Bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: hono and ws.

Updates hono from 4.12.19 to 4.12.31

Release notes

Sourced from hono's releases.

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130
• fix(utils/body): reuse cached formData in parseBody() by @​yusukebe in honojs/hono#5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @​yusukebe in honojs/hono#5133
• fix(sse): emit retry feild when retry is 0 by @​yusukebe in honojs/hono#5135
• test(validator): fix misspelled identifier in transform type test by @​yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

• chore(benchmark/routers): bump deps in honojs/hono#5107
• chore(benchmark): remove not used benchmarks in honojs/hono#5108
• chore: update to ts6 in prep for ts7 in honojs/hono#5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025
• fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020
• fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096
• fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in honojs/hono#5092
• chore: fix no-op tsc in test script by @​yusukebe in honojs/hono#5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in honojs/hono#5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in honojs/hono#5081
• test(workerd): add compatibilityDate by @​yusukebe in honojs/hono#5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in honojs/hono#5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in honojs/hono#5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in honojs/hono#5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in honojs/hono#5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in honojs/hono#5084

New Contributors

• @​codebybilal18 made their first contribution in honojs/hono#5081
• @​Arman-Luthra made their first contribution in honojs/hono#5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in honojs/hono#5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in honojs/hono#5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in honojs/hono#5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in honojs/hono#5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in honojs/hono#5071

... (truncated)

Commits

• cadff88 4.12.31
• 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
• aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
• d796450 fix(request): fix multipart boundary mismatch in cloneRawRequest (#5133)
• 80959d4 fix(utils/body): reuse cached formData in parseBody() (#5131)
• 21b44b6 refactor(aws-lambada): remove FIXME in @ts-expect-error (#5130)
• 5f73897 docs(combine): close quote in combine JSDoc example (#5126)
• c285f9a chore(benchmark): add app.fetch() overhead benchmark (#5117)
• fb9d7bf test(context): assert case-insensitive header names in response helpers (#5116)
• b2ae3a2 4.12.30
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates ws from 8.20.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[netlify]

❌ Deploy Preview for edcubetest failed.

Name	Link
🔨 Latest commit	00ebe67
🔍 Latest deploy log	https://app.netlify.com/projects/edcubetest/deploys/6a5edaebefa3630008ecc6b7

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	edcube	00ebe67	Jul 21 2026, 02:35 AM

[netlify]

❌ Deploy Preview for edcube failed.

Name	Link
🔨 Latest commit	00ebe67
🔍 Latest deploy log	https://app.netlify.com/projects/edcube/deploys/6a5edaebd004c50008b2f648