chore(deps): bump the all-dependencies group across 1 directory with 11 updates by dependabot[bot] · Pull Request #106 · roziscoding/jack

dependabot · 2026-11-10T15:06:37Z

Bumps the all-dependencies group with 11 updates in the / directory:

Package	From	To
tsrs	`0.20.1-ts7.1.0-beta`	`0.21.0-ts7.1.0-beta`
@opentelemetry/exporter-logs-otlp-proto	`0.300.0`	`0.301.0`
@opentelemetry/exporter-trace-otlp-proto	`0.300.0`	`0.301.0`
@opentelemetry/sdk-logs	`3.0.0`	`3.1.0`
@opentelemetry/sdk-node	`0.300.0`	`0.301.0`
@opentelemetry/sdk-trace	`3.0.0`	`3.1.0`
hono	`4.13.16`	`4.13.17`
nuxt	`4.6.3`	`4.6.4`
vue	`3.5.44`	`3.5.45`
tailwindcss	`4.3.3`	`4.3.5`
vue-tsc	`3.3.13`	`3.3.14`

Updates tsrs from 0.20.1-ts7.1.0-beta to 0.21.0-ts7.1.0-beta

Release notes

Sourced from tsrs's releases.

0.20.1

tsrs 0.20.1 is a patch release targeting TypeScript 7.1 beta. The TypeScript source pin remains microsoft/TypeScript@3e9236361fa9, with the same TypeScript-compatible defaults and opt-in --fast preset as 0.20.0.
pnpm add -D tsrs@0.20.1-ts7.1.0-beta
# WebAssembly for Node and browsers:
pnpm add @tsrs/wasm@0.20.1-ts7.1.0-beta
Checker correctness. Reverts a union-constraint shortcut whose cached type-variable flag could miss NoInfer constituents. Narrowing checks each constituent again (#808).

WebAssembly hosts. Host and WASI memory accesses treat pointers at or above 2 GiB as unsigned, including request and response buffers, filesystem transfers, environment variables and output (#812).

Windows integration. Native packages include tsgo.exe for VS Code SDK discovery (#826); see editor setup. Bare content-mapper commands resolve through PATHEXT, and explicit paths bypass PATH lookup (#822).

npm launcher. Restores blocking standard streams before starting the native compiler, avoiding output failures when Node has made a stream nonblocking (#831).

Checker and collection storage. Small union-merge buffers and inference flags use inline storage; concurrent maps allocate shard groups on demand, generic link stores use smaller chunks, and language-server file events use Fx hashing while preserving order (#800, #804). The small-buffer and collection notes record individual measurements and tradeoffs.

Scheduling and filesystem work. Checker threads are reused across work groups, build modification-time caches are shared across builders without a single lock, and small include trees are read inline before falling back to the Rayon pool (#814, #815, #816).

Printer allocations. Emit and type display avoid temporary output buffers and strings while retaining the same output (#828). The printer note records measurements.

Release publishing. GitHub releases are marked as the latest release. npm packages continue to use the latest tag, and the playground deploys after publication (#801).

Benchmark documentation. The benchmark report compares published 0.20.0 packages with and without --fast against TypeScript 7.1 beta, with reproducible chart data (#805).

Supported platforms and known limitations remain listed in the compatibility table. The linked optimization measurements describe individual changes, not a new packaged-release performance comparison.

Full changelog

Commits

See full diff in compare view

Updates @opentelemetry/exporter-logs-otlp-proto from 0.300.0 to 0.301.0

Release notes

Sourced from @opentelemetry/exporter-logs-otlp-proto's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @trentm

startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.

startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).

Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.

refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @trentm

Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.

Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @avens19

fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @LarryHu0217

fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @trentm

fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @trentm

Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.

The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.

fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @MO2k4

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @helmipradita

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-proto from 0.300.0 to 0.301.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-proto's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @trentm

startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.

startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).

Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.

refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @trentm

Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.

Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @avens19

fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @LarryHu0217

fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @trentm

fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @trentm

Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.

