build(deps): bump the dependencies group with 27 updates by dependabot[bot] · Pull Request #12 · realmroot/wallet

dependabot · 2026-09-01T21:29:56Z

Bumps the dependencies group with 27 updates:

Package	From	To
@coinbase/cdp-hooks	`0.0.120`	`0.0.123`
@coinbase/cdp-react	`0.0.120`	`0.0.123`
@hono/node-server	`2.1.0`	`2.1.1`
@hono/zod-openapi	`1.5.1`	`1.6.1`
@hookform/resolvers	`5.7.1`	`5.9.1`
@solana/kit	`7.0.0`	`8.2.0`
@tanstack/react-query	`5.101.4`	`5.102.8`
@x402/core	`2.20.0`	`2.24.0`
@x402/evm	`2.20.0`	`2.24.0`
@x402/hono	`2.20.0`	`2.24.0`
@x402/svm	`2.20.0`	`2.24.0`
hono	`4.13.0`	`4.13.5`
jose	`6.2.8`	`6.2.10`
lucide-react	`1.28.0`	`1.37.0`
oauth4webapi	`3.8.6`	`3.8.7`
react-hook-form	`7.84.0`	`7.86.0`
viem	`2.55.10`	`2.56.0`
zod	`4.4.3`	`4.5.4`
@cloudflare/vite-plugin	`1.50.0`	`1.54.2`
@cloudflare/vitest-pool-workers	`0.20.1`	`0.22.0`
@cloudflare/workers-types	`5.20260804.1`	`5.20260829.1`
@types/react-dom	`19.2.4`	`19.2.5`
@vitejs/plugin-react	`6.0.5`	`6.1.1`
smol-toml	`1.7.1`	`1.8.0`
vite	`8.2.0`	`8.2.2`
vitest	`4.1.10`	`4.1.11`
wrangler	`4.118.0`	`4.127.1`

Updates @coinbase/cdp-hooks from 0.0.120 to 0.0.123

Updates @coinbase/cdp-react from 0.0.120 to 0.0.123

Updates @hono/node-server from 2.1.0 to 2.1.1

Release notes

Sourced from @hono/node-server's releases.

v2.1.1

What's Changed

perf: lazily materialize request headers by @BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

Commits

73c03ad 2.1.1
5515aa0 perf: lazily materialize request headers (#389)
See full diff in compare view

Updates @hono/zod-openapi from 1.5.1 to 1.6.1

Release notes

Sourced from @hono/zod-openapi's releases.

@hono/zod-openapi@1.6.1

Patch Changes

#1988 4fce28c6fbba41795b316becaf7d8cffa11fb521 Thanks @thekiwi! - Reduce route-typing type instantiations (~54% on TS6, ~48% on TS7 in a 100-route benchmark) by binding expensive sub-expressions once and sharing the input intersection / response-shape conditional.

@hono/zod-openapi@1.6.0

Minor Changes

#2086 1dc1a4a5418be24d571652e1013b8a6a925824c0 Thanks @WolfieLeader! - feat: support the HTTP QUERY method in createRoute() by bumping @asteasolutions/zod-to-openapi to v9

@hono/zod-openapi@1.5.3

Patch Changes

#2084 9a9324937cfa77db210a966be33e8c73bbbe33e3 Thanks @kamaal111! - Revert the local z binding export because it causes zod types to degrade to any when built with tsdown.

@hono/zod-openapi@1.5.2

Patch Changes

#2069 fc0377c5595bde3147d181e5013a3fc710175e40 Thanks @edenbuilds! - fix(zod-openapi): keep the z import edge so .openapi() survives bundling

Re-exporting zod's z as a pass-through let esbuild code-splitting resolve import { z } from '@hono/zod-openapi' straight to zod and drop the edge to the module that runs extendZodWithOpenApi(z), so schemas could be built before the patch applied and .openapi() was undefined at runtime. Export z as an alias declaration instead: it compiles to a binding local to the module, which keeps that edge, while still carrying zod's type namespace so z.infer, z.ZodType and the rest continue to work. Fixes #2051.

Changelog

Sourced from @hono/zod-openapi's changelog.

1.6.1

Patch Changes

#1988 4fce28c6fbba41795b316becaf7d8cffa11fb521 Thanks @thekiwi! - Reduce route-typing type instantiations (~54% on TS6, ~48% on TS7 in a 100-route benchmark) by binding expensive sub-expressions once and sharing the input intersection / response-shape conditional.

