deps(deps): bump the production-minor-patch group across 1 directory with 23 updates by dependabot[bot] · Pull Request #31 · playforge-coding/spelling-creator

dependabot · 2026-08-07T19:19:19Z

Bumps the production-minor-patch group with 23 updates in the / directory:

Package	From	To
@cloudflare/puppeteer	`1.1.0`	`1.3.0`
@cloudflare/workers-oauth-provider	`0.8.1`	`0.10.1`
agents	`0.17.4`	`0.20.1`
hono	`4.12.25`	`4.13.0`
yjs	`13.6.31`	`13.6.32`
@rspress/core	`2.0.14`	`2.0.19`
@modelcontextprotocol/sdk	`1.29.0`	`1.30.0`
@fontsource/fraunces	`5.2.9`	`5.3.0`
@fontsource/public-sans	`5.2.7`	`5.3.0`
@isomorphic-git/lightning-fs	`4.6.2`	`4.7.0`
@tsparticles/engine	`4.3.0`	`4.3.2`
@tsparticles/plugin-emitters	`4.3.0`	`4.3.2`
@tsparticles/react	`4.3.0`	`4.3.2`
@tsparticles/shape-text	`4.3.0`	`4.3.2`
@tsparticles/slim	`4.3.0`	`4.3.2`
dompurify	`3.4.12`	`3.4.13`
isomorphic-git	`1.38.7`	`1.40.0`
lucide-react	`1.24.0`	`1.28.0`
radix-ui	`1.6.2`	`1.6.7`
react-i18next	`17.0.10`	`17.0.11`
react-router-dom	`7.16.0`	`7.18.2`
@supabase/supabase-js	`2.106.2`	`2.112.1`
fuse.js	`7.4.0`	`7.5.0`

Updates @cloudflare/puppeteer from 1.1.0 to 1.3.0

Release notes

Sourced from @cloudflare/puppeteer's releases.

v1.3.0

What's Changed

Enable trusted publishing of packages by @meddulla in cloudflare/puppeteer#231

feat(cloudflare): add browser launch option by @meddulla in cloudflare/puppeteer#232

Full Changelog: cloudflare/puppeteer@v1.2.0...v1.3.0

v1.2.0

What's Changed

Rename Browser Rendering to Browser Run in README and package.json by @jonnyparris in cloudflare/puppeteer#200

feat(cloudflare): typed Cloudflare.* CDP commands (handoff, session, live view) by @jonnyparris and @meddulla in cloudflare/puppeteer#223

Full Changelog: cloudflare/puppeteer@v1.1.0...v1.2.0

Commits

64b3255 Merge pull request #232 from cloudflare/scardita/add_browser_option
fdc19f0 feat(cloudflare): add browser launch option to select kitesurf
08707e0 Merge pull request #231 from cloudflare/scardita/enable-trusted-publishing
0bde29c Enable trusted publishing of packages
fb2979b Merge pull request #223 from cloudflare/ruskin/brapi-cdp-types
f0aee62 fix(types): make Cloudflare.* CDP commands type-check correctly
e4b373c chore(lint): fix pre-existing prettier violations blocking CI
27a7bb7 style: fix pre-existing prettier violation in PuppeteerWorkers.ts
f0918b8 fix(cloudflare): satisfy lint on Cloudflare.* CDP types
e26649b fix(cloudflare): drop unused ProtocolMapping import
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @cloudflare/puppeteer since your current version.

Updates @cloudflare/workers-oauth-provider from 0.8.1 to 0.10.1

Release notes

Sourced from @cloudflare/workers-oauth-provider's releases.

v0.10.1

Patch Changes

#287 30b1f4f Thanks @mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

#285 737dfa2 Thanks @mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

#288 7a6baf9 Thanks @mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

Deprecate resourceMatchOriginOnly without changing its behavior.

v0.10.0

Minor Changes

#283 b36f841 Thanks @mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

v0.9.1

Patch Changes

#280 43b9fa4 Thanks @mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

v0.9.0

Minor Changes

#253 f4e026c Thanks @mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

#248 194154e Thanks @ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable metadata_resolution_failed reason, and underlying diagnostic detail. The token endpoint still returns the same generic invalid_client / "Client not found" response, but reports the failure through the onError hook's internal field (category client-id-metadata-document) together with a new optional request field. Breaking for callers of OAuthHelpers.lookupClient (and methods built on it) that relied on null for CIMD fetch failures: catch CimdFetchError to restore the old behavior.

#259 71ec864 Thanks @mattzcarey! - Enable RFC 9207 authorization response issuer identification. Authorization server metadata advertises support, parsed requests carry the expected issuer for application-owned terminal error responses, and successful code and implicit redirects include iss.

#255 5cc336c Thanks @mattzcarey! - Validate protected resource metadata at construction time. Reject empty or invalid authorization server issuer lists, invalid resource and scope values, and bearer presentation methods the provider does not implement instead of publishing unusable or misleading RFC 9728 metadata.

#277 9e88aa4 Thanks @mattzcarey! - Require S256 PKCE by default. Authorization servers now advertise only S256 and reject PKCE challenges that use plain or omit code_challenge_method unless allowPlainPKCE: true is configured for legacy compatibility. Confidential clients may continue to omit PKCE entirely.

#260 248a9e7 Thanks @mattzcarey! - Separate authorization-server and protected-resource scope configuration. Explicit resourceMetadata.scopes_supported values become baseline Bearer challenge guidance, operation-specific requiredScopes takes precedence, and offline_access is omitted from provider-generated resource-facing scope lists. Deployments relying on the old scopesSupported fallback must configure protected-resource scopes explicitly.

#251 98d642f Thanks @mattzcarey! - Add an exported ExternalTokenError for intentional structured errors from resolveExternalToken. Existing callbacks keep their previous behavior: returning { props, audience? } authenticates, returning null returns a generic 401 invalid_token, and every other thrown value, including OAuthError, propagates as an unexpected failure. Standard bearer-token ExternalTokenError failures receive WWW-Authenticate challenges, requiredScopes supplies step-up guidance, callback headers are preserved, and browser clients can read WWW-Authenticate and Retry-After through CORS.

... (truncated)

Changelog

Sourced from @cloudflare/workers-oauth-provider's changelog.

0.10.1

Patch Changes

#287 30b1f4f Thanks @mattzcarey! - Preserve Basic and POST authentication interoperability for legacy and defaulted confidential clients while enforcing explicitly selected methods.

#285 737dfa2 Thanks @mattzcarey! - Negotiate Client ID Metadata Document grant and response types with the authorization server's supported capabilities instead of rejecting documents that advertise additional values.

#288 7a6baf9 Thanks @mattzcarey! - Restore v0.8.2-compatible resource handling for grants without a stored RFC 8707 resource. Configured canonical resources are defaulted and inherited, bound grants reject explicit mismatches, and an unconfigured legacy grant can issue an unbound token or use an explicit token-request resource without persisting a new grant binding.

Deprecate resourceMatchOriginOnly without changing its behavior.

0.10.0

Minor Changes

#283 b36f841 Thanks @mattzcarey! - Export AuthorizationError and throw it from parseAuthRequest() for expected authorization-request validation failures. Errors carry a validated redirect URI, original state, and issuer only after exact client redirect validation succeeds, allowing applications to distinguish safe OAuth error redirects from failures that must be rendered locally.

0.9.1

Patch Changes

#280 43b9fa4 Thanks @mattzcarey! - Stop returning registration_client_uri from dynamic client registration. The provider implements RFC 7591 registration but not the RFC 7592 client configuration endpoint previously advertised by this field.

0.9.0

Minor Changes

#253 f4e026c Thanks @mattzcarey! - Reject authorization-code requests from public clients that omit PKCE. OAuth 2.1 requires authorization servers to enforce code_challenge for clients that cannot authenticate at the token endpoint.