The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.

fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @MO2k4

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @helmipradita

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-logs from 3.0.0 to 3.1.0

Release notes

Sourced from @opentelemetry/sdk-logs's releases.

v3.1.0

3.1.0

🚀 Features

feat(resources): Deprecate envDetector in favor of separate resourceAttributesEnvDetector and serviceNameEnvDetector. Also mark serviceInstanceIdDetector as stable (the service.instance.id semconv attribute is now stable). #6999 @trentm

🐛 Bug Fixes

fix(context-zone): declare the @opentelemetry/api peer dependency so Yarn PnP can resolve it for context-zone-peer-dep #7268 @Vivek1898

fix(core): accept attribute values with shared (non-circular) object references #7068 @rajanpanth

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

fix(propagator-b3): reject trace ids that are not 16 or 32 characters long #7262 @adityareddy-dev

📚 Documentation

docs(resources): update dead semantic conventions resource specification links #7254 @helmipradita

docs(migration): note that @opentelemetry/api v1.10.0 needs SDK 3.x #7253 @adityareddy-dev

🏠 Internal

perf(sdk-logs, sdk-trace): wait for each distinct pending resource once per batch instead of once per record #7208 @shehjaddev

ci: update the W3C harness for Python 3.14 #7236 @adityareddy-dev

Changelog

Sourced from @opentelemetry/sdk-logs's changelog.

3.1.0

🚀 Features

feat(resources): Deprecate envDetector in favor of separate resourceAttributesEnvDetector and serviceNameEnvDetector. Also mark serviceInstanceIdDetector as stable (the service.instance.id semconv attribute is now stable). #6999 @trentm

🐛 Bug Fixes

fix(context-zone): declare the @opentelemetry/api peer dependency so Yarn PnP can resolve it for context-zone-peer-dep #7268 @Vivek1898

fix(core): accept attribute values with shared (non-circular) object references #7068 @rajanpanth

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

fix(propagator-b3): reject trace ids that are not 16 or 32 characters long #7262 @adityareddy-dev

📚 Documentation

docs(resources): update dead semantic conventions resource specification links #7254 @helmipradita

docs(migration): note that @opentelemetry/api v1.10.0 needs SDK 3.x #7253 @adityareddy-dev

🏠 Internal

perf(sdk-logs, sdk-trace): wait for each distinct pending resource once per batch instead of once per record #7208 @shehjaddev

ci: update the W3C harness for Python 3.14 #7236 @adityareddy-dev

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.300.0 to 0.301.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @trentm

startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.

startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).

Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.

refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @trentm

Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.

Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @avens19

fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @LarryHu0217

fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @trentm

fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @trentm

Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.

The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.

fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @MO2k4

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @helmipradita

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-trace from 3.0.0 to 3.1.0

Release notes

Sourced from @opentelemetry/sdk-trace's releases.

v3.1.0

3.1.0

🚀 Features

feat(resources): Deprecate envDetector in favor of separate resourceAttributesEnvDetector and serviceNameEnvDetector. Also mark serviceInstanceIdDetector as stable (the service.instance.id semconv attribute is now stable). #6999 @trentm

🐛 Bug Fixes

fix(context-zone): declare the @opentelemetry/api peer dependency so Yarn PnP can resolve it for context-zone-peer-dep #7268 @Vivek1898

fix(core): accept attribute values with shared (non-circular) object references #7068 @rajanpanth

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

fix(propagator-b3): reject trace ids that are not 16 or 32 characters long #7262 @adityareddy-dev

📚 Documentation

docs(resources): update dead semantic conventions resource specification links #7254 @helmipradita

docs(migration): note that @opentelemetry/api v1.10.0 needs SDK 3.x #7253 @adityareddy-dev

🏠 Internal

perf(sdk-logs, sdk-trace): wait for each distinct pending resource once per batch instead of once per record #7208 @shehjaddev

ci: update the W3C harness for Python 3.14 #7236 @adityareddy-dev

Changelog

Sourced from @opentelemetry/sdk-trace's changelog.

3.1.0

🚀 Features

feat(resources): Deprecate envDetector in favor of separate resourceAttributesEnvDetector and serviceNameEnvDetector. Also mark serviceInstanceIdDetector as stable (the service.instance.id semconv attribute is now stable). #6999 @trentm

🐛 Bug Fixes

fix(context-zone): declare the @opentelemetry/api peer dependency so Yarn PnP can resolve it for context-zone-peer-dep #7268 @Vivek1898

fix(core): accept attribute values with shared (non-circular) object references #7068 @rajanpanth

fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @volodymyrshk @pichlermarc

Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.

