Skip to content

chore(deps): bump the npm-production group across 1 directory with 16 updates - #856

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-a483d9b645
Open

chore(deps): bump the npm-production group across 1 directory with 16 updates#856
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-production-a483d9b645

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-production group with 16 updates in the / directory:

Package From To
@stripe/stripe-js 9.13.0 9.14.0
eventsource-parser 3.1.1 4.1.0
@hono/node-server 2.1.0 2.1.1
@x402/core 2.22.0 2.23.0
@x402/evm 2.22.0 2.23.0
@x402/express 2.22.0 2.23.0
hono 4.13.1 4.13.3
viem 2.55.13 2.55.19
vite 8.2.1 8.2.2
@remix-run/node-fetch-server 0.14.0 0.14.1
bun 1.3.14 1.4.0
@tanstack/react-query 5.101.4 5.102.2
stripe 17.7.0 22.5.0
accounts 0.16.0 0.16.2
file-type 22.0.1 22.0.2
ox 0.14.33 1.7.1

Updates @stripe/stripe-js from 9.13.0 to 9.14.0

Release notes

Sourced from @​stripe/stripe-js's releases.

v9.14.0

  • CPM in ECE - Update API types (#959)
  • Add types for new walletOptions top-level parameter for PE create/update (#952)
  • Add deprecation tag to onShippingDetailsChange for Embedded Checkout (#960)
  • Bump js-yaml from 3.15.0 to 3.15.1 (#958)

New features

Fixes

Changed

Commits

Updates eventsource-parser from 3.1.1 to 4.1.0

Release notes

Sourced from eventsource-parser's releases.

v4.1.0

Minor Changes

  • #39 0482048 Thanks @​rexxars! - Added an onId callback that reports ID fields when an event block ends, including blocks without data.

v4.0.0

Major Changes

  • #33 39cf365 Thanks @​rexxars! - Require Node.js 22.12 or higher, drop the CommonJS build, and discard invalid lines instead of buffering them

    Breaking changes

    • Node.js 18 and 20 are no longer supported. engines now requires >=22.12, and the browserslist target moved from node >= 18 to node >= 22.12. Older versions may keep working, but they are no longer tested or guaranteed.
    • The CommonJS build has been removed. The main field and the require export conditions are gone, so the package resolves to ./dist/index.js and ./dist/stream.js only. Node 22.12 and above supports require(esm) transparently, so require('eventsource-parser') continues to work there.
    • The root stream.js file has been removed. It re-exported ./dist/stream.cjs for React Native and other bundlers without package exports support. Import eventsource-parser/stream instead, and make sure your bundler resolves the exports field.
    • Invalid lines are now discarded as soon as the parser can tell they cannot become a valid SSE field, rather than being buffered until the line terminator arrives. onError is not called for these, and no line, field, or value is retained. Only lines that are complete when found to be invalid still produce a ParseError with type: 'unknown-field'. This also means reset({consume: true}) no longer reports pending data that was already discarded.
    • Partial comment lines (starting with :) are only buffered when an onComment callback is configured. Without one, they are discarded like any other line the parser has no use for.

    Other changes

    • A leading byte order mark is now stripped whether it arrives as a decoded U+FEFF (for example from a TextDecoder created with ignoreBOM) or as the raw three byte 0xEF 0xBB 0xBF sequence. Previously only the raw form was handled.
    • The README documented an invalid-field error type that the parser never emitted. The ErrorType union is unchanged; the documentation now correctly refers to unknown-field.
Changelog

Sourced from eventsource-parser's changelog.

4.1.0

Minor Changes

  • #39 0482048 Thanks @​rexxars! - Added an onId callback that reports ID fields when an event block ends, including blocks without data.

4.0.0

Major Changes

  • #33 39cf365 Thanks @​rexxars! - Require Node.js 22.12 or higher, drop the CommonJS build, and discard invalid lines instead of buffering them

    Breaking changes

    • Node.js 18 and 20 are no longer supported. engines now requires >=22.12, and the browserslist target moved from node >= 18 to node >= 22.12. Older versions may keep working, but they are no longer tested or guaranteed.
    • The CommonJS build has been removed. The main field and the require export conditions are gone, so the package resolves to ./dist/index.js and ./dist/stream.js only. Node 22.12 and above supports require(esm) transparently, so require('eventsource-parser') continues to work there.
    • The root stream.js file has been removed. It re-exported ./dist/stream.cjs for React Native and other bundlers without package exports support. Import eventsource-parser/stream instead, and make sure your bundler resolves the exports field.
    • Invalid lines are now discarded as soon as the parser can tell they cannot become a valid SSE field, rather than being buffered until the line terminator arrives. onError is not called for these, and no line, field, or value is retained. Only lines that are complete when found to be invalid still produce a ParseError with type: 'unknown-field'. This also means reset({consume: true}) no longer reports pending data that was already discarded.
    • Partial comment lines (starting with :) are only buffered when an onComment callback is configured. Without one, they are discarded like any other line the parser has no use for.

    Other changes

    • A leading byte order mark is now stripped whether it arrives as a decoded U+FEFF (for example from a TextDecoder created with ignoreBOM) or as the raw three byte 0xEF 0xBB 0xBF sequence. Previously only the raw form was handled.
    • The README documented an invalid-field error type that the parser never emitted. The ErrorType union is unchanged; the documentation now correctly refers to unknown-field.
Commits
  • 6519a0f chore: version packages (#40)
  • f54bf65 docs: clarify eventsource being cross-runtime, not node.js exclusive
  • 0482048 feat: add an onId callback (#39)
  • 202c19e chore: version packages (#36)
  • fde4ca2 ci: use a conventional commit subject for the version pull request (#38)
  • f32fda2 ci: generate changesets from conventional commit PR titles (#37)
  • c8cd582 chore: add changeset for #33
  • 39cf365 feat!: require node 22.12 or higher, drop commonjs, reduce memory usage (#33)
  • 0e767c4 docs: prepare CHANGELOG.md for changesets
  • f56f2d2 ci: replace semantic-release with changesets (#35)
  • See full diff in compare view

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

Updates @x402/core from 2.22.0 to 2.23.0

Commits

Updates @x402/evm from 2.22.0 to 2.23.0

Commits

Updates @x402/express from 2.22.0 to 2.23.0

Commits

Updates hono from 4.13.1 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236
  • fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
  • fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
  • fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
  • feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

Commits
  • 0293343 4.13.3
  • 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
  • c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
  • eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
  • a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
  • 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
  • ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
  • 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
  • 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
  • 7195c24 fix(etag): copy pending stream bytes (#5239)
  • Additional commits viewable in compare view

Updates viem from 2.55.13 to 2.55.19

Release notes

Sourced from viem's releases.

viem@2.55.19

Patch Changes

viem@2.55.18

Patch Changes

viem@2.55.17

Patch Changes

viem@2.55.16

Patch Changes

viem@2.55.15

Patch Changes

Commits

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

  • deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

  • bundled-dev: handle lazy request error (#23291) (3ba026d)
  • bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
  • config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
  • css: don't pass empty targets to lightningcss (#23295) (2804636)
  • define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
  • deps: update all non-major dependencies (#23217) (ba958bd)
  • deps: update rolldown-related dependencies (#23218) (83ecb2c)
  • module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
  • optimizer: close custom extension analysis bundles (#23207) (8fb7675)
  • reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
  • respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
  • ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
  • vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

Miscellaneous Chores

Code Refactoring

  • use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
  • use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

  • define: close rolldown bundler after generate (#23231) (b4d66fe)
  • module-runner: add TLA circular import case (#23299) (4a261f2)
  • module-runner: simplify server-hmr tests (#23300) (599b44b)
  • ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

  • use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)
Commits
  • de1111a release: v8.2.2
  • cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
  • 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
  • 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
  • 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
  • 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
  • 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
  • 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
  • 599b44b test(module-runner): simplify server-hmr tests (#23300)
  • 4a261f2 test(module-runner): add TLA circular import case (#23299)
  • Additional commits viewable in compare view

Updates @remix-run/node-fetch-server from 0.14.0 to 0.14.1

Release notes

Sourced from @​remix-run/node-fetch-server's releases.

node-fetch-server v0.14.1

Patch Changes

  • Request handlers now receive native Request instances instead of lazy request objects that emulated native requests. This fixes compatibility with standard APIs like new Request(request, init) that rely on native Request internals.
Changelog

Sourced from @​remix-run/node-fetch-server's changelog.

v0.14.1

Patch Changes

  • Request handlers now receive native Request instances instead of lazy request objects that emulated native requests. This fixes compatibility with standard APIs like new Request(request, init) that rely on native Request internals.
Commits

Updates bun from 1.3.14 to 1.4.0

Release notes

Sourced from bun's releases.

Bun v1.4

To install Bun v1.4

curl -fsSL https://bun.com/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.0:

bun upgrade

Read the blog post:

Thank you

Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3.

... (truncated)

Commits
  • 34cbb9a Fix edgecase in v8 CPU profiler
  • cfa9f8e valkey: add ERR_REDIS_SERVER_ERROR for server error replies (#39573)
  • 6ee3009 Read BUN_FEATURE_FLAG_EXPERIMENTAL_BAKE and BUN_FEATURE_FLAG_NO_LIBDEFLATE fr...
  • 0a4e3b1 process: NUL-terminate the PSI trigger that arms memoryPressure on Linux (#39...
  • 4199361 tls: send a bare RST from terminate(), no close_notify (#39632)
  • a356964 usockets: skip the poll-error close for a socket a handler already closed (#3...
  • 24c0063 valkey: fix null array, null CRLF, big number and blob error replies (#39544)
  • 8226b3d css: keep the lower bound when simplifying clamp() (#39577)
  • 88165c6 buffer: restore swap16/32/64 and multi-byte indexOf throughput (#39616)
  • 118154c libjpeg-turbo: use the clz intrinsic and enable the x86_64 SIMD kernels (#39523)
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.101.4 to 5.102.2

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.2

Patch Changes

  • Updated dependencies [80fbf73]:
    • @​tanstack/query-core@​5.102.2

5.102.1

Patch Changes

  • Updated dependencies [134890d]:
    • @​tanstack/query-core@​5.102.1

5.102.0

Minor Changes

  • #10668 e674826 - react-query: update usePrefetchQuery and usePrefetchInfiniteQuery to use queryClient.query and queryClient.infiniteQuery

Patch Changes

Commits

Updates stripe from 17.7.0 to 22.5.0

Release notes

Sourced from stripe's releases.

v22.5.0

  • #2805 Emit Claude Code plugin hint at module load time

    • Emits new Claude Code plugin hint when CLAUDECODE or CLAUDE_CODE_CHILD_SESSION environment variables are detected.

  • #2794 add/adjust event parsing helpers

    • Added methods that return their respective Event/EventNotification objects without verifying authenticity. Use them when you've previously verified an event (e.g. you verified, put the event in a queue, and are now processing). Supports events from AWS EventBridge and Azure Event Grid natively.
      • stripe.webhooks.constructEventWithoutVerification(payload)
      • stripe.constructEventWithoutVerification(payload)
      • stripe.parseEventNotificationWithoutVerification(payload)

  • #2799 Add stripe.major_api_version constant

See the changelog for more details.

v22.5.0-beta.1

This release changes the pinned API version to 2026-07-29.preview.

  • #2772 Update generated code for beta
    • Add support for list and retrieve methods on resource ProductCatalog.TrialOffer
    • Add support for tax_items on ChargeCaptureParams.payment_details.car_rental_data[].total.tax, ChargeCaptureParams.payment_details.flight_data[].total.tax, ChargeCaptureParams.payment_details.lodging_data[].total.tax, ChargeUpdateParams.payment_details.car_rental_data[].total.tax, ChargeUpdateParams.payment_details.flight_data[].total.tax, ChargeUpdateParams.payment_details.lodging_data[].total.tax, PaymentIntent.payment_details.car_rental_data[].total.tax, PaymentIntent.payment_details.flight_data[].total.tax, PaymentIntent.payment_details.lodging_data[].total.tax, PaymentIntentCaptureParams.payment_details.car_rental_data[].total.tax, PaymentIntentCaptureParams.payment_details.flight_data[].total.tax, PaymentIntentCaptureParams.payment_details.lodging_data[].total.tax, PaymentIntentConfirmParams.payment_details.car_rental_data[].total.tax, PaymentIntentConfirmParams.payment_details.flight_data[].total.tax, PaymentIntentConfirmParams.payment_details.lodging_data[].total.tax, PaymentIntentCreateParams.payment_details.car_rental_data[].total.tax, PaymentIntentCreateParams.payment_details.flight_data[].total.tax, PaymentIntentCreateParams.payment_details.lodging_data[].total.tax, PaymentIntentUpdateParams....

      Description has been truncated
@dependabot
chore(deps): bump the npm-production group across 1 directory with 16…
8e68a6e 
… updates

Bumps the npm-production group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@stripe/stripe-js](https://github.com/stripe/stripe-js) | `9.13.0` | `9.14.0` |
| [eventsource-parser](https://github.com/rexxars/eventsource-parser) | `3.1.1` | `4.1.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` | `2.1.1` |
| [@x402/core](https://github.com/x402-foundation/x402) | `2.22.0` | `2.23.0` |
| [@x402/evm](https://github.com/x402-foundation/x402) | `2.22.0` | `2.23.0` |
| [@x402/express](https://github.com/x402-foundation/x402) | `2.22.0` | `2.23.0` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.3` |
| [viem](https://github.com/wevm/viem) | `2.55.13` | `2.55.19` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |
| [@remix-run/node-fetch-server](https://github.com/remix-run/remix/tree/HEAD/packages/node-fetch-server) | `0.14.0` | `0.14.1` |
| [bun](https://github.com/oven-sh/bun) | `1.3.14` | `1.4.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.2` |
| [stripe](https://github.com/stripe/stripe-node) | `17.7.0` | `22.5.0` |
| [accounts](https://github.com/tempoxyz/accounts) | `0.16.0` | `0.16.2` |
| [file-type](https://github.com/sindresorhus/file-type) | `22.0.1` | `22.0.2` |
| [ox](https://github.com/wevm/ox) | `0.14.33` | `1.7.1` |



Updates `@stripe/stripe-js` from 9.13.0 to 9.14.0
- [Release notes](https://github.com/stripe/stripe-js/releases)
- [Commits](stripe/stripe-js@v9.13.0...v9.14.0)

Updates `eventsource-parser` from 3.1.1 to 4.1.0
- [Release notes](https://github.com/rexxars/eventsource-parser/releases)
- [Changelog](https://github.com/rexxars/eventsource-parser/blob/main/CHANGELOG.md)
- [Commits](rexxars/eventsource-parser@v3.1.1...v4.1.0)

Updates `@hono/node-server` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.0...v2.1.1)

Updates `@x402/core` from 2.22.0 to 2.23.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/core@v2.22.0...npm-@x402/core@v2.23.0)

Updates `@x402/evm` from 2.22.0 to 2.23.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/evm@v2.22.0...npm-@x402/evm@v2.23.0)

Updates `@x402/express` from 2.22.0 to 2.23.0
- [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/express@v2.22.0...npm-@x402/express@v2.23.0)

Updates `hono` from 4.13.1 to 4.13.3
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.3)

Updates `viem` from 2.55.13 to 2.55.19
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.55.13...viem@2.55.19)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `@remix-run/node-fetch-server` from 0.14.0 to 0.14.1
- [Release notes](https://github.com/remix-run/remix/releases)
- [Changelog](https://github.com/remix-run/remix/blob/main/packages/node-fetch-server/CHANGELOG.md)
- [Commits](https://github.com/remix-run/remix/commits/v0.14.1/packages/node-fetch-server)

Updates `bun` from 1.3.14 to 1.4.0
- [Release notes](https://github.com/oven-sh/bun/releases)
- [Commits](oven-sh/bun@bun-v1.3.14...bun-v1.4.0)

Updates `@tanstack/react-query` from 5.101.4 to 5.102.2
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.2/packages/react-query)

Updates `stripe` from 17.7.0 to 22.5.0
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v17.7.0...v22.5.0)

Updates `accounts` from 0.16.0 to 0.16.2
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/accounts@0.16.0...accounts@0.16.2)

Updates `file-type` from 22.0.1 to 22.0.2
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v22.0.1...v22.0.2)

Updates `ox` from 0.14.33 to 1.7.1
- [Release notes](https://github.com/wevm/ox/releases)
- [Changelog](https://github.com/wevm/ox/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/ox/compare/ox@0.14.33...ox@1.7.1)

---
updated-dependencies:
- dependency-name: "@stripe/stripe-js"
  dependency-version: 9.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: eventsource-parser
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-production
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@x402/core"
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@x402/evm"
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@x402/express"
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: hono
  dependency-version: 4.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: viem
  dependency-version: 2.55.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: "@remix-run/node-fetch-server"
  dependency-version: 0.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: bun
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-production
- dependency-name: stripe
  dependency-version: 22.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-production
- dependency-name: accounts
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: file-type
  dependency-version: 22.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-production
- dependency-name: ox
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026
@socket-security

socket-security Bot commented Aug 31, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedbun@​1.4.0921007994100
Added@​types/​node@​26.4.01001008196100
Addedtsx@​4.23.131001008194100
Addedstripe@​22.5.08210010096100
Addedvite@​8.2.2981008296100
Addedfile-type@​22.0.210010010089100
Addedeventsource-parser@​4.1.010010010090100
Added@​tanstack/​react-query@​5.102.2991009198100
Added@​hono/​node-server@​2.1.110010010094100
Addedhono@​4.13.31001009796100
Addedaccounts@​0.16.29610010099100
Added@​x402/​express@​2.23.09710010097100
Added@​x402/​core@​2.23.010010010097100
Added@​x402/​evm@​2.23.010010010097100
Updatedox@​0.14.33 ⏵ 1.7.1100 +110099 +197 +2100
Updated@​stripe/​stripe-js@​9.13.0 ⏵ 9.14.0100 +1100100100100

View full report
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

0 participants