1.6.0

Minor Changes

#2086 1dc1a4a5418be24d571652e1013b8a6a925824c0 Thanks @WolfieLeader! - feat: support the HTTP QUERY method in createRoute() by bumping @asteasolutions/zod-to-openapi to v9

1.5.3

Patch Changes

#2084 9a9324937cfa77db210a966be33e8c73bbbe33e3 Thanks @kamaal111! - Revert the local z binding export because it causes zod types to degrade to any when built with tsdown.

1.5.2

Patch Changes

#2069 fc0377c5595bde3147d181e5013a3fc710175e40 Thanks @edenbuilds! - fix(zod-openapi): keep the z import edge so .openapi() survives bundling

Re-exporting zod's z as a pass-through let esbuild code-splitting resolve import { z } from '@hono/zod-openapi' straight to zod and drop the edge to the module that runs extendZodWithOpenApi(z), so schemas could be built before the patch applied and .openapi() was undefined at runtime. Export z as an alias declaration instead: it compiles to a binding local to the module, which keeps that edge, while still carrying zod's type namespace so z.infer, z.ZodType and the rest continue to work. Fixes #2051.

Commits

fdad95a Version Packages (#2101)
4fce28c fix(zod-openapi): reduce route type instantiations (#1988)
eb5f75d Version Packages (#2088)
1dc1a4a feat(zod-openapi): support the HTTP QUERY method (#2086)
3aebc4e Version Packages (#2085)
9a93249 revert(zod-openapi): export local z binding (#2084)
265bcf1 Version Packages (#2077)
fc0377c fix(zod-openapi): export local z binding so OpenAPI patch is not tree-shaken ...
40f956e chore(dev-deps): partial upgrade to TypeScript 7 (#2048)
See full diff in compare view

Updates @hookform/resolvers from 5.7.1 to 5.9.1

Release notes

Sourced from @hookform/resolvers's releases.

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

isNameInFieldArray fails to recognise bracket-notation array paths causing nested errors overwriting (#876) (f18ddfb)

v5.9.0

5.9.0 (2026-08-15)

Features

update joi to v18 (#873) (c8159ae)

v5.8.0

5.8.0 (2026-08-13)

Features

support Vest 6 (a5100ab)

Commits

f18ddfb fix: isNameInFieldArray fails to recognise bracket-notation array paths causi...
c8159ae feat: update joi to v18 (#873)
a5100ab feat: support Vest 6
28ec539 fix(vest)!: support Vest 6 (#874)
See full diff in compare view

Updates @solana/kit from 7.0.0 to 8.2.0

Release notes

Sourced from @solana/kit's releases.

v8.2.0

@solana/kit

v8.2.0 (2026-08-29)

Minor Changes

[@solana/instruction-plans] #2013 26edd3b Thanks @mcintyre94! - Align createTransactionPlanExecutorWithConcurrentLeaves with createTransactionPlanExecutor by giving both the same TransactionPlanExecutorConfig. Its executeTransactionMessage callback now receives a mutable per-leaf context object and returns the context of a successful result, instead of building a whole SingleTransactionPlanResult itself. The executor builds the results: on success it merges the returned context over the stored one, and when the callback throws — or the abort signal fires before it settles — it preserves the stored context on the failed result, matching the partial-context behaviour of createTransactionPlanExecutor. The ConcurrentLeafTransactionPlanExecutorConfig type is removed. This is a breaking change to the createTransactionPlanExecutorWithConcurrentLeaves API introduced in 8.1.0.

Patch Changes

[@solana/signers] #2006 d385ce3 Thanks @amilz! - Relaxed the parameter type of the signer type guards (isMessagePartialSigner, isTransactionSigner, isKeyPairSigner, their siblings, and the assertIs* variants) so that class instances implementing a signer interface can be passed without casts. The guards now accept any TValue extends { address: Address } and narrow to TValue & Signer, whereas the previous parameter type required an implicit index signature, which TypeScript never grants to class instances.

v8.1.0

@solana/kit

v8.1.0 (2026-08-27)

Minor Changes

[@solana/errors, @solana/transaction-messages] #1972 7d56e29 Thanks @skyyycodes! - Validate compute unit limit and heap size when they are set on a transaction message

setTransactionMessageComputeUnitLimit, setTransactionMessageHeapSize and setTransactionMessageConfig now reject values the runtime will not honor as written, throwing SOLANA_ERROR__TRANSACTION__COMPUTE_UNIT_LIMIT_OUT_OF_RANGE or SOLANA_ERROR__TRANSACTION__INVALID_HEAP_SIZE at the point the value is set. An invalid heap size fails the transaction on-chain; a compute unit limit above the maximum is instead clamped down by the runtime, so the transaction quietly runs with a budget other than the one requested. A compute unit limit must be an integer in the range [0, 1,400,000]; a heap size must be an integer multiple of 1 KiB between 32 KiB and 256 KiB inclusive.

