chore(deps): bump the minor group with 19 updates by dependabot[bot] · Pull Request #2160 · agentclientprotocol/agent-client-protocol

dependabot · 2026-09-14T14:12:22Z

Bumps the minor group with 19 updates:

Package	From	To
mint	`4.2.873`	`4.2.887`
@mintlify/cli	`4.0.1476`	`4.0.1490`
@mintlify/common	`1.0.1129`	`1.0.1141`
react-dom	`19.2.8`	`19.3.0`
@mintlify/link-rot	`3.0.1331`	`3.0.1343`
@mintlify/models	`0.0.351`	`0.0.355`
@mintlify/prebuild	`1.0.1283`	`1.0.1295`
@mintlify/previewing	`4.0.1355`	`4.0.1367`
@mintlify/scraping	`4.0.997`	`4.0.1009`
@mintlify/validation	`0.1.846`	`0.1.852`
body-parser	`1.20.6`	`1.20.8`
@types/node	`26.4.1`	`26.5.1`
@types/react	`19.2.18`	`19.3.0`
hono	`4.13.5`	`4.13.7`
jose	`6.2.11`	`6.2.12`
nanoid	`3.3.18`	`3.3.19`
oauth4webapi	`3.8.7`	`3.8.8`
undici-types	`8.3.0`	`8.9.0`
use-sync-external-store	`1.6.0`	`1.7.0`

Updates mint from 4.2.873 to 4.2.887

Commits

See full diff in compare view

Updates @mintlify/cli from 4.0.1476 to 4.0.1490

Commits

See full diff in compare view

Updates @mintlify/common from 1.0.1129 to 1.0.1141

Commits

See full diff in compare view

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

f4e439e [Fizz] Add nonce to rendered import maps (#37339)
21c89c9 [DOM] Clean up Fragment listeners on signal abort (#37457)
065bc84 [DOM] Unobserve fragment IntersectionObserver targets after exit (#37408)
ff7445e [DOM] Update HTML parser rules for new select parser (#34804)
2dc7da7 [test] Bump Jest to 30.4 (#37382)
29d9d31 [DOM] Copy source onto the synthetic toggle event (#37389)
269bd40 [test] Remove the custom toThrow override for legacy V8 error messages (#37...
a112448 [DOM] Treat omitted Fragment Event listener options same as capture: false ...
3d05080 [Fizz] Construct the render lifetime controller only when it is needed (#37357)
77ed3f5 [Flight/Fizz] Stop the caller's signal from retaining a finished render (#37315)
Additional commits viewable in compare view

Updates @mintlify/link-rot from 3.0.1331 to 3.0.1343

Commits

See full diff in compare view

Updates @mintlify/models from 0.0.351 to 0.0.355

Commits

See full diff in compare view

Updates @mintlify/prebuild from 1.0.1283 to 1.0.1295

Commits

See full diff in compare view

Updates @mintlify/previewing from 4.0.1355 to 4.0.1367

Commits

See full diff in compare view

Updates @mintlify/scraping from 4.0.997 to 4.0.1009

Commits

See full diff in compare view

Updates @mintlify/validation from 0.1.846 to 0.1.852

Commits

See full diff in compare view

Updates body-parser from 1.20.6 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

ci: backport npm-publish workflow from master by @UlisesGascon in expressjs/body-parser#769

1.20.8 by @UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

docs: include security fix in 1.20.6 changes by @UlisesGascon in expressjs/body-parser#747

deps: qs@~6.16.0 by @krzysdz in expressjs/body-parser#761

1.20.7 by @UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

Changelog

Sourced from body-parser's changelog.

1.20.8

Same code base as 1.20.7. This was created to test the new release process.

1.20.7

deps: qs@~6.16.0

Commits

5c08c20 1.20.8 (#770)
0cea4f4 ci: backport npm-publish workflow from master (#769)
0f0f0d7 1.20.7 (#767)
355eb04 deps: qs@~6.16.0 (#761)
8be369a docs: include security fix in 1.20.6 changes
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates @types/node from 26.4.1 to 26.5.1

Commits

See full diff in compare view

Updates @types/react from 19.2.18 to 19.3.0

Commits

See full diff in compare view

Updates hono from 4.13.5 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

eebdf7b 4.13.7
2b8ed40 Merge commit from fork
cac0c4d 4.13.6
dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
ec648d6 chore: bump editorconfig-checker (#5336)
e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
499c35e fix(client): normalize root WebSocket URLs (#5291)
50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
See full diff in compare view