#248 194154e Thanks @ksinder! - Report CIMD metadata fetch failures instead of treating them as unknown clients. A failed Client ID Metadata Document fetch previously became a null client lookup, so a network problem (timeout, WAF block, upstream outage) was indistinguishable from an unregistered client — at the token endpoint, in the onError hook, and for OAuthHelpers callers. The fetch failure now throws a new exported CimdFetchError carrying the metadata URL, stable metadata_resolution_failed reason, and underlying diagnostic detail. The token endpoint still returns the same generic invalid_client / "Client not found" response, but reports the failure through the onError hook's internal field (category client-id-metadata-document) together with a new optional request field. Breaking for callers of OAuthHelpers.lookupClient (and methods built on it) that relied on null for CIMD fetch failures: catch CimdFetchError to restore the old behavior.

#259 71ec864 Thanks @mattzcarey! - Enable RFC 9207 authorization response issuer identification. Authorization server metadata advertises support, parsed requests carry the expected issuer for application-owned terminal error responses, and successful code and implicit redirects include iss.

#255 5cc336c Thanks @mattzcarey! - Validate protected resource metadata at construction time. Reject empty or invalid authorization server issuer lists, invalid resource and scope values, and bearer presentation methods the provider does not implement instead of publishing unusable or misleading RFC 9728 metadata.

#277 9e88aa4 Thanks @mattzcarey! - Require S256 PKCE by default. Authorization servers now advertise only S256 and reject PKCE challenges that use plain or omit code_challenge_method unless allowPlainPKCE: true is configured for legacy compatibility. Confidential clients may continue to omit PKCE entirely.

... (truncated)

Commits

a316ce8 Version Packages (#286)
9e3f44d chore: release resource compatibility as patch (#291)
a3e69f7 refactor(auth): simplify client auth storage (#290)
7a6baf9 fix(resource): preserve omission and legacy grants (#288)
30b1f4f fix(auth): preserve legacy client-secret transports (#287)
737dfa2 fix(cimd): negotiate optional client capabilities (#285)
72229c5 Version Packages (#284)
b36f841 feat: tag authorization request errors (#283)
a22d120 Version Packages (#281)
43b9fa4 fix: stop returning unsupported registration_client_uri (#280)
Additional commits viewable in compare view

Updates agents from 0.17.4 to 0.20.1

Release notes

Sourced from agents's releases.

agents@0.20.1

Patch Changes

#1987 ad015c2 Thanks @mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

#1982 e983026 Thanks @mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

agents@0.20.0

Minor Changes

#1557 447013d Thanks @mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

@cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

Deprecations in this release:

McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.

Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.

The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

#1981 6c01c8d Thanks @agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

agents@0.19.0

Minor Changes

#1922 cb4c1c7 Thanks @cjol! - Support both AI SDK v6 and v7.

The ai peer range is ai@^6 || ^7 (and @ai-sdk/react is @^3 || ^4) across agents, @cloudflare/ai-chat, @cloudflare/codemode, and @cloudflare/think. Consumers can adopt AI SDK v7 or stay on v6 — no forced AI SDK upgrade when

... (truncated)

Changelog

Sourced from agents's changelog.

0.20.1

Patch Changes

#1987 ad015c2 Thanks @mattzcarey! - Update the MCP dependencies to stable @modelcontextprotocol/client@2.0.0 and @modelcontextprotocol/server@2.0.0, and update the retained SDK v1 compatibility dependency to @modelcontextprotocol/sdk@1.30.0. Delegate SDK-backed SSE keepalives to the upstream transports so each stream has one timer, while preserving the Agents-owned keepalive on the legacy McpAgent WebSocket bridge.

#1982 e983026 Thanks @mattzcarey! - Fix AI SDK v7 telemetry, which produced spans with no token counts, no finish reason, no tool results and zero durations.

