Skip to content

Bump the npm_and_yarn group across 2 directories with 4 updates - #2902

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/platform.bible-extension/npm_and_yarn-0313f0ee4a
Open

dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/platform.bible-extension/npm_and_yarn-0313f0ee4a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 3 updates in the /platform.bible-extension directory: @hono/node-server, qs and systeminformation.
Bumps the npm_and_yarn group with 1 update in the /frontend directory: @sveltejs/kit.

Updates @hono/node-server from 2.1.1 to 2.1.5

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • d57ed9b 2.1.4
  • 92b014c chore: allow hono v5 as a peer dependency (#406)
  • 720ac78 2.1.3
  • 9821792 Merge commit from fork
  • 35bca95 2.1.2
  • 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
  • fe7467c test(request): accept asynchronous body read errors (#403)
  • Additional commits viewable in compare view

Updates qs from 6.16.0 to 6.17.1

Changelog

Sourced from qs's changelog.

6.17.1

  • [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
  • [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
  • [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
  • [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
  • [Refactor] parse: extract wrapping-bracket stripping helper
  • [readme] document that depth: 0 and depth: false keep keys flat
  • [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

  • [New] stringify: add WHATWG format (#623)
  • [Fix] stringify: do not sort the caller's filter array in place (#637)
  • [Fix] parse: copy an own __proto__ key as data (#636)
  • [Fix] parse: decode percent-encoded dots case-insensitively (#635)
  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
  • [Fix] parse: allow scalar fields with a zero array limit (#627)
  • [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
  • [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
  • [eslint] fix indentation
  • [readme] document the encoder's format argument
  • [meta] add changelog acknowledgement
  • [meta] fix changelog indents
  • [Dev Deps] update eslint, evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
  • [Tests] stringify: pin sort order for nested keys selected by an array filter
  • [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
  • [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
  • [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
  • [Tests] parse: pin the behavior of a zero or negative arrayLimit
  • [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [meta] use double quotes for better OS support
  • [Dev Deps] update evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

  • [Fix] parse: do not mutate an object input
  • [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
  • [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
  • [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
  • [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
  • [Fix] stringify: ignore inherited array format names (#622)
  • [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
  • [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
  • [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
  • [Fix] parse: only treat [] as array syntax when it ends the key
  • [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits
  • 43baea4 v6.17.1
  • 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
  • 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
  • 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
  • 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
  • 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
  • ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
  • 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
  • cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
  • 136912a v6.16.2
  • Additional commits viewable in compare view

Updates systeminformation from 5.33.10 to 5.33.19

Release notes

Sourced from systeminformation's releases.

v5.33.19

Full Changelog: sebhildebrandt/systeminformation@v5.33.18...v5.33.19

v5.33.18

Full Changelog: sebhildebrandt/systeminformation@v5.33.17...v5.33.18

v5.33.17

Full Changelog: sebhildebrandt/systeminformation@v5.33.16...v5.33.17

v5.33.16

Full Changelog: sebhildebrandt/systeminformation@v5.33.15...v5.33.16

v5.33.15

Full Changelog: sebhildebrandt/systeminformation@v5.33.14...v5.33.15

v5.33.14

Full Changelog: sebhildebrandt/systeminformation@v5.33.13...v5.33.14

v5.33.13

Full Changelog: sebhildebrandt/systeminformation@v5.33.12...v5.33.13

v5.33.12

Full Changelog: sebhildebrandt/systeminformation@v5.33.11...v5.33.12

v5.33.11

Full Changelog: sebhildebrandt/systeminformation@v5.33.10...v5.33.11

Changelog

Sourced from systeminformation's changelog.

Changelog

Major Changes - Version 5

New Functions

  • audio() detailed audio information
  • bluetoothDevices() detailed information detected bluetooth devices
  • dockerImages() detailed information docker images
  • dockerVolumes() detailed information docker volumes
  • printers() detailed printer information
  • usb() detailed USB information
  • wifiInterfaces() detected Wi-Fi interfaces
  • wifiConnections() active Wi-Fi connections

Breaking Changes

Be aware, that the new version 5.x is NOT fully backward compatible to version 4.x ...

