Skip to content

chore(deps): bump the npm-deps group with 6 updates - #95

Merged
mroderick merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-715e69a394
Oct 18, 2026
Merged

chore(deps): bump the npm-deps group with 6 updates#95
mroderick merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-715e69a394

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-deps group with 6 updates:

Package From To
@hono/node-server 2.1.3 2.1.4
hono 4.13.12 4.13.13
pino 10.3.1 10.4.0
@playwright/test 1.63.0 1.64.0
eslint 10.11.0 10.12.0
fallow 3.31.0 3.32.0

Updates @hono/node-server from 2.1.3 to 2.1.4

Release notes

Sourced from @​hono/node-server's releases.

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

Commits

Updates hono from 4.13.12 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

Commits
  • 08a023c 4.13.13
  • ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
  • f23b146 fix(jsx): allow JSXNode function component results (#5476)
  • 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
  • deff529 test(client): simulate network error for undefined route in parseResponse tes...
  • See full diff in compare view

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

... (truncated)

Commits
  • b29dbe9 Bumped v10.4.0
  • 6ba157b docs: fix the pino-pretty flush explanation after thread-stream#198 (#2524)
  • 6429c14 docs: Note that serializers run on child bindings at creation time (#2518)
  • 6c71bc9 Add bindings method to browser logger (#2504)
  • b557f72 ci: pin lock-threads to upstream v6.0.2 to fix token validation failure (#2525)
  • 1de1212 docs: document the APIs that are unavailable in the browser (#2521)
  • af2fe10 Delete .github/dependabot.yml (#2517)
  • 5aa6230 build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 (#2515)
  • 6f5af07 build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 (#2513)
  • 2ffe576 ci: check pull requests target main (#2500)
  • Additional commits viewable in compare view

Updates @playwright/test from 1.63.0 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
  • 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
  • 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
  • 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
  • dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
  • Additional commits viewable in compare view

Updates eslint from 10.11.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

  • 4618052 feat: handle astral letters in new-cap (#21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
  • 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
  • f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
  • b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
  • 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)
Commits
  • a438ec3 10.12.0
  • 32a73f1 Build: changelog update for 10.12.0
  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
  • 152067f chore: update ecosystem plugins (#21362)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
  • 67eb586 docs: Update README
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371)
  • Additional commits viewable in compare view

Updates fallow from 3.31.0 to 3.32.0

Release notes

Sourced from fallow's releases.

v3.32.0: grouped health trends, markdown from saved runs, dead-code accuracy fixes

Features

  • fallow dead-code --absent-component-props reports optional props that callers never pass. The rule reports an optional component prop that no known reachable caller passes. It is off by default. It supports React, Preact, Solid, Qwik, Vue, Svelte, Astro, Angular, Lit and Ember components. Each finding shows the declaration, the callers, the framework and whether a default exists. Fallow gives no finding when it cannot see every caller of the component. Static analysis does not prove that a prop is unreachable at runtime. Review defaults and API intent manually. The rule has no automatic fix.
  • fallow health --group-by selects groups and tracks a trend per group. --group <KEY> keeps only the matching groups. It accepts exact keys, globs and ! negations. Each group gets severity and hotspot counts. --save-snapshot on a grouped run stores the group data (snapshot schema v11). --trend or the new --trend-from <PATH> then adds a trend per group. Markdown and the GitHub job summary get a ## Health by <mode> table and one findings block per group. --top N now applies to each group. The MCP check_health tool accepts group and trend_from.
  • fallow report --from <file> --format markdown renders saved JSON output. A saved dead-code, dupes, health or bare combined run gives the same markdown as the live run with the same flags. You can analyze once and write both a job summary and a markdown report from one JSON file. The saved output of a combined run does not record --group-by, so its markdown is not grouped. A saved audit, security or fix run, and a combined run with type-aware evidence, exit 2 with a reason.
  • fallow dupes marks symlinked clone instances. A clone instance under a symlink now has is_symlink: true in JSON, symlink=true in compact output and a (symlink) marker in human output. To report only duplication between real files, set duplicates.ignoreSymlinks: true or pass --ignore-symlinks. --no-ignore-symlinks overrides the config value. The MCP tools, the Node API, the LSP and the VS Code setting fallow.duplication.ignoreSymlinks accept the same option. Thanks @​lzear for the report (#2961).
  • fallow agent install adds a native commit gate for Codex. The install writes a PreToolUse handler to .codex/hooks.json and the gate script to .codex/hooks/fallow-gate.sh. The handler runs the audit from the nearest install root, also from a subdirectory. The Claude Code handler now also finds the nearest install root. Run fallow agent install again to get the new handler. Codex runs a hook only after you trust it in /hooks. fallow agent status shows the gate as its own row, and fallow hooks status --format json adds a codex_gate entry. The AGENTS.md block is now routing guidance. fallow hooks install --target agent --agent codex --user now writes the user gate and no longer writes the project AGENTS.md block.
  • The new fallow-setup skill tells an agent how to add code-quality tools. The skill is for a JavaScript or TypeScript project. It tells the agent to detect the existing tools, run fallow recommend, install Fallow as a dev dependency and add a CI gate with a baseline. It gives each tool one job, and it removes a tool only after a parity check. fallow agent install writes it next to the fallow skill.
  • The gdp-proof-producer rule-pack kind restricts proof producers. The opt-in rule restricts @gdp-ts/core.defineProof calls to allowedFiles. proofKinds assigns literal proof labels to owner modules. The analysis follows static imports and unambiguous re-export chains.
  • Fallow has new built-in plugins.
    • release-it keeps each .release-it.* config form and reads the package.json key. It does not read the JSON5, YAML and TOML forms. It credits the plugins and extends packages.
    • eve makes agent modules entry points.
    • ag-ui credits the hooks of a class that extends AbstractAgent directly.
    • nestjs-trpc credits the methods that the module calls.
    • kibana reads kibana.jsonc plugin manifests and adds their entry points.
  • The health JSON names the sections that the run produced. The root array sections lists each section that the run computed. With --baseline, summary.baseline_staleness.remaining_findings gives the number of functions above a threshold that the baseline does not accept.
  • The CLI, MCP and the LSP report the same finding_id for a security finding. The VS Code "Copy Fallow finding id" quick fix now works on a security candidate (#3035).
  • Fallow can suggest its Claude Code plugin. Inside a Claude Code session, Fallow writes one hint line to stderr for human output. Fallow writes the hint only without --quiet, outside CI, and when no Fallow plugin or skill is installed. The hint has no effect until the official marketplace lists the Fallow plugin. Set FALLOW_CLAUDE_CODE_HINT=off or FALLOW_SUGGESTIONS=off to suppress it.

Changed

  • Tooling dependencies need evidence of use. Three kinds of devDependency no longer count as used by name alone:

    • A command-line tool from the tooling catalogue.
    • A tooling package of an active plugin.
    • A @types/X package.

    A tool counts as used when a script, a CI workflow or a git hook runs it. It also counts when its config file or its package.json key exists, or when a plugin credits it. Fallow now reads git hooks in .husky/, lefthook, simple-git-hooks and lint-staged configs. A @types/X package counts as used when the project declares or imports X, or names X in tsconfig types. A short list of global type packages, such as @types/node, always counts. --trace-dependency names each credit. Production dependencies still count as used by name.

  • Root dependencies follow the nearest manifest. Each import now counts for the nearest manifest that installs the package. Fallow reports a root declaration as unused when each import uses a workspace declaration. The finding has a declared_and_imported_in field that names those workspaces. Such an entry gets one finding, not a second test-only or type-only finding.

  • export default Name links to the local binding Name. Fallow now reports unused members of a class that a file exports this way. With ignoreExportsUsedInFile, such a default export is used when the file uses Name.

  • fallow health --group-by counts a clone in each group that holds an instance. The group duplicated_lines values now sum to the project value. Group scores can drop once after the upgrade.