Decoding is unaffected: decompileTransactionMessage still returns messages carrying out-of-range values so that callers can inspect any transaction that reaches them.

[@solana/instruction-plans] #1995 95a2788 Thanks @mcintyre94! - Add createTransactionPlanExecutorWithConcurrentLeaves to concurrently transform every transaction plan leaf while preserving the plan's result shape.

Patch Changes

[@solana/codecs-core] #1970 be30e32 Thanks @koriyoshi2041! - Fix toArrayBuffer slicing SharedArrayBuffer-backed views from a non-zero byte offset.

[@solana/codecs-data-structures] #1971 c51b9f6 Thanks @shin4141! - Preserve the literal fixedSize type for single-field fixed-size struct codecs.

[@solana/codecs-strings] #1979 6852054 Thanks @amilz! - Fixed getBase64Decoder() throwing RangeError: Maximum call stack size exceeded in browser builds when decoding byte arrays larger than roughly 65KB. The bytes are now converted to a binary string in chunks rather than spread into a single String.fromCharCode call.

[@solana/rpc, @solana/transaction-confirmation] #1994 490ac9e Thanks @matusbalascak! - Fix transaction confirmation and coalesced RPC request cancellation in environments where abort events have a null target.

v8.0.0

@solana/kit

v8.0.0 (2026-08-21)

Major Changes
[@solana/instruction-plans] #1913 80368eb Thanks @mcintyre94! - Stop writing to the execution context in createTransactionPlanExecutor

The executeTransactionMessage callback can no longer return a Signature or a Transaction. Those return values were deprecated when the callback gained the ability to return the context that a successful result should carry, and they are now gone: that context, a complete TContext, is the only thing the callback returns. Nothing is written to it on your behalf.

... (truncated)

Commits

b0a9749 Version Packages (#2015)
d385ce3 fix: accept class-based signers in @solana/signers type guards (#2006)
26edd3b Unify the concurrent leaf executor's callback contract with `createTransactio...
ceba283 Bump start-server-and-test from 3.0.11 to 3.0.12 (#2009)
d04c874 Also run preview-docs in the merge queue (#2008)
fc32b73 Bump @tanstack/react-query from 5.101.4 to 5.102.3 in /docs (#2011)
584422f Update docs CI so that it can be required (#2003)
bb54243 Version Packages (#1980)
7d56e29 validate compute unit limit and heap size in transaction messages (#1972)
c51b9f6 Preserve fixedSize for single-field struct codecs (#1971)
Additional commits viewable in compare view

Updates @tanstack/react-query from 5.101.4 to 5.102.8

Release notes

Sourced from @tanstack/react-query's releases.

@tanstack/react-query-devtools@5.102.8

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.102.8

@tanstack/react-query@5.102.8

@tanstack/react-query-next-experimental@5.102.8

Patch Changes

Updated dependencies []:

@tanstack/react-query@5.102.8

@tanstack/react-query-persist-client@5.102.8

Patch Changes

Updated dependencies []:

@tanstack/query-persist-client-core@5.102.8

@tanstack/react-query@5.102.8

@tanstack/react-query@5.102.8

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.102.8

@tanstack/react-query-devtools@5.102.7

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.102.7

@tanstack/react-query@5.102.7

@tanstack/react-query-next-experimental@5.102.7

Patch Changes

Updated dependencies []:

@tanstack/react-query@5.102.7

@tanstack/react-query-persist-client@5.102.7

Patch Changes

Updated dependencies []:

@tanstack/query-persist-client-core@5.102.7

@tanstack/react-query@5.102.7

@tanstack/react-query@5.102.7

Patch Changes

Updated dependencies []:

... (truncated)

Changelog

Sourced from @tanstack/react-query's changelog.