Spans that must not outlive their invocation now close at the end of it rather than at the first await. Closing at the handoff ended every WebSocket-turn span before its result existed, so every finish-time attribute was dropped. A span still open when its invocation ends is closed and marked cloudflare.agents.span.truncated instead of passing as complete, approval spans decided asynchronously included. A chat turn owns its own boundary rather than its caller's, so a turn that is not awaited — an ack-and-return submit, or an auto-continuation fired from a timer — is no longer cut short by the handler that started it. generateText is bounded on the same terms as streamText, and a turn that fails or is cancelled keeps the usage it already reported.

chat and execute_tool spans sit under their invoke_agent operation span on v7, where they were previously emitted as unrelated roots, and tool_approval segments sit under execute_tool.

v7 has no telemetry metadata bag, so identity and turn context arrive through runtimeContext and telemetry.includeRuntimeContext. Reserved keys project onto the attributes v6 already emits, so a query written against v6 traces still matches v7 ones; other included keys pass through as cloudflare.agents.runtime_context.{key}, and context the caller did not mark stays off the span.

0.20.0

Minor Changes

#1557 447013d Thanks @mattzcarey! - Add MCP SDK v2 client and server support. MCPClientConnection now uses the exact-pinned @modelcontextprotocol/client@2.0.0-beta.5. It probes for stateless MCP with server/discover, then falls back to the legacy initialize handshake on the same connection when needed. The SDK auto-fulfills stateless elicitation input_required results through the existing form and URL elicitation handlers while callTool, getPrompt, and readResource remain pending. OAuth reauthorization discards redirect-scoped discovery after token issuance and preserves discovery-triggered authentication, allowing a changed authorization server to be rediscovered and registered without reusing the prior issuer's credentials. Legacy pushed elicitation, Streamable HTTP, SSE, RPC, OAuth, and hibernation recovery remain supported. Codemode's MCP connector now uses an SDK-neutral structural boundary compatible with both MCP client generations.

Add MCP SDK v2 support to createMcpHandler. Pass a factory returning McpServer or Server from the exact-pinned @modelcontextprotocol/server@2.0.0-beta.5 peer dependency to serve stateless MCP with legacy compatibility by default. The new agents/mcp/server entry exports the stateless Agents handler without retaining McpAgent, WorkerTransport, MCP client transports, PartyServer, or SDK v1 modules. The returned handler remains callable for Worker dispatch and exposes the lower-level SDK fetch(request, options?) method plus typed notify methods; upstream close and event-bus internals are not part of the Agents surface. The retained v1 server APIs use the exact-pinned @modelcontextprotocol/sdk@1.29.0 peer dependency.

The legacy compatibility fallback now uses SDK v2's web-standard transport, including fail-fast handling for unsupported server-to-client requests, active-request teardown, and the same 25-second Cloudflare SSE keepalive previously supplied by WorkerTransport. It returns 405 for session-only GET and DELETE requests without constructing an application server. createLegacyMcpHandler remains an explicit public API for SDK v1 servers and complete WorkerTransport options.

The MCP client storage codec now preserves stateless discovery data with resumed HTTP sessions and preserves the binding name and props required to restore RPC servers. Stored HTTP session IDs from older Agents versions have no associated protocol version. The upgraded client discards those IDs and reconnects instead of sending an unsafe resumed request, so in-flight work tied to an old remote session does not resume.

The v2 callable handler maps verified provider-issued metadata from compatible @cloudflare/workers-oauth-provider releases to standard MCP AuthInfo while preserving getMcpAuthContext().props.

The Workers handler rejects malformed, opaque, and non-HTTP browser Origins. Its default allowlist includes localhost-class Origins, the endpoint's workers.dev hostname, and a concrete corsOptions.origin hostname. It applies matching Host checks to localhost and workers.dev endpoints. Custom-domain deployments with wildcard CORS can set allowedHostnames and allowedOriginHostnames explicitly, or set allowedOriginHostnames: "*" when trusted upstream middleware already enforces the required Origin policy. Requests without Origin remain valid for non-browser MCP clients. Default CORS preflights allow the stateless Mcp-Method and Mcp-Name request headers.