  • CODEOWNERS matching follows GitHub. A pattern without a trailing / owns the directory contents. * does not match /, apps/ matches an apps directory at any depth, and /* owns only the files at the root. Owner groups can change.

  • Gate rows show a count. The health-findings and error-severity-findings entries in gate_outcomes now have observed and threshold_label. The PR decision and the PR comment show the count, for example 6 at or above error.

  • fallow hooks install --target agent selects Codex from a .codex/ directory, not from AGENTS.md alone.

Bug fixes

Dependencies

  • Fallow no longer reports an optional peer of a used dependency as unused. Fallow also no longer reports a devDependency that the same manifest lists as a peer. An optional peer that the project does not list no longer credits its own peers.
  • A peer-only entry no longer hides the ancestor workspace that installs a package. A workspace file can use a package that an ancestor manifest declares. This does not apply to production code in a publishable workspace. An ancestor declaration counts as used when a nested workspace uses it.
  • A postcss.config.* file credits the PostCSS plugins that it names, also without a declared postcss package.
  • A script binary credits every package that can provide it, for example run-p for npm-run-all2.
  • Fallow credits a runtime loader that a tool config needs, such as ts-node for a TypeScript Jest config. The Mocha plugin reads .mocharc files and the mocha key.
  • A tool config file in a workspace package credits the root devDependency of that tool.
  • require.resolve and import.meta.resolve with any subpath credit the package. require.resolve('pkg') reports an unlisted package. Thanks @​DrJKL for the report (#3213).
  • import {} from 'pkg', a module augmentation declare module 'pkg', and a node_modules/.bin/<name> path in source credit the package.
  • Fallow credits Expo config plugins in the app config, Oxlint jsPlugins inside overrides, and packages in Starlight customCss.
  • React Router apps without entry.server no longer report isbot as unused.
  • An esbuild call in a test file no longer removes the credit that a dependent workspace gets for the packages of a private sibling. Fallow removes that credit only when a build file or a package script sets every package external.

... (truncated)

Commits
  • aaaec79 chore: release v3.32.0
  • f79576a fix(release): pin cargo-zigbuild 0.23.4 for the aarch64-musl build (#3272)
  • 47f17f3 chore: release v3.32.0
  • 3380750 chore(deps-dev): bump oxlint in /apps/review-electron (#3256)
  • 791aa13 chore(deps): bump rmcp from 3.4.1 to 3.5.0 (#3269)
  • d07accc chore(deps-dev): bump vitest from 5.0.1 to 5.0.2 in /viz-frontend (#3257)
  • 6ea600d chore(deps): bump github/codeql-action/upload-sarif (#3266)
  • d7f0d25 chore(deps-dev): bump @​types/d3-zoom in /viz-frontend (#3254)
  • 7c0ed57 chore(deps-dev): bump vitest in /apps/review-electron (#3259)
  • b0de2d9 chore(deps-dev): bump oxfmt in /apps/review-electron (#3265)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-deps group with 6 updates
b98dcca 
Bumps the npm-deps group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.3` | `2.1.4` |
| [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.13` |
| [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.0` |
| [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.12.0` |
| [fallow](https://github.com/fallow-rs/fallow) | `3.31.0` | `3.32.0` |


Updates `@hono/node-server` from 2.1.3 to 2.1.4
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.3...v2.1.4)

Updates `hono` from 4.13.12 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.12...v4.13.13)

Updates `pino` from 10.3.1 to 10.4.0
- [Release notes](https://github.com/pinojs/pino/releases)
- [Commits](pinojs/pino@v10.3.1...v10.4.0)

Updates `@playwright/test` from 1.63.0 to 1.64.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.0)

Updates `eslint` from 10.11.0 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.11.0...v10.12.0)

Updates `fallow` from 3.31.0 to 3.32.0
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@v3.31.0...v3.32.0)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: pino
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@playwright/test"
  dependency-version: 1.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: fallow
  dependency-version: 3.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 15, 2026
@mroderick

mroderick commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Dependency Upgrade Review