5.102.8

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.102.8

5.102.7

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.102.7

5.102.6

Patch Changes

#11305 ac2b612 - fix(react-query): throw falsy errors from useQueries and useSuspenseQueries to the error boundary

Updated dependencies []:

@tanstack/query-core@5.102.6

5.102.5

Patch Changes

Updated dependencies [578e5c2]:

@tanstack/query-core@5.102.5

5.102.4

Patch Changes

Updated dependencies [a05df6a]:

@tanstack/query-core@5.102.4

5.102.3

Patch Changes

Updated dependencies []:

@tanstack/query-core@5.102.3

5.102.2

Patch Changes

Updated dependencies [80fbf73]:

@tanstack/query-core@5.102.2

... (truncated)

Commits

2969edf ci: Version Packages (#11316)
2eb3c7c ci: Version Packages (#11313)
714df67 ci: Version Packages (#11306)
ac2b612 fix(react-query): propagate falsy errors to the error boundary (#11305)
1836e61 ci: Version Packages (#11303)
51f12db ci: Version Packages (#11294)
730b3aa ci: Version Packages (#11276)
388bbaf ci: Version Packages (#11265)
bc423b3 ci: Version Packages (#11261)
be1352b test(*): add adapter-level type coverage for optional undefinable mutate vari...
Additional commits viewable in compare view

Updates @x402/core from 2.20.0 to 2.24.0

Commits

b703a0e Update docs/sdk-features.md (#3286)
8ac521c chore(go): release (#3289)
d22ae96 chore: version python package (#3288)
f257584 chore: version typescript packages (#3287)
44f6b17 feat(ts/go): auth-capture client v1.1 (#3283)
8468e3a Fix SVM upto facilitator RPC configuration examples (#3277)
acaa904 fix(ts/go): refactor svm upto rpc config (#3274)
b32b564 fix: upto proxy canonical address (#3276)
ab1b418 feat(evm): add Upto-only deployment entrypoint (#3199)
b1a88ef Update docs/schemes/exact.mdx (#3272)
Additional commits viewable in compare view

Updates @x402/evm from 2.20.0 to 2.24.0

Commits

b703a0e Update docs/sdk-features.md (#3286)
8ac521c chore(go): release (#3289)
d22ae96 chore: version python package (#3288)
f257584 chore: version typescript packages (#3287)
44f6b17 feat(ts/go): auth-capture client v1.1 (#3283)
8468e3a Fix SVM upto facilitator RPC configuration examples (#3277)
acaa904 fix(ts/go): refactor svm upto rpc config (#3274)
b32b564 fix: upto proxy canonical address (#3276)
ab1b418 feat(evm): add Upto-only deployment entrypoint (#3199)
b1a88ef Update docs/schemes/exact.mdx (#3272)
Additional commits viewable in compare view

Updates @x402/hono from 2.20.0 to 2.24.0

Commits

b703a0e Update docs/sdk-features.md (#3286)
8ac521c chore(go): release (#3289)
d22ae96 chore: version python package (#3288)
f257584 chore: version typescript packages (#3287)
44f6b17 feat(ts/go): auth-capture client v1.1 (#3283)
8468e3a Fix SVM upto facilitator RPC configuration examples (#3277)
acaa904 fix(ts/go): refactor svm upto rpc config (#3274)
b32b564 fix: upto proxy canonical address (#3276)
ab1b418 feat(evm): add Upto-only deployment entrypoint (#3199)
b1a88ef Update docs/schemes/exact.mdx (#3272)
Additional commits viewable in compare view

Updates @x402/svm from 2.20.0 to 2.24.0

Commits

b703a0e Update docs/sdk-features.md (#3286)
8ac521c chore(go): release (#3289)
d22ae96 chore: version python package (#3288)
f257584 chore: version typescript packages (#3287)
44f6b17 feat(ts/go): auth-capture client v1.1 (#3283)
8468e3a Fix SVM upto facilitator RPC configuration examples (#3277)
acaa904 fix(ts/go): refactor svm upto rpc config (#3274)
b32b564 fix: upto proxy canonical address (#3276)
ab1b418 feat(evm): add Upto-only deployment entrypoint (#3199)
b1a88ef Update docs/schemes/exact.mdx (#3272)
Additional commits viewable in compare view

Updates hono from 4.13.0 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

jwks: compact remote resolver state (ef5eaf4)

jws: specialize compact processing (021abf4)

jwt: compact claim validation helpers (f390683)

jwt: consolidate replicated claim checks (7dd5591)

jwt: share producer claim state (52ba159)

key: compact JWK algorithm selection (a6b29da)

key: compact secret length parsing (cc03be8)

Bumps the dependencies group with 27 updates: | Package | From | To | | --- | --- | --- | | @coinbase/cdp-hooks | `0.0.120` | `0.0.123` | | @coinbase/cdp-react | `0.0.120` | `0.0.123` | | [@hono/node-server](https://github.com/honojs/node-server) | `2.1.0` | `2.1.1` | | [@hono/zod-openapi](https://github.com/honojs/middleware/tree/HEAD/packages/zod-openapi) | `1.5.1` | `1.6.1` | | [@hookform/resolvers](https://github.com/react-hook-form/resolvers) | `5.7.1` | `5.9.1` | | [@solana/kit](https://github.com/anza-xyz/kit) | `7.0.0` | `8.2.0` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.8` | | [@x402/core](https://github.com/x402-foundation/x402) | `2.20.0` | `2.24.0` | | [@x402/evm](https://github.com/x402-foundation/x402) | `2.20.0` | `2.24.0` | | [@x402/hono](https://github.com/x402-foundation/x402) | `2.20.0` | `2.24.0` | | [@x402/svm](https://github.com/x402-foundation/x402) | `2.20.0` | `2.24.0` | | [hono](https://github.com/honojs/hono) | `4.13.0` | `4.13.5` | | [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.10` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.37.0` | | [oauth4webapi](https://github.com/panva/oauth4webapi) | `3.8.6` | `3.8.7` | | [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.84.0` | `7.86.0` | | [viem](https://github.com/wevm/viem) | `2.55.10` | `2.56.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | | [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.50.0` | `1.54.2` | | [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.20.1` | `0.22.0` | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260804.1` | `5.20260829.1` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.1` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.8.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.118.0` | `4.127.1` | Updates `@coinbase/cdp-hooks` from 0.0.120 to 0.0.123 Updates `@coinbase/cdp-react` from 0.0.120 to 0.0.123 Updates `@hono/node-server` from 2.1.0 to 2.1.1 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.1.0...v2.1.1) Updates `@hono/zod-openapi` from 1.5.1 to 1.6.1 - [Release notes](https://github.com/honojs/middleware/releases) - [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-openapi/CHANGELOG.md) - [Commits](https://github.com/honojs/middleware/commits/@hono/zod-openapi@1.6.1/packages/zod-openapi) Updates `@hookform/resolvers` from 5.7.1 to 5.9.1 - [Release notes](https://github.com/react-hook-form/resolvers/releases) - [Commits](react-hook-form/resolvers@v5.7.1...v5.9.1) Updates `@solana/kit` from 7.0.0 to 8.2.0 - [Release notes](https://github.com/anza-xyz/kit/releases) - [Commits](anza-xyz/kit@v7.0.0...v8.2.0) Updates `@tanstack/react-query` from 5.101.4 to 5.102.8 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.8/packages/react-query) Updates `@x402/core` from 2.20.0 to 2.24.0 - [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/core@v2.20.0...npm-@x402/core@v2.24.0) Updates `@x402/evm` from 2.20.0 to 2.24.0 - [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/evm@v2.20.0...npm-@x402/evm@v2.24.0) Updates `@x402/hono` from 2.20.0 to 2.24.0 - [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/hono@v2.20.0...npm-@x402/hono@v2.24.0) Updates `@x402/svm` from 2.20.0 to 2.24.0 - [Commits](https://github.com/x402-foundation/x402/compare/npm-@x402/svm@v2.20.0...npm-@x402/svm@v2.24.0) Updates `hono` from 4.13.0 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.0...v4.13.5) Updates `jose` from 6.2.8 to 6.2.10 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.8...v6.2.10) Updates `lucide-react` from 1.28.0 to 1.37.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.37.0/packages/lucide-react) Updates `oauth4webapi` from 3.8.6 to 3.8.7 - [Release notes](https://github.com/panva/oauth4webapi/releases) - [Changelog](https://github.com/panva/oauth4webapi/blob/main/CHANGELOG.md) - [Commits](panva/oauth4webapi@v3.8.6...v3.8.7) Updates `react-hook-form` from 7.84.0 to 7.86.0 - [Release notes](https://github.com/react-hook-form/react-hook-form/releases) - [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md) - [Commits](react-hook-form/react-hook-form@v7.84.0...v7.86.0) Updates `viem` from 2.55.10 to 2.56.0 - [Release notes](https://github.com/wevm/viem/releases) - [Commits](https://github.com/wevm/viem/compare/viem@2.55.10...viem@2.56.0) Updates `zod` from 4.4.3 to 4.5.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.4) Updates `@cloudflare/vite-plugin` from 1.50.0 to 1.54.2 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.54.2/packages/vite-plugin-cloudflare) Updates `@cloudflare/vitest-pool-workers` from 0.20.1 to 0.22.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers) Updates `@cloudflare/workers-types` from 5.20260804.1 to 5.20260829.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `@types/react-dom` from 19.2.4 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react) Updates `smol-toml` from 1.7.1 to 1.8.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.7.1...v1.8.0) Updates `vite` from 8.2.0 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `wrangler` from 4.118.0 to 4.127.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.127.1/packages/wrangler) --- updated-dependencies: - dependency-name: "@coinbase/cdp-hooks" dependency-version: 0.0.123 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@coinbase/cdp-react" dependency-version: 0.0.123 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@hono/node-server" dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@hono/zod-openapi" dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@hookform/resolvers" dependency-version: 5.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@solana/kit" dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: "@tanstack/react-query" dependency-version: 5.102.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@x402/core" dependency-version: 2.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@x402/evm" dependency-version: 2.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@x402/hono" dependency-version: 2.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@x402/svm" dependency-version: 2.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: jose dependency-version: 6.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: lucide-react dependency-version: 1.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: oauth4webapi dependency-version: 3.8.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: react-hook-form dependency-version: 7.86.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: viem dependency-version: 2.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: zod dependency-version: 4.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@cloudflare/vite-plugin" dependency-version: 1.54.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.22.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20260829.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: wrangler dependency-version: 4.127.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-09-01T21:42:59Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	agent-wallet	`46414df`	Sep 01 2026, 09:30 PM