@cloudflare/codemode is now an optional peer. Applications that import agents/skills or agents/browser install Codemode explicitly; MCP-only applications no longer install it transitively.

Deprecations in this release:

McpAgent is deprecated and feature-frozen as a stateful SDK v1 path. New servers should use an SDK v2 factory with createMcpHandler from agents/mcp/server.

Passing an SDK v1 server to the overloaded createMcpHandler is deprecated for removal in the next major release. Move the server to an SDK v2 factory. Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1 behavior while migrating.

The explicit result-schema overloads MCPClientManager.callTool(params, resultSchema, options) and withX402Client(...).callTool(confirm, params, resultSchema, options) are deprecated. Use callTool(params, options) or callTool(confirm, params, options) instead.

experimental_createMcpHandler was already deprecated and remains scheduled for removal in the next major release. Its warning now directs users to an SDK v2 factory first and names createLegacyMcpHandler only as a temporary bridge for sessionful SDK v1 behavior.

Patch Changes

#1981 6c01c8d Thanks @agent-think! - Recycle reusable Browser Run sessions after the platform reports HTTP 410 for an expired session.

0.19.0

Minor Changes

#1922 cb4c1c7 Thanks @cjol! - Support both AI SDK v6 and v7.

... (truncated)

Commits

413011e Version Packages (#1988)
e983026 fix(observability): preserve AI span hierarchy across WebSocket turns (#1982)
ad015c2 chore(mcp): update stable SDK dependencies (#1987)
f089c5b Version Packages (#1985)
447013d feat(mcp): add SDK v2 client and stateless server support (#1557)
6c01c8d fix: recycle expired Browser Run sessions (#1980) (#1981)
4a3ee29 Version Packages (#1976)
cb4c1c7 feat: update AI SDK to v7 (#1922)
83e093b Version Packages (#1943)
33e59c4 fix(mcp): recover expired HTTP sessions (#1923)
Additional commits viewable in compare view

Updates hono from 4.12.25 to 4.13.0

Release notes

Sourced from hono's releases.

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup

ping — GET / 165.83 ns 163.99 ns 1.01x

query — GET /id/1?name=bun 674.40 ns 616.99 ns 1.09x

json — GET /user 528.99 ns 422.44 ns 1.25x

body — POST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

perf(context): iterate the header record with for..in honojs/hono#5118

perf(url): replace regex tests with indexOf honojs/hono#5121

perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122

perf(urls): refactor tryDecodeURIComponent honojs/hono#5158

perf(request): allocate #validatedData lazily honojs/hono#5175

perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():
const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})
Thanks @shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

... (truncated)

Commits

192768f 4.13.0
b0c2d90 Merge pull request #5154 from honojs/next
8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
3feb355 fix(jsx): allow a function component to return an array (#5179)
5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
30277ae feat(jwt,jwk): add a configurable WWW-Authenticate realm (#5141)
1f707c5 feat(middleware): add method-not-allowed middleware (#5132)
2df0b47 feat(jsx): add React-compatible overloads to useRef (#5063)
3bc96ba feat(cache): add first-class support for QUERY requests (#5119)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates yjs from 13.6.31 to 13.6.32

Release notes

Sourced from yjs's releases.

v13.6.32

fix #797 - undomanager clears destroy handler 95e890d9

yjs/yjs@v13.6.31...v13.6.32

Commits

1ce38f7 13.6.32
95e890d fix #797 - undomanager clears destroy handler
See full diff in compare view

Updates @rspress/core from 2.0.14 to 2.0.19

Release notes

Sourced from @rspress/core's releases.

v2.0.19

Highlights

🤖 Guide AI agents from generated Markdown

When SSG-MD is enabled, every generated Markdown page now starts with an agent-readable directive pointing to llms.txt, llms-full.txt, and the Markdown version of the current page:
> For AI agents: the complete documentation index is available at https://example.com/llms.txt, the full documentation bundle is available at https://example.com/llms-full.txt, and this page is available as Markdown at https://example.com/guide/index.md.
This extends the existing HTML hint to Markdown output. Its URLs automatically respect siteOrigin, base, locale, and version prefixes, helping agents discover the right machine-readable content from either format.