We had to make several interface changes to keep systeminformation as consistent as possible. We highly recommend to go through the complete list and adapt your own code to be again compatible to the new version 5.

Function Old New (V5) Comments
unsupported values -1 null values which are unknown orunsupported on platform
battery() hasbatterycyclecountischargingdesignedcapacitymaxcapacityacconnectedtimeremaining hasBatterycycleCountisChargingdesignedCapacitymaxCapacityacConnectedtimeRemaining pascalCase conformity
blockDevices() fstype fsType pascalCase conformity
cpu() speedminspeedmax speedMinspeedMax pascalCase conformity
cpu().speedcpu().speedMincpu().speedMax string values now returningnumerical values better value handling
cpuCurrentspeed() cpuCurrentSpeed() function name changedpascalCase conformity
currentLoad() avgloadcurrentloadcurrentload_usercurrentload_systemcurrentload_nicecurrentload_idlecurrentload_irqraw_currentload avgLoadcurrentLoadcurrentLoadUsercurrentLoadSystemcurrentLoadNicecurrentLoadIdlecurrentLoadIrqrawCurrentLoad pascalCase conformity
dockerContainerStats() mem_usagemem_limitmem_percentcpu_percentcpu_statsprecpu_statsmemory_stats memUsagememLimitmemPercentcpuPercentcpuStatsprecpuStatsmemoryStats pascalCase conformity
dockerContainerProcesses() pid_host pidHost pascalCase conformity
graphics().display pixeldepthresolutionxresolutionysizexsizey pixelDepthresolutionXresolutionYsizeXsizeY pascalCase conformity
networkConnections() localaddresslocalportpeeraddresspeerport localAddresslocalPortpeerAddresspeerPort pascalCase conformity
networkInterfaces() carrier_changes carrierChanges pascalCase conformity
processes() mem_vszmem_rsspcpupcpuupcpuspmem memVszmemRsscpucpuucpusmem pascalCase conformityrenamed attributes
processLoad() result as object result as array of objects function now allows to provide more thanone process (as a comma separated list)
services() pcpupmem cpumem renamed attributes
vbox() HPETPAEAPICX2APICACPIIOAPICbiosAPICmodeTRC hpetpaeapicx2ApicacpiioApicbiosApicModertc pascalCase conformity

Other Improvements and Changes

  • baseboard(): added memMax, memSlots
  • bios(): added language and features (linux)
  • blockDevices() added raid group member (linux)
  • cpu(): extended AMD processor list

... (truncated)

Commits
  • 1d6f20e 5.33.19
  • 26034d3 code review and hardening
  • 7f5268b networkInterfaces() fixed uncaught TypeError on non-function callback
  • e478870 get() fixed uncaught TypeError on params for callback-only functions
  • c17c3db 5.33.18
  • c2b652f fsSize() fixed uncaught TypeError on non-string drive (linux, macOS, bsd)
  • 30edabf 5.33.17
  • 7c59c22 inetChecksite() fixed unhandled rejection on invalid URLs
  • 2929006 5.33.16
  • 5014c6d utils() sanitizeShellString extended (windows)
  • Additional commits viewable in compare view

Updates @sveltejs/kit from 2.70.3 to 3.0.0

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​3.0.0

Major Changes

  • breaking: move remote function types to $app/server (#16740)

  • breaking: remove experimental.handleRenderingErrors flag (#16265)

  • breaking: make getRequest and setResponse synchronous (#16280)

  • breaking: TypeScript 6 is now the minimum required version (#15930)

  • breaking: refresh all load functions/queries when clicking a link to the current URL (#16572)

  • breaking: move remote function types to $app/server (#16764)

  • breaking: upgrade to cookie v2. Cookie names must now contain only ASCII characters (#13386)

  • breaking: require Node 22 or newer (#12548)

  • major: error when a client-requested single-flight mutation isn't respected by the server, allow the server to explicitly ignore refreshes (#16892)

  • breaking: remove the preloadStrategy option. modulepreload will always be used (#15256)

  • breaking: default the cookie path option to '/' (#15398)

  • breaking: remove @sveltejs/kit/node/polyfills (#15430)