Verdict: Compatible (head b98dccae8b28c04101e35773d79baabdac8cf07b) · Confidence: High

Bumps six npm dependencies (hono, @hono/node-server, pino at runtime; @playwright/test, eslint, fallow in dev) with only lockfile/manifest changes. Safe: the diffs touch no APIs this repo uses, the planner-facing OAuth contracts are emitted by unchanged better-auth 1.7.7 and covered by repo tests plus a passing round-trip probe, and pino's one behavior-relevant change cannot fire here (no transports) — verified by runtime check.

Checks

Check Result
planner suite pass
auth suite pass
round-trip probe pass

Contracts

Contract Status Basis
OAuth authorize: 302 redirect to planner callback with code + state Verified Repo tests (test/integration/oauth-flow.test.js, e2e/oauth-flow.spec.js) exercise it on the upgraded stack; probe passed; hono and node-server diffs read directly.
Token response emits { access_token, id_token, expires_in } consumed by planner Verified better-auth 1.7.7 unchanged; integration test asserts id_token; probe passed; consumer reads verified in planner's lib/omniauth/strategies/codebar.rb.
Sparse id_token claims: sub, github_id for GitHub-linked users only, aud=planner Verified test/integration/jwt-payload.test.js asserts both session classes; better-auth unchanged; probe passed; planner JWT verification read in local checkout.
UserInfo response carries sub, email, email_verified, name — planner's identity source Verified test/integration/oauth-flow.test.js asserts the exact claims; consumer email/name reads in planner's codebar.rb; better-auth unchanged; probe passed.
JWKS endpoint serves { keys: [JWK] } for planner id_token verification Verified test/integration/oauth-flow.test.js fetches JWKS and verifies the id_token signature end-to-end; better-auth unchanged.
better-auth session cookie set and consumed through hono middleware on all routes Verified Integration and e2e tests drive cookie-based sessions through authorize; better-auth unchanged; hono diff touches no cookie paths.
Pino JSON logs on stdout with cookie/authorization/user-agent redacted Verified pino 10.4.0 diff read: redaction/serializer hardening only; warning needs transports hono-pino never sets; runtime check with app config confirmed output.
CI smoke gate: npm run lint and npm run fallow must pass on every PR Verified Ran eslint 10.12.0 (exit 0) and fallow 3.32.0 (exit 0, 0 findings above threshold) in the PR worktree.
Compatibility analysis — 7 packages
  • hono 4.13.12 → 4.13.13: 5 commits, 9 files: src/jsx/base.ts fix (repo uses hono/html, not hono/jsx), new src/middleware/mount (no .mount usage), jsdoc-only edits to src/request.ts and src/hono-base.ts (app.mount deprecated, not removed). No used API affected.
  • @hono/node-server 2.1.3 → 2.1.4: 2 commits, package.json only — hono v5 allowed as peer. Metadata-only; no serving-code change.
  • pino 10.3.1 → 10.4.0: 51 commits. New warning fires only when formatters.level is set with multi-target transports (transportUsesMultistreamSym); hono-pino 0.10.3 calls pino(opt) with no transports, so it cannot fire. Redaction/serializer map hardening and multistream fixes leave the repo's config (level, string formatters.level, three redact paths) producing identical output — runtime-checked on 10.4.0. Brings real-require 0.2.0 → 1.0.0.
  • @playwright/test 1.63.0 → 1.64.0: Additive release (WebMCP, video fps/style, locator.within, --shuffle, testProject.default). Config and spec use unchanged APIs. Bumps playwright and playwright-core transitively.
  • eslint 10.11.0 → 10.12.0: Autofix/rule fixes (curly, prefer-exponentiation-operator, TSFunctionType location) not surfaced by the repo's js/recommended config; npx eslint . exits 0.
  • fallow 3.31.0 → 3.32.0: Changed dependency-usage and CODEOWNERS semantics; ran fallow 3.32.0 locally: exit 0, 0 findings above threshold (maintainability 94.4). CI smoke gate unaffected. Bumps fallow-type-aware and platform binaries.
  • better-auth / @better-auth/oauth-provider unchanged: Emits every planner-facing OAuth contract; left unchanged at 1.7.7, so contract-emitting code paths are identical to the pre-upgrade baseline.
Usage of 6 dependencies
  • hono: Hono class + routing in all 8 route modules and src/app/app.js (14 import sites across src/); hono/html tagged templates in 11 files; no hono/jsx; no app.mount
  • @hono/node-server: serve (src/index.js: fetch/port + server.close graceful shutdown), serveStatic (src/app/app.js), getConnInfo (src/app/routes/test-magic-links.js local-connection guard)
  • pino: Indirect via hono-pino pinoLogger in src/app/app.js: level debug, string formatters.level, redact of req.headers.cookie/authorization/user-agent; no transports; listed in fallow ignoreDependencies
  • @playwright/test: e2e/oauth-flow.spec.js (test, expect, page/request fixtures) + playwright.config.js (testDir, workers, baseURL, trace)
  • eslint: eslint.config.js (js/recommended + defineConfig) via npm run lint and lint-staged
  • fallow: CLI via npm run fallow in the CI smoke job, configured by .fallowrc.json (entry test/features + test/unit)
Test coverage
  • Strong: auth-suite and planner-suite pass (given), round-trip probe passes.
  • Strong: test/integration/oauth-flow.test.js exercises the exact contract path — authorize → token → JWKS verify → userinfo claim assertions — on the upgraded hono/@hono/node-server stack.
  • Strong: test/integration/jwt-payload.test.js covers id_token claims for both session classes (GitHub-linked vs not).
  • Strong: e2e/oauth-flow.spec.js drives the full magic-link OAuth round trip through a real browser and APIRequestContext.
  • Thin: no test asserts pino log output (redaction/level format); mitigated by my runtime check with the app's exact config on 10.4.0.
  • Gap: eslint 10.12.0 and fallow 3.32.0 (CI smoke gate) were not part of the given suites — validated locally instead; both pass with no new findings.
Calibration and confidence

Confidence: High — Every listed runtime/cross-service contract was verified at the required rigor: the emitting code (better-auth 1.7.7) is unchanged in this diff, receiving-repo tests exercise each exact path on the upgraded stack, the consumer side was read in a local planner checkout, and the one diff that touches an emitted artifact (pino logs) was verified by runtime check with the repo's exact config. Both smoke-gate tools were run locally at the new versions with no new findings, and all given verification results (planner-suite, auth-suite, probe) pass. No unverified or partially verified contracts remain, so the Medium confidence cap does not apply.

  1. Weakest claim: The claim that pino 10.4.0's log-contract changes are inert rests on my local runtime check plus a diff read, not on a repo test — no test in this repo asserts log output. A committed test pinning the redacted log line format for the app's pinoLogger config would shore this up.
  2. Relied on but unverified: That pino 10.4.0's 'without Object.prototype' hardening of redaction/serializer maps (#2457, #2495) and child-binding key escaping (#2452) does not alter edge-case log shapes I did not exercise (e.g. child bindings with keys colliding with Object.prototype members). I verified only the repo's actual config and record shapes at runtime, and relied on the diff showing these as shape-construction hardening, not behavior changes.
  3. Falsifier: A failing auth-suite, planner-suite, or round-trip probe against this head would overturn the verdict — all three pass. Locally, a new finding in npm run fallow (exit non-zero) or a changed pino output line under the app.js config would prove the analysis wrong; neither occurred.

@till
till requested review from mroderick and till October 18, 2026 15:38
@mroderick
mroderick merged commit 8a22252 into main Oct 18, 2026
7 checks passed
@mroderick
mroderick deleted the dependabot/npm_and_yarn/npm-deps-715e69a394 branch October 18, 2026 20:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mroderick mroderick mroderick approved these changes
@till till till approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mroderick @till