Documentation: SSG-MD · injectLlmsHint

Related PR: #3544

🎨 Add icons to generated sidebars and navigation

Use icon to display an image, inline SVG, emoji, external URL, or data URL before sidebar and navbar labels. Auto-generated sidebars support icons on groups, items, and section headers through _meta.json or page frontmatter, while navigation icons can be configured through _nav.json or themeConfig.nav.

For a local image, place it in public and reference it with an absolute path:
[
  {
    "type": "file",
    "name": "introduction",
    "label": "Introduction",
    "icon": "/icon.png",
    "tag": "new"
  }
]
Icons render before the label, while an existing tag remains on the right.

Documentation: Sidebar icons and tags · nav · sidebar

Related PR: #3554

⚡ Speed up lastUpdated on large sites

Rspress now resolves Git history for all documentation pages in one batched pass instead of spawning one git log process per page. Existing lastUpdated configuration remains unchanged:

... (truncated)

Commits

5efbc5d Release v2.0.19 (#3566)
58fede3 feat(auto-nav-sidebar): support icon field in sidebar and navbar (#3554)
47cfb12 perf(core): resolve lastUpdated with a single git process (#3545)
138fdb9 fix(theme/llmsUI): warn when copying Markdown in dev (#3563)
eee3d23 fix(ssg-md): preserve MDX exports (#3562)
8a8d01c fix(plugin-playground): scope Monaco preloads to playground pages (#3559)
bd730a1 refactor(core): remove redundant AST filtering (#3558)
c1003da chore(deps): update dependency memfs to ^4.64.0 (#3552)
4841ded chore(core): remove redundant dependencies (#3557)
7ed7163 fix(theme/outline): hide dividers without content (#3556)
Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

fix(server): prioritize zod issues and format them by @mozmo15 in modelcontextprotocol/typescript-sdk#1503

chore(ci): switch publish to OIDC trusted publishing by @felixweinberger in modelcontextprotocol/typescript-sdk#1839

Add end-to-end test suite by @felixweinberger in modelcontextprotocol/typescript-sdk#2167

v1 stdio buffer limit by @KKonstantinov in modelcontextprotocol/typescript-sdk#2239

fix: support Zod 3.25 method literals by @mattzcarey in modelcontextprotocol/typescript-sdk#2368

Validate Content-Type by parsed media type instead of substring match (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2444

fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @mattzcarey in modelcontextprotocol/typescript-sdk#2538

fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 by @arimu1 in modelcontextprotocol/typescript-sdk#2549

Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2547

chore: bump version to 1.30.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

@mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503

@arimu1 made their first contribution in

…with 23 updates Bumps the production-minor-patch group with 23 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@cloudflare/puppeteer](https://github.com/cloudflare/puppeteer) | `1.1.0` | `1.3.0` | | [@cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider) | `0.8.1` | `0.10.1` | | [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.17.4` | `0.20.1` | | [hono](https://github.com/honojs/hono) | `4.12.25` | `4.13.0` | | [yjs](https://github.com/yjs/yjs) | `13.6.31` | `13.6.32` | | [@rspress/core](https://github.com/web-infra-dev/rspress/tree/HEAD/packages/core) | `2.0.14` | `2.0.19` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` | | [@fontsource/fraunces](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/fraunces) | `5.2.9` | `5.3.0` | | [@fontsource/public-sans](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/public-sans) | `5.2.7` | `5.3.0` | | [@isomorphic-git/lightning-fs](https://github.com/isomorphic-git/lightning-fs) | `4.6.2` | `4.7.0` | | [@tsparticles/engine](https://github.com/tsparticles/tsparticles/tree/HEAD/engine) | `4.3.0` | `4.3.2` | | [@tsparticles/plugin-emitters](https://github.com/tsparticles/tsparticles/tree/HEAD/plugins/emitters) | `4.3.0` | `4.3.2` | | [@tsparticles/react](https://github.com/tsparticles/tsparticles/tree/HEAD/wrappers/react) | `4.3.0` | `4.3.2` | | [@tsparticles/shape-text](https://github.com/tsparticles/tsparticles/tree/HEAD/shapes/text) | `4.3.0` | `4.3.2` | | [@tsparticles/slim](https://github.com/tsparticles/tsparticles/tree/HEAD/bundles/slim) | `4.3.0` | `4.3.2` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.13` | | [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.38.7` | `1.40.0` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.24.0` | `1.28.0` | | [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) | `1.6.2` | `1.6.7` | | [react-i18next](https://github.com/i18next/react-i18next) | `17.0.10` | `17.0.11` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.16.0` | `7.18.2` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.106.2` | `2.112.1` | | [fuse.js](https://github.com/krisk/Fuse) | `7.4.0` | `7.5.0` | Updates `@cloudflare/puppeteer` from 1.1.0 to 1.3.0 - [Release notes](https://github.com/cloudflare/puppeteer/releases) - [Commits](cloudflare/puppeteer@v1.1.0...v1.3.0) Updates `@cloudflare/workers-oauth-provider` from 0.8.1 to 0.10.1 - [Release notes](https://github.com/cloudflare/workers-oauth-provider/releases) - [Changelog](https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md) - [Commits](cloudflare/workers-oauth-provider@v0.8.1...v0.10.1) Updates `agents` from 0.17.4 to 0.20.1 - [Release notes](https://github.com/cloudflare/agents/releases) - [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md) - [Commits](https://github.com/cloudflare/agents/commits/agents@0.20.1/packages/agents) Updates `hono` from 4.12.25 to 4.13.0 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.13.0) Updates `yjs` from 13.6.31 to 13.6.32 - [Release notes](https://github.com/yjs/yjs/releases) - [Commits](yjs/yjs@v13.6.31...v13.6.32) Updates `@rspress/core` from 2.0.14 to 2.0.19 - [Release notes](https://github.com/web-infra-dev/rspress/releases) - [Commits](https://github.com/web-infra-dev/rspress/commits/v2.0.19/packages/core) Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0) Updates `@fontsource/fraunces` from 5.2.9 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/fraunces) Updates `@fontsource/public-sans` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/public-sans) Updates `@isomorphic-git/lightning-fs` from 4.6.2 to 4.7.0 - [Release notes](https://github.com/isomorphic-git/lightning-fs/releases) - [Commits](isomorphic-git/lightning-fs@v4.6.2...v4.7.0) Updates `@tsparticles/engine` from 4.3.0 to 4.3.2 - [Release notes](https://github.com/tsparticles/tsparticles/releases) - [Changelog](https://github.com/tsparticles/tsparticles/blob/main/engine/CHANGELOG.md) - [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/engine) Updates `@tsparticles/plugin-emitters` from 4.3.0 to 4.3.2 - [Release notes](https://github.com/tsparticles/tsparticles/releases) - [Changelog](https://github.com/tsparticles/tsparticles/blob/main/plugins/emitters/CHANGELOG.md) - [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/plugins/emitters) Updates `@tsparticles/react` from 4.3.0 to 4.3.2 - [Release notes](https://github.com/tsparticles/tsparticles/releases) - [Changelog](https://github.com/tsparticles/tsparticles/blob/main/wrappers/react/CHANGELOG.md) - [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/wrappers/react) Updates `@tsparticles/shape-text` from 4.3.0 to 4.3.2 - [Release notes](https://github.com/tsparticles/tsparticles/releases) - [Changelog](https://github.com/tsparticles/tsparticles/blob/main/shapes/text/CHANGELOG.md) - [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/shapes/text) Updates `@tsparticles/slim` from 4.3.0 to 4.3.2 - [Release notes](https://github.com/tsparticles/tsparticles/releases) - [Changelog](https://github.com/tsparticles/tsparticles/blob/main/bundles/slim/CHANGELOG.md) - [Commits](https://github.com/tsparticles/tsparticles/commits/v4.3.2/bundles/slim) Updates `dompurify` from 3.4.12 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.12...3.4.13) Updates `isomorphic-git` from 1.38.7 to 1.40.0 - [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases) - [Commits](isomorphic-git/isomorphic-git@v1.38.7...v1.40.0) Updates `lucide-react` from 1.24.0 to 1.28.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.28.0/packages/lucide-react) Updates `radix-ui` from 1.6.2 to 1.6.7 - [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md) - [Commits](https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui) Updates `react-i18next` from 17.0.10 to 17.0.11 - [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md) - [Commits](i18next/react-i18next@v17.0.10...v17.0.11) Updates `react-router-dom` from 7.16.0 to 7.18.2 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom) Updates `@supabase/supabase-js` from 2.106.2 to 2.112.1 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.112.1/packages/core/supabase-js) Updates `fuse.js` from 7.4.0 to 7.5.0 - [Release notes](https://github.com/krisk/Fuse/releases) - [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md) - [Commits](krisk/Fuse@v7.4.0...v7.5.0) --- updated-dependencies: - dependency-name: "@cloudflare/puppeteer" dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@cloudflare/workers-oauth-provider" dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@fontsource/fraunces" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@fontsource/public-sans" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@isomorphic-git/lightning-fs" dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@rspress/core" dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@supabase/supabase-js" dependency-version: 2.112.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@tsparticles/engine" dependency-version: 4.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@tsparticles/plugin-emitters" dependency-version: 4.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@tsparticles/react" dependency-version: 4.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@tsparticles/shape-text" dependency-version: 4.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@tsparticles/slim" dependency-version: 4.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: agents dependency-version: 0.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: fuse.js dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: hono dependency-version: 4.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: isomorphic-git dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: lucide-react dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: radix-ui dependency-version: 1.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: react-i18next dependency-version: 17.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: react-router-dom dependency-version: 7.18.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: yjs dependency-version: 13.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 7, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-minor-patch-ef583be2d2 branch from 89dc9f6 to 29757fd Compare August 8, 2026 18:33

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-minor-patch-ef583be2d2 branch from 29757fd to faacb08 Compare August 8, 2026 22:31

Navigation Menu

deps(deps): bump the production-minor-patch group across 1 directory with 23 updates - #31

deps(deps): bump the production-minor-patch group across 1 directory with 23 updates#31
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-minor-patch-ef583be2d2

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Benchmark	v4.12	v4.13	Speedup
`ping` — `GET /`	165.83 ns	163.99 ns	1.01x
`query` — `GET /id/1?name=bun`	674.40 ns	616.99 ns	1.09x
`json` — `GET /user`	528.99 ns	422.44 ns	1.25x
`body` — `POST /json`	1.16 µs	1.00 µs	1.15x

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.3.0

What's Changed

v1.2.0

What's Changed

v0.10.1

Patch Changes

v0.10.0

Minor Changes

v0.9.1

Patch Changes

v0.9.0

Minor Changes

0.10.1

Patch Changes

0.10.0

Minor Changes

0.9.1

Patch Changes

0.9.0

Minor Changes

agents@0.20.1

Patch Changes

agents@0.20.0

Minor Changes

Patch Changes

agents@0.19.0

Minor Changes

0.20.1

Patch Changes

0.20.0

Minor Changes

Patch Changes

0.19.0

Minor Changes

v4.13.0

Performance improvements

First-class QUERY method support

QUERY support across built-in middleware

v13.6.32

v2.0.19

Highlights

🤖 Guide AI agents from generated Markdown

🎨 Add icons to generated sidebars and navigation

⚡ Speed up lastUpdated on large sites

1.30.0

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

⚡ Speed up `lastUpdated` on large sites