dependabot · 2026-10-01T21:31:25Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

dependabot Bot closed this Oct 1, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-a53b8c95a4 branch October 1, 2026 21:31

Navigation Menu

build(deps): bump the dependencies group with 27 updates - #12

build(deps): bump the dependencies group with 27 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-a53b8c95a4

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.1.1

What's Changed

@​hono/zod-openapi@​1.6.1

Patch Changes

@​hono/zod-openapi@​1.6.0

Minor Changes

@​hono/zod-openapi@​1.5.3

Patch Changes

@​hono/zod-openapi@​1.5.2

Patch Changes

1.6.1

Patch Changes

1.6.0

Minor Changes

1.5.3

Patch Changes

1.5.2

Patch Changes

v5.9.1

5.9.1 (2026-08-17)

Bug Fixes

v5.9.0

5.9.0 (2026-08-15)

Features

v5.8.0

5.8.0 (2026-08-13)

Features

v8.2.0

@​solana/kit

v8.2.0 (2026-08-29)

Minor Changes

Patch Changes

v8.1.0

@​solana/kit

v8.1.0 (2026-08-27)

Minor Changes

Patch Changes

v8.0.0

@​solana/kit

v8.0.0 (2026-08-21)

Major Changes

@​tanstack/react-query-devtools@​5.102.8

Patch Changes

@​tanstack/react-query-next-experimental@​5.102.8

Patch Changes

@​tanstack/react-query-persist-client@​5.102.8

Patch Changes

@​tanstack/react-query@​5.102.8

Patch Changes

@​tanstack/react-query-devtools@​5.102.7

Patch Changes

@​tanstack/react-query-next-experimental@​5.102.7

Patch Changes

@​tanstack/react-query-persist-client@​5.102.7

Patch Changes

@​tanstack/react-query@​5.102.7

Patch Changes

5.102.8

Patch Changes

5.102.7

Patch Changes

5.102.6

Patch Changes

5.102.5

Patch Changes

5.102.4

Patch Changes

5.102.3

Patch Changes

5.102.2

Patch Changes

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

`@hono/zod-openapi@1`.6.1

`@hono/zod-openapi@1`.6.0

`@hono/zod-openapi@1`.5.3

`@hono/zod-openapi@1`.5.2

`@solana/kit`

`@solana/kit`

`@solana/kit`

`@tanstack/react-query-devtools@5`.102.8

`@tanstack/react-query-next-experimental@5`.102.8

`@tanstack/react-query-persist-client@5`.102.8

`@tanstack/react-query@5`.102.8

`@tanstack/react-query-devtools@5`.102.7

`@tanstack/react-query-next-experimental@5`.102.7

`@tanstack/react-query-persist-client@5`.102.7

`@tanstack/react-query@5`.102.7

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion