6869

style(types): enforce max line length by @jean-michelet in fastify/fastify#6864

... (truncated)

Commits

a22cede Bumped v5.11.3
16a74e7 fix: reset lastIndex before testing global/sticky content-type RegExp parsers...
27938ac fix: recognize constructor-assigned built-in properties as decorator dependen...
a2f5905 chore: Bump fastify/workflows/.github/workflows/nested-quality.yml (#6917)
22c419a chore: Bump fastify/workflows/.github/workflows/lock-threads.yml (#6916)
f5b1400 docs(encapsulation): clarify nested plugin scopes (#6893)
9eaef51 fix: pass null instead of undefined to requestCompleted on success (#6837)
39e87e8 docs(readme): fix grammar and cjs capitalization (#6899)
3f6451c docs(errors): document what the default error handler sends (#6894)
f28528f docs: document percent-decoded route params as untrusted input (#6903)
Additional commits viewable in compare view

Updates find-my-way from 9.6.0 to 9.7.0

Release notes

Sourced from find-my-way's releases.

v9.7.0

What's Changed

fix: backtrack on regex param mismatch by @mcollina in delvedor/find-my-way#427

fix: apply root path fallback for optional params in off() by @aquie00t in delvedor/find-my-way#428

ci: add node v26 to test matrix by @aquie00t in delvedor/find-my-way#435

perf(host): cache regex lookup results in HostStorage by @aquie00t in delvedor/find-my-way#436

chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group by @dependabot[bot] in delvedor/find-my-way#437

chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 by @dependabot[bot] in delvedor/find-my-way#438

chore: bump @types/node from 25.9.4 to 26.1.0 in the dev-dependencies group by @dependabot[bot] in delvedor/find-my-way#440

fix: prevent done from being called multiple times on async constraint errors by @deepview-autofix in delvedor/find-my-way#425

fix: align isParamSafe state in findRoute with _on by @deepview-autofix in delvedor/find-my-way#424

chore: bump actions/checkout from 6 to 7 by @dependabot[bot] in delvedor/find-my-way#439

fix: avoid crash on undefined regex capture during route lookup by @bianyifan in delvedor/find-my-way#441

New Contributors

@aquie00t made their first contribution in delvedor/find-my-way#428

@deepview-autofix made their first contribution in delvedor/find-my-way#425

@bianyifan made their first contribution in delvedor/find-my-way#441

Full Changelog: delvedor/find-my-way@v9.6.0...v9.7.0

Commits

827248e Bumped v9.7.0
b9d7bf1 Merge branch 'main' of github.com:delvedor/find-my-way
b7b5657 fix: avoid crash on undefined regex capture during route lookup (#441)
4263d82 chore: bump actions/checkout from 6 to 7 (#439)
66d3015 fix: align isParamSafe state in findRoute with _on (#424)
75e4728 fix: prevent done from being called multiple times on async constraint errors...
902a02d chore: bump @types/node in the dev-dependencies group (#440)
b803e4e chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 (#438)
e63cb77 chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group (#437)
992c1df perf(host): cache regex lookup results in HostStorage (#436)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@nestjs/platform-fastify](https://github.com/nestjs/nest/tree/HEAD/packages/platform-fastify) | `11.1.24` | `11.2.4` | | [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.8` | | [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.11.3` | | [find-my-way](https://github.com/delvedor/find-my-way) | `9.6.0` | `9.7.0` | Updates `@nestjs/platform-fastify` from 11.1.24 to 11.2.4 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.2.4/packages/platform-fastify) Updates `hono` from 4.13.5 to 4.13.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.5...v4.13.7) Updates `fast-uri` from 3.1.2 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.8) Updates `fastify` from 5.8.5 to 5.11.3 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.8.5...v5.11.3) Updates `find-my-way` from 9.6.0 to 9.7.0 - [Release notes](https://github.com/delvedor/find-my-way/releases) - [Commits](delvedor/find-my-way@v9.6.0...v9.7.0) --- updated-dependencies: - dependency-name: "@nestjs/platform-fastify" dependency-version: 11.2.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.7 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fastify dependency-version: 5.11.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: find-my-way dependency-version: 9.7.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

pkg-pr-new · 2026-10-05T14:45:10Z

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@191

commit: fc8e4c1

dependabot Bot requested a review from a team as a code owner October 5, 2026 14:43

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

dependabot Bot requested review from a team as code owners October 5, 2026 14:43

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

mandarini approved these changes Oct 5, 2026

View reviewed changes

mandarini merged commit 24be9d2 into main Oct 5, 2026
16 checks passed

mandarini deleted the dependabot/npm_and_yarn/npm_and_yarn-361e7ce0e7 branch October 5, 2026 15:51

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates - #191

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates#191
mandarini merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-361e7ce0e7

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

pkg-pr-new Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026

v11.2.4

What's changed

v11.2.3

What's Changed

v11.2.2

What's changed

v11.2.1

What's Changed

v11.2.0

What's Changed

New Contributors

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v5.11.3

What's Changed

New Contributors

v5.11.2

What's Changed

v5.11.1

What's Changed

New Contributors

v5.11.0

What's Changed

v9.7.0

What's Changed

New Contributors

Uh oh!

pkg-pr-new Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

pkg-pr-new Bot commented Oct 5, 2026 •

edited

Loading