Updates jose from 6.2.11 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

Commits

505a55b chore(release): 6.2.12
7bc9a33 perf: encode single-signature JWS input once
78637bd perf: normalize General JWE shared headers once
bf5138b perf: deduplicate pending jwks key imports
b23a6f3 perf: use native encoding for larger ASCII strings
fd3ae3f perf: normalize jwks selection metadata once
6925d43 perf: avoid copying AES-GCM output
be62530 docs: clarify and shorten public API guidance
1b41312 build: preserve README when generation fails
0b51829 build: check tree-shaking for every public binding
Additional commits viewable in compare view

Updates nanoid from 3.3.18 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

Fixed killing the app by setting huge user ID.

Changelog

Sourced from nanoid's changelog.

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

Commits

eb63bd6 Release 3.3.19 version
9067e03 Sync CJS and ESM
See full diff in compare view

Updates oauth4webapi from 3.8.7 to 3.8.8

Release notes

Sourced from oauth4webapi's releases.

v3.8.8

Fixes

accept space runs in Bearer and DPoP credentials (3414db5)

decode HTTP authentication quoted pairs correctly (bd7fcb0)

forward arguments to AVA test runners (b898ba5)

honor explicit auth-time skips in authorization responses (656d762)

recognize DPoP nonce errors among multiple challenges (70bd8a1)

release: separate changelog sections (a827c39)

validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

consolidate ID Token validation policy (53900cc)

Performance

cache imported issuer verification keys by algorithm (fbe6c02)

coalesce compatible in-flight JWKS requests (e64849e)

Changelog

Sourced from oauth4webapi's changelog.

3.8.8 (2026-09-05)

Fixes

accept space runs in Bearer and DPoP credentials (3414db5)

decode HTTP authentication quoted pairs correctly (bd7fcb0)

forward arguments to AVA test runners (b898ba5)

honor explicit auth-time skips in authorization responses (656d762)

recognize DPoP nonce errors among multiple challenges (70bd8a1)

release: separate changelog sections (a827c39)

validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

consolidate ID Token validation policy (53900cc)

Performance

cache imported issuer verification keys by algorithm (fbe6c02)

coalesce compatible in-flight JWKS requests (e64849e)

Commits

916b979 chore(release): 3.8.8
eb564a4 test: accept WebCrypto DOMException rejections on Node 20
fbe6c02 perf: cache imported issuer verification keys by algorithm
e64849e perf: coalesce compatible in-flight JWKS requests
53900cc refactor: consolidate ID Token validation policy
edbebeb fix: validate ID Token subjects and DPoP identifiers as strings
bd7fcb0 fix: decode HTTP authentication quoted pairs correctly
3414db5 fix: accept space runs in Bearer and DPoP credentials
656d762 fix: honor explicit auth-time skips in authorization responses
b898ba5 fix: forward arguments to AVA test runners
Additional commits viewable in compare view

Updates undici-types from 8.3.0 to 8.9.0

Release notes

Sourced from undici-types's releases.

v8.9.0

⚠️ Security fixes

High severity

GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.

GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Description has been truncated