  • breaking: add config.kit.output.linkHeaderPreload to preload using the Link header (#15939)

  • breaking: require @sveltejs/vite-plugin-svelte v7 (#15371)

  • breaking: make page.url immutable on a type level (#16256)

  • breaking: remove base, assets, and resolveRoute from $app/paths (#15507)

  • breaking: remove createEntries from the Builder object passed to adapter functions (#15509)

  • breaking: return no content for 204 responses (#16200)

  • breaking: rename Pathname type to Path and Asset to AssetPath (#16430) breaking: remove leading / from Path and AssetPath

  • breaking: handle's resolve is now typed to always return a Promise (#16352)

  • breaking: remove Server constructor and SSRManifest from public types (#16876)

  • breaking: require Svelte config options to be passed through the Vite plugin (#16007)

  • breaking: form action responses now use the HTTP status code returned from fail (#16200)

  • breaking: write tsconfig to node_modules/$app/tsconfig (#16458)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

3.0.0

Major Changes

  • breaking: move remote function types to $app/server (#16740)

  • breaking: remove experimental.handleRenderingErrors flag (#16265)

  • breaking: make getRequest and setResponse synchronous (#16280)

  • breaking: TypeScript 6 is now the minimum required version (#15930)

  • breaking: refresh all load functions/queries when clicking a link to the current URL (#16572)

  • breaking: move remote function types to $app/server (#16764)

  • breaking: upgrade to cookie v2. Cookie names must now contain only ASCII characters (#13386)

  • breaking: require Node 22 or newer (#12548)

  • major: error when a client-requested single-flight mutation isn't respected by the server, allow the server to explicitly ignore refreshes (#16892)

  • breaking: remove the preloadStrategy option. modulepreload will always be used (#15256)

  • breaking: default the cookie path option to '/' (#15398)

  • breaking: remove @sveltejs/kit/node/polyfills (#15430)

  • breaking: add config.kit.output.linkHeaderPreload to preload using the Link header (#15939)

  • breaking: require @sveltejs/vite-plugin-svelte v7 (#15371)

  • breaking: make page.url immutable on a type level (#16256)

  • breaking: remove base, assets, and resolveRoute from $app/paths (#15507)

  • breaking: remove createEntries from the Builder object passed to adapter functions (#15509)

  • breaking: return no content for 204 responses (#16200)

  • breaking: rename Pathname type to Path and Asset to AssetPath (#16430) breaking: remove leading / from Path and AssetPath

  • breaking: handle's resolve is now typed to always return a Promise (#16352)

  • breaking: remove Server constructor and SSRManifest from public types (#16876)

  • breaking: require Svelte config options to be passed through the Vite plugin (#16007)

  • breaking: form action responses now use the HTTP status code returned from fail (#16200)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 3 updates in the /platform.bible-extension directory: [@hono/node-server](https://github.com/honojs/node-server), [qs](https://github.com/ljharb/qs) and [systeminformation](https://github.com/sebhildebrandt/systeminformation).
Bumps the npm_and_yarn group with 1 update in the /frontend directory: [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit).


Updates `@hono/node-server` from 2.1.1 to 2.1.5
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.5)

Updates `qs` from 6.16.0 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.16.0...v6.17.1)

Updates `systeminformation` from 5.33.10 to 5.33.19
- [Release notes](https://github.com/sebhildebrandt/systeminformation/releases)
- [Changelog](https://github.com/sebhildebrandt/systeminformation/blob/master/CHANGELOG.md)
- [Commits](sebhildebrandt/systeminformation@v5.33.10...v5.33.19)

Updates `@sveltejs/kit` from 2.70.3 to 3.0.0
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@3.0.0/packages/kit)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: systeminformation
  dependency-version: 5.33.19
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@sveltejs/kit"
  dependency-version: 3.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 2, 2026
@coderabbitai

coderabbitai Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: cc7fedb8-724f-4186-8fab-c17847d3d0be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@github-actions github-actions Bot added 📦 Lexbox issues related to any server side code, fw-headless included 📙 Platform.Bible labels Nov 2, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code 📦 Lexbox issues related to any server side code, fw-headless included 📙 Platform.Bible

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants