deps: bump the non-breaking group across 1 directory with 3 updates

[dependabot]

Bumps the non-breaking group with 3 updates in the / directory: @hono/node-server, hono and @biomejs/biome.

Updates @hono/node-server from 2.0.8 to 2.0.10

Release notes

Sourced from @​hono/node-server's releases.

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in honojs/node-server#371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in honojs/node-server#372
• fix: recover complete request bodies after client disconnect by @​usualoma in honojs/node-server#375

New Contributors

• @​otnc made their first contribution in honojs/node-server#371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

Commits

• 7c1457e 2.0.10
• 3a21938 Merge commit from fork
• 9842021 2.0.9
• 51f3bf5 fix: recover complete request bodies after client disconnect (#375)
• fdb87ba fix(serve-static): correct Range header parsing edge cases (#372)
• 912e3fd fix(websocket): polyfill missing ErrorEvent global (#371)
• See full diff in compare view

Updates hono from 4.12.30 to 4.12.31

Release notes

Sourced from hono's releases.

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130
• fix(utils/body): reuse cached formData in parseBody() by @​yusukebe in honojs/hono#5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @​yusukebe in honojs/hono#5133
• fix(sse): emit retry feild when retry is 0 by @​yusukebe in honojs/hono#5135
• test(validator): fix misspelled identifier in transform type test by @​yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

Commits

• cadff88 4.12.31
• 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
• aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
• d796450 fix(request): fix multipart boundary mismatch in cloneRawRequest (#5133)
• 80959d4 fix(utils/body): reuse cached formData in parseBody() (#5131)
• 21b44b6 refactor(aws-lambada): remove FIXME in @ts-expect-error (#5130)
• 5f73897 docs(combine): close quote in combine JSDoc example (#5126)
• c285f9a chore(benchmark): add app.fetch() overhead benchmark (#5117)
• fb9d7bf test(context): assert case-insensitive header names in response helpers (#5116)
• See full diff in compare view

Updates @biomejs/biome from 2.5.3 to 2.5.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.4

2.5.4

Patch Changes

• #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
  -   expect(a).toBe(b);
  - });
  + test.each([[1, 2]])(
  +   "a description that is long enough to push the hugged opening line beyond the print width",
  +   (a, b) => {
  +     expect(a).toBe(b);
  +   },
  + );

• #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

What's Changed

• feat(yml/fmt): basic block properties by @​ematipico in biomejs/biome#10873
• feat(useSortedClasses): sort important-suffix classes in sort_v4 by @​johncarmack1984 in biomejs/biome#10880
• fix(format/js): wrap curried test each calls by @​dyc3 in biomejs/biome#10886
• fix(markdown): parse whitespace after list markers by @​tidefield in biomejs/biome#10869
• fix(inference): use correct function when cloning data by @​ematipico in biomejs/biome#10891
• docs(noDuplicateProperties): note that @​keyframes declarations are ignored by @​dfedoryshchev in biomejs/biome#10893
• fix(lint): prevent noCommentText fix from looping forever by @​JamBalaya56562 in biomejs/biome#10842
• fix(core): cleanup old sockets in Unix by @​ematipico in biomejs/biome#10895
• feat(inference): inference engine via salsa by @​ematipico in biomejs/biome#10888
• chore(deps): update dependency @​types/node to v24.13.3 by @​renovate[bot] in biomejs/biome#10920
• chore(deps): update github-actions by @​renovate[bot] in biomejs/biome#10921

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.4

Patch Changes

• #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
  -   expect(a).toBe(b);
  - });
  + test.each([[1, 2]])(
  +   "a description that is long enough to push the hugged opening line beyond the print width",
  +   (a, b) => {
  +     expect(a).toBe(b);
  +   },
  + );

• #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

Commits

• bfc3f3d ci: release (#10887)
• See full diff in compare view

[UltimaPhoenix]

@dependabot rebase