If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

fix(propagator-b3): reject trace ids that are not 16 or 32 characters long #7262 @adityareddy-dev

📚 Documentation

docs(resources): update dead semantic conventions resource specification links #7254 @helmipradita

docs(migration): note that @opentelemetry/api v1.10.0 needs SDK 3.x #7253 @adityareddy-dev

🏠 Internal

perf(sdk-logs, sdk-trace): wait for each distinct pending resource once per batch instead of once per record #7208 @shehjaddev

ci: update the W3C harness for Python 3.14 #7236 @adityareddy-dev

Commits

9985264 chore: prepare next release (#7272)
7983f1c fix: raise @opentelemetry/api peer floor to 1.10.0 where needed (#7259)
0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
5ca48a7 fix(context-zone): declare the @opentelemetry/api peer dependency (#7268)
babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
4667c0a docs: update dead semantic conventions resource specification links (#7254)
Additional commits viewable in compare view

Updates hono from 4.13.16 to 4.13.17

Release notes

Sourced from hono's releases.

v4.13.17

What's Changed

fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in honojs/hono#5608

fix(utils/url): do not match a query key across separators in honojs/hono#5607

fix(etag,pretty-json): cancel the discarded response body in honojs/hono#5606

fix(client): detect the JSON media type with whitespace before a parameter in honojs/hono#5609

fix(timing): honor a precision of 0 in setMetric in honojs/hono#5363

fix(utils/mime,ssg): match media types case-insensitively in honojs/hono#5449

fix(timing): escape double quotes and backslashes in Server-Timing descriptions in honojs/hono#5478

fix(etag): preserve commas within quoted entity tags in honojs/hono#5353

fix(accepts): preserve exact media type quality over subtype wildcards in honojs/hono#5427

fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in honojs/hono#5611

fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in honojs/hono#5430

fix(ssg): do not reuse created directories across toSSG runs in honojs/hono#5381

fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in honojs/hono#5483

fix(jsx): escape element and object attribute values in honojs/hono#5512

fix(jsx): do not render ref objects as attributes in honojs/hono#5615

fix(factory): keep independent return types for nine handlers in honojs/hono#5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

Commits

61f7c59 4.13.17
1534ffa fix(factory): keep independent return types for nine handlers (#5618)
eb754bd fix(jsx): do not render ref objects as attributes (#5615)
6cbe361 fix(jsx): escape element and object attribute values (#5512)
8b7f9e9 fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events (#...
7852e0a fix(ssg): do not reuse created directories across toSSG runs (#5381)
bcfd02b fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary (#5430)
456fe46 fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in C...
98b35af fix(accepts): preserve exact media type quality over subtype wildcards (#5427)
b3f1272 fix(etag): preserve commas within quoted entity tags (#5353)
Additional commits viewable in compare view

Updates nuxt from 4.6.3 to 4.6.4

Release notes

Sourced from nuxt's releases.

v4.6.4

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.

Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.

workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.

Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.

Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

nitro,nuxt: require unrouting 0.3.2 (768d21368)

nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)

nitro: require nitropack 2.13.6 (1b13c6981)

nitro: keep leading double slash in renderer request path (75c12c6fb)

nuxt: use unambiguous encoding for island hash (6f1b93c64)

vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)

nuxt: do not expose details of untrusted thrown errors (8c56b71e4)

nuxt: strip trailing slashes in linear time (97424dd21)

nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)

webpack: skip hot middleware for forbidden dev requests (3c9645326)

rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)

schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)

nitro,nuxt: match route rules for paths with encoded slashes (084396b10)

schema: only widen workspace dir to a declared workspace root (89d3306d1)

nitro: only trust x-forwarded-proto in when opted-in (#36818)

nitro: stream the body read through a nuxt/server handler (#36817)

kit: suggest the specific fix when loading falls back to jiti (24d75659d)

vite: use a single type checker (#36774)

nitro,vite: remove windows + virtual dev ssr css links after hydration (#36765)

nitro,vite: dedupe dev css by module node (#36420)

nuxt: avoid hoisting setup-only values from definePageMeta (#36751)

nuxt: only match hydration modifiers after lazy prefix (#36750)

kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#36747)

nuxt: render inlined component styles after stylesheet links (#36714)

webpack: use valid devtool for hidden client sourcemaps in dev (#36555)

📖 Documentation

clarify template dependency regeneration (#36766)

revise README structure and headings (#36772)

link the Nuxt DevTools docs on nuxt.com (#36769)

... (truncated)

Commits

b9a6b68 v4.6.4 (#36823)
6f1b93c fix(nuxt): use unambiguous encoding for island hash
8c56b71 fix(nuxt): do not expose details of untrusted thrown errors
97424dd fix(nuxt): strip trailing slashes in linear time
084396b fix(nitro,nuxt): match route rules for paths with encoded slashes
Description has been truncated