Bumps the minor group with 19 updates: | Package | From | To | | --- | --- | --- | | [mint](https://github.com/mintlify/mint/tree/HEAD/packages/mint) | `4.2.873` | `4.2.887` | | [@mintlify/cli](https://github.com/mintlify/mint/tree/HEAD/packages/cli) | `4.0.1476` | `4.0.1490` | | [@mintlify/common](https://github.com/mintlify/mint/tree/HEAD/packages/common) | `1.0.1129` | `1.0.1141` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@mintlify/link-rot](https://github.com/mintlify/mint/tree/HEAD/packages/link-rot) | `3.0.1331` | `3.0.1343` | | [@mintlify/models](https://github.com/mintlify/mint/tree/HEAD/packages/models) | `0.0.351` | `0.0.355` | | [@mintlify/prebuild](https://github.com/mintlify/mint/tree/HEAD/packages/prebuild) | `1.0.1283` | `1.0.1295` | | [@mintlify/previewing](https://github.com/mintlify/mint/tree/HEAD/packages/previewing) | `4.0.1355` | `4.0.1367` | | [@mintlify/scraping](https://github.com/mintlify/mint/tree/HEAD/packages/scraping) | `4.0.997` | `4.0.1009` | | [@mintlify/validation](https://github.com/mintlify/mint/tree/HEAD/packages/validation) | `0.1.846` | `0.1.852` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.6` | `1.20.8` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.5.1` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` | | [jose](https://github.com/panva/jose) | `6.2.11` | `6.2.12` | | [nanoid](https://github.com/ai/nanoid) | `3.3.18` | `3.3.19` | | [oauth4webapi](https://github.com/panva/oauth4webapi) | `3.8.7` | `3.8.8` | | [undici-types](https://github.com/nodejs/undici) | `8.3.0` | `8.9.0` | | [use-sync-external-store](https://github.com/react/react/tree/HEAD/packages/use-sync-external-store) | `1.6.0` | `1.7.0` | Updates `mint` from 4.2.873 to 4.2.887 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/mint) Updates `@mintlify/cli` from 4.0.1476 to 4.0.1490 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/cli) Updates `@mintlify/common` from 1.0.1129 to 1.0.1141 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/common) Updates `react-dom` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@mintlify/link-rot` from 3.0.1331 to 3.0.1343 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/link-rot) Updates `@mintlify/models` from 0.0.351 to 0.0.355 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/models) Updates `@mintlify/prebuild` from 1.0.1283 to 1.0.1295 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/prebuild) Updates `@mintlify/previewing` from 4.0.1355 to 4.0.1367 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/previewing) Updates `@mintlify/scraping` from 4.0.997 to 4.0.1009 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/scraping) Updates `@mintlify/validation` from 0.1.846 to 0.1.852 - [Commits](https://github.com/mintlify/mint/commits/HEAD/packages/validation) Updates `body-parser` from 1.20.6 to 1.20.8 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md) - [Commits](expressjs/body-parser@1.20.6...1.20.8) Updates `@types/node` from 26.4.1 to 26.5.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `hono` from 4.13.5 to 4.13.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.5...v4.13.7) Updates `jose` from 6.2.11 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.11...v6.2.12) Updates `nanoid` from 3.3.18 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.18...3.3.19) Updates `oauth4webapi` from 3.8.7 to 3.8.8 - [Release notes](https://github.com/panva/oauth4webapi/releases) - [Changelog](https://github.com/panva/oauth4webapi/blob/main/CHANGELOG.md) - [Commits](panva/oauth4webapi@v3.8.7...v3.8.8) Updates `undici-types` from 8.3.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.3.0...v8.9.0) Updates `use-sync-external-store` from 1.6.0 to 1.7.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/HEAD/packages/use-sync-external-store) --- updated-dependencies: - dependency-name: mint dependency-version: 4.2.887 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@mintlify/cli" dependency-version: 4.0.1490 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@mintlify/common" dependency-version: 1.0.1141 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@mintlify/link-rot" dependency-version: 3.0.1343 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@mintlify/models" dependency-version: 0.0.355 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@mintlify/prebuild" dependency-version: 1.0.1295 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@mintlify/previewing" dependency-version: 4.0.1367 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@mintlify/scraping" dependency-version: 4.0.1009 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@mintlify/validation" dependency-version: 0.1.852 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: body-parser dependency-version: 1.20.8 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@types/node" dependency-version: 26.5.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor - dependency-name: hono dependency-version: 4.13.7 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: jose dependency-version: 6.2.12 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: oauth4webapi dependency-version: 3.8.8 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: undici-types dependency-version: 8.9.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor - dependency-name: use-sync-external-store dependency-version: 1.7.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026

dependabot Bot requested a review from a team as a code owner September 14, 2026 14:12

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026

benbrandt enabled auto-merge (squash) September 14, 2026 14:16

benbrandt merged commit b267137 into main Sep 14, 2026
6 checks passed

benbrandt deleted the dependabot/npm_and_yarn/minor-0b2469023b branch September 14, 2026 14:16

Navigation Menu

Uh oh!

chore(deps): bump the minor group with 19 updates - #2160

chore(deps): bump the minor group with 19 updates#2160
benbrandt merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-0b2469023b

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

1.20.8

Important

What's Changed

1.20.7

What's Changed

1.20.8

1.20.7

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v6.2.12

Documentation

Refactor

Performance

6.2.12 (2026-09-05)

Documentation

Refactor

Performance

3.3.19

3.3.19

v3.8.8

Fixes

Refactor

Performance

3.8.8 (2026-09-05)

Fixes

Refactor

Performance

v8.9.0

⚠️ Security fixes

High severity

Medium severity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS