build(deps): bump the npm_and_yarn group across 1 directory with 4 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: hono, nx, postcss and socket.io-parser.

Updates hono from 4.12.30 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
• fix(client): skip undefined header and cookie values in honojs/hono#5244
• fix(client): skip an undefined entry inside a query array in honojs/hono#5272
• fix(client): skip an undefined entry inside a form array in honojs/hono#5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
• fix(client): omit empty query delimiter in honojs/hono#5283
• fix(request): drop stale content length for cloned FormData in honojs/hono#5282
• fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
• fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
• fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• 3a67f7f Merge commit from fork
• 9c28d72 Merge commit from fork
• 017000d 4.13.4
• 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
• 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
• c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
• 612b59c fix(request): drop stale content length for cloned FormData (#5282)
• 73794bd fix(client): omit empty query delimiter (#5283)
• Additional commits viewable in compare view

Updates nx from 22.1.0 to 22.7.8

Release notes

Sourced from nx's releases.

22.7.8 (2026-07-30)

🩹 Fixes

• angular-rspack: dispose stylesheet bundler so one-shot builds exit (#35869)
• core: use workspace package manager when fetching migrations via install (#35866)
• core: omit peer dependencies when installing packages to a temp dir (#36295)
• core: prevent shell injection in nx import (#36348)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• core: acknowledge @​swc/core build script in generated pnpm-workspace.yaml (#35608)
• core: keep real dependencies when omitting peers from npm temp installs (#36518, #36295)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• detox: resolve jest versions locally instead of importing @​nx/jest internals (3ce3f6ab6e)
• docker: run release pipeline docker commands without a shell (#36505)
• js: exclude typescript 7 from supported versions on 22.7.x (dc804964e9)
• js: resolve the verdaccio bin through its package.json (#36479)
• misc: use default import for chalk in @​nx/workspace output.ts (#35523, #35521, #34111, #21201, #26667)
• repo: use default inputs instead of the '...' token in nx-dev on 22.7.x (#35530)
• repo: trust wix/brew tap so macOS detox CI can install applesimutils (#36146)
• testing: seed typescript before plugins in e2e workspaces to avoid TS7 stub (7f5ffbfcbc)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Jonathan Garvey @​jdgarvey
• Miroslav Jonaš @​meeroslav

22.7.7 (2026-07-10)

🩹 Fixes

• core: prevent path traversal / zip-slip in self-hosted remote cache (#36116)
• core: warn when the self-hosted remote cache disables TLS verification (NXC-4593) (#36132, #36116)
• dotnet: declare obj as a publish output to fix sandbox violation (#35858)
• dotnet: declare directory build props input for analyzer dotnet tasks (df7540195a)
• dotnet: declare directory build props on the separate release build target (6545ee2222)
• dotnet: declare directory build props on the analyzer tests dotnet targets (e72ee0dd79)

❤️ Thank You

• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz

22.7.6 (2026-06-23)

🩹 Fixes

... (truncated)

Commits

• f7afd77 fix(core): bump pinned axios and brace-expansion past vulnerable versions (#3...
• 983413b fix(core): keep real dependencies when omitting peers from npm temp installs ...
• 4159295 fix(core): stop passing git revisions through a shell in affected commands (#...
• cf99649 fix(core): prevent shell injection in nx import (#36348)
• 74311e7 fix(core): omit peer dependencies when installing packages to a temp dir (#36...
• 84beebc fix(core): use workspace package manager when fetching migrations via install...
• a328bf1 fix(core): warn when the self-hosted remote cache disables TLS verification (...
• a828076 fix(core): prevent path traversal / zip-slip in self-hosted remote cache (#36...
• dc849bb fix(core): update brace-expansion and yaml (#35790)
• 8fd1feb fix(core): allow local plugin subpath imports without custom conditions (#35751)
• Additional commits viewable in compare view

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Updates postcss from 8.5.19 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Updates socket.io-parser from 4.2.4 to 4.2.7

Release notes

Sourced from socket.io-parser's releases.

socket.io-parser@4.2.7

Bug Fixes

• honor toJSON() when deconstructing a binary packet (#5518) (57f1114)
• reject binary packets with zero attachments (7c6ef57)

New Contributors

• @​spokodev made their first contribution in socketio/socket.io#5518

socket.io-parser@4.2.6

This release includes a fix for CVE-2026-33151. Please upgrade as soon as possible.

Bug Fixes

• add a limit to the number of binary attachments (b25738c)

socket.io-parser@4.2.5

This release contains a bump of debug from ~4.3.1 to ~4.4.1.

Commits

• 4054894 chore(release): socket.io-parser@4.2.7
• 7c6ef57 fix(parser): reject binary packets with zero attachments
• 57f1114 fix(parser): honor toJSON() when deconstructing a binary packet (#5518)
• 8d2e4f7 docs(security): add CVE-2026-59724 and CVE-2026-59725
• d2d753f refactor(sio): align client file matching in Node.js HTTP server
• dfb5ab3 fix(sio): prevent uWebSockets.js from serving missing client files
• dcbd961 perf(eio): optimize polling request body buffering
• 6bb2e7f refactor(sio): internalize base64id dependency
• a80711a refactor(eio): internalize base64id dependency
• 8bead0f chore: upgrade to TypeScript 6
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for socket.io-parser since your current version.

[coveralls]

coverage: 87.816%. remained the same — dependabot/npm_and_yarn/npm_and_yarn-f5fd6f08d0 into master

[kdinev]

@dependabot recreate