…11 updates Bumps the all-dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tsrs](https://github.com/oxc-project/tsrs) | `0.20.1-ts7.1.0-beta` | `0.21.0-ts7.1.0-beta` | | [@opentelemetry/exporter-logs-otlp-proto](https://github.com/open-telemetry/opentelemetry-js) | `0.300.0` | `0.301.0` | | [@opentelemetry/exporter-trace-otlp-proto](https://github.com/open-telemetry/opentelemetry-js) | `0.300.0` | `0.301.0` | | [@opentelemetry/sdk-logs](https://github.com/open-telemetry/opentelemetry-js) | `3.0.0` | `3.1.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.300.0` | `0.301.0` | | [@opentelemetry/sdk-trace](https://github.com/open-telemetry/opentelemetry-js) | `3.0.0` | `3.1.0` | | [hono](https://github.com/honojs/hono) | `4.13.16` | `4.13.17` | | [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `4.6.3` | `4.6.4` | | [vue](https://github.com/vuejs/core) | `3.5.44` | `3.5.45` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.5` | | [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.13` | `3.3.14` | Updates `tsrs` from 0.20.1-ts7.1.0-beta to 0.21.0-ts7.1.0-beta - [Release notes](https://github.com/oxc-project/tsrs/releases) - [Commits](https://github.com/oxc-project/tsrs/commits) Updates `@opentelemetry/exporter-logs-otlp-proto` from 0.300.0 to 0.301.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.300.0...experimental/v0.301.0) Updates `@opentelemetry/exporter-trace-otlp-proto` from 0.300.0 to 0.301.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.300.0...experimental/v0.301.0) Updates `@opentelemetry/sdk-logs` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v3.0.0...v3.1.0) Updates `@opentelemetry/sdk-node` from 0.300.0 to 0.301.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.300.0...experimental/v0.301.0) Updates `@opentelemetry/sdk-trace` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v3.0.0...v3.1.0) Updates `hono` from 4.13.16 to 4.13.17 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.16...v4.13.17) Updates `nuxt` from 4.6.3 to 4.6.4 - [Release notes](https://github.com/nuxt/nuxt/releases) - [Commits](https://github.com/nuxt/nuxt/commits/v4.6.4/packages/nuxt) Updates `vue` from 3.5.44 to 3.5.45 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.44...v3.5.45) Updates `tailwindcss` from 4.3.3 to 4.3.5 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss) Updates `vue-tsc` from 3.3.13 to 3.3.14 - [Release notes](https://github.com/vuejs/language-tools/releases) - [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md) - [Commits](https://github.com/vuejs/language-tools/commits/v3.3.14/packages/tsc) --- updated-dependencies: - dependency-name: tsrs dependency-version: 0.21.0-ts7.1.0-beta dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@opentelemetry/exporter-logs-otlp-proto" dependency-version: 0.301.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-proto" dependency-version: 0.301.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@opentelemetry/sdk-logs" dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.301.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@opentelemetry/sdk-trace" dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: hono dependency-version: 4.13.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: nuxt dependency-version: 4.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: vue dependency-version: 3.5.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: tailwindcss dependency-version: 4.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: vue-tsc dependency-version: 3.3.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

greptile-apps · 2026-11-10T15:06:43Z

PR author is in the excluded authors list.

github-actions · 2026-11-10T15:08:34Z

🐳 Docker images published

This PR has been built and pushed to GHCR:

ghcr.io/roziscoding/jack:pr-106        # backend
ghcr.io/roziscoding/jack-ui:pr-106     # management UI

Pull them locally:

docker pull ghcr.io/roziscoding/jack:pr-106
docker pull ghcr.io/roziscoding/jack-ui:pr-106

Run the backend standalone:

docker run --rm ghcr.io/roziscoding/jack:pr-106

The UI needs the backend + a management key, so run the two together with examples/docker-compose.yml, overriding the image tags to pr-106.

Last built from commit 362d914. Heads up: these images are automatically deleted when the PR is closed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 10, 2026

Navigation Menu

Repository navigation

chore(deps): bump the all-dependencies group across 1 directory with 11 updates - #106

chore(deps): bump the all-dependencies group across 1 directory with 11 updates#106
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/all-dependencies-b20e233e52

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

greptile-apps Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 10, 2026

0.20.1

experimental/v0.301.0

0.301.0

💥 Breaking Changes

🐛 Bug Fixes

📚 Documentation

experimental/v0.301.0

0.301.0

💥 Breaking Changes

🐛 Bug Fixes

📚 Documentation

v3.1.0

3.1.0

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

3.1.0

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.301.0

0.301.0

💥 Breaking Changes

🐛 Bug Fixes

📚 Documentation

v3.1.0

3.1.0

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

3.1.0

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

v4.13.17

What's Changed

v4.6.4

⚠️ Behaviour changes

👉 Changelog

🩹 Fixes

📖 Documentation

Uh oh!

greptile-apps Bot commented Nov 10, 2026

Uh oh!

github-actions Bot commented Nov 10, 2026

🐳 Docker images published

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants