build(deps): bump the npm_and_yarn group across 1 directory with 2 updates - #3007
Merged
IrynaKulakova merged 3 commits intoAug 18, 2026
Merged
Conversation
…dates Bumps the npm_and_yarn group with 2 updates in the /ui directory: [@hono/node-server](https://github.com/honojs/node-server) and [ip-address](https://github.com/beaugunderson/ip-address). Updates `@hono/node-server` from 1.19.14 to 2.0.12 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v2.0.12) Updates `ip-address` from 10.2.0 to 10.4.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.0.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.4.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
IrynaKulakova
approved these changes
Aug 18, 2026
IrynaKulakova
deleted the
dependabot/npm_and_yarn/ui/npm_and_yarn-7c2e25470e
branch
August 18, 2026 12:39
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
github-mcp-server 1.10.0 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre>## Highlights v1.10.0 is a substantial security, reliability, and compatibility release for the GitHub MCP Server. ### Safer by default - Added confirmed repository deletion with form elicitation and protected multi-round-trip state ([#3076](github/github-mcp-server#3076)). - Restricted bearer credentials to configured GitHub authorities ([#3056](github/github-mcp-server#3056)). - Enforced HTTPS for GitHub Enterprise hosts ([#3069](github/github-mcp-server#3069)). - Made invalid static `--tools` configuration fail closed ([#3050](github/github-mcp-server#3050)). - Hardened lockdown, request limits, cache isolation, URL traversal, and response sanitization ([#3109](github/github-mcp-server#3109), [#3112](github/github-mcp-server#3112), [#3113](github/github-mcp-server#3113), [#3111](github/github-mcp-server#3111), [#3108](github/github-mcp-server#3108), [#3114](github/github-mcp-server#3114), [#3110](github/github-mcp-server#3110)). ### Better GitHub Enterprise Server compatibility - `list_issues` and `search_issues` now degrade safely when issue custom-field GraphQL types are unavailable ([#3086](github/github-mcp-server#3086), [#2897](github/github-mcp-server#2897)). - `list_issues` now returns assignee logins and stable empty arrays for unassigned issues ([#3064](github/github-mcp-server#3064)). - Validation failures expose safe ruleset details when supplied by the GitHub API ([#3081](github/github-mcp-server#3081)). ### Safer repository file operations - `get_file_contents` now identifies symbolic links and clearly labels dereferenced content. - Symbolic-link writes require explicit `allow_symlink_write: true` opt-in ([#3071](github/github-mcp-server#3071)). - Fixed binary MCP resources being base64-encoded twice ([#3098](github/github-mcp-server#3098)). ### More reliable tool contracts - Corrected `add_issue_comment` input modes ([#3085](github/github-mcp-server#3085)). - `issue_write.issue_fields[].delete: false` is now a valid no-op for strict-schema clients ([#3077](github/github-mcp-server#3077)). - Zero-parameter tools accept an omitted `arguments` property while rejecting explicit `null` and malformed JSON ([#3099](github/github-mcp-server#3099)). - Notification subscription tools explicitly advertise destructive behavior ([#2936](github/github-mcp-server#2936)). - Copilot review-request denials now return actionable guidance instead of a bare 404 ([#3119](github/github-mcp-server#3119)). ### Projects, Actions, and efficiency - Added Project view lifecycle operations and visible-field configuration ([#2961](github/github-mcp-server#2961), [#2988](github/github-mcp-server#2988)). - Reduced Actions and other successful response payloads ([#3047](github/github-mcp-server#3047), [#3055](github/github-mcp-server#3055)). - Improved sanitization performance and refreshed UI/build dependencies ([#3120](github/github-mcp-server#3120), [#3100](github/github-mcp-server#3100)). ### Behavior changes to note - Unknown static `--tools` names now prevent startup. - Symbolic-link updates require explicit opt-in. - Requests cannot relax server-enforced lockdown. - Oversized HTTP request bodies are rejected early. - `add_issue_comment` performs stricter mutually exclusive mode validation. - Repository deletion requires an eligible modern MCP client, form elicitation support, and the appropriate scopes. ## What's Changed * Reduce Actions workflow list response payloads by @tommaso-moro in github/github-mcp-server#3047 * Use minimal response types for tool results by @tommaso-moro in github/github-mcp-server#3055 * Add basic project view management by @zwick in github/github-mcp-server#2961 * Add visible fields to project views by @zwick in github/github-mcp-server#2988 * fix(actions): avoid malformed response on log download failure by @SamMorrowDrums in github/github-mcp-server#3066 * fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials by @SamMorrowDrums in github/github-mcp-server#3069 * Reject unsupported subscription streams by @SamMorrowDrums in github/github-mcp-server#3073 * build(deps): bump distroless/base-debian12 from `348dac1` to `76b3162` by @dependabot[bot] in github/github-mcp-server#3088 * build(deps): bump golang from 1.25.12-alpine to 1.25.13-alpine by @dependabot[bot] in github/github-mcp-server#3087 * build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in github/github-mcp-server#3089 * build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in github/github-mcp-server#3007 * build(deps): bump docker/login-action from 4.4.0 to 4.6.0 by @dependabot[bot] in github/github-mcp-server#3005 * Add confirmed repository deletion tool by @SamMorrowDrums in github/github-mcp-server#3076 * fix(issues): validate add_issue_comment input modes by @SamMorrowDrums in github/github-mcp-server#3085 * Fix static --tools validation fallback by @Mahmoud772122777 in github/github-mcp-server#3050 * Attach GitHub token only to configured GitHub hosts by @SyedAnas01 in github/github-mcp-server#3056 * Show ruleset violation details when create_branch fails by @Hashim1999164 in github/github-mcp-server#3081 * fix(notifications): mark subscription tools destructive by @SamMorrowDrums in github/github-mcp-server#2936 * Fix binary resource blob encoding by @SamMorrowDrums in github/github-mcp-server#3098 * Return assignees from list_issues by @tgockel in github/github-mcp-server#3064 * Fix list_issues on GHES schemas without issue fields by @SamMorrowDrums in github/github-mcp-server#3086 * Fix omitted tool arguments by @SamMorrowDrums in github/github-mcp-server#3099 * Clarify symlink behavior for repository file reads and writes by @theinfosecguy in github/github-mcp-server#3071 * fix(issues): allow delete:false in issue_write issue_fields by @tgockel in github/github-mcp-server#3077 * Handle unsupported issueFieldValues enrichment in search_issues by @kerobbi in github/github-mcp-server#2897 * build(deps): clear UI dependency alerts by @SamMorrowDrums in github/github-mcp-server#3100 * fix(lockdown): harden pull_request_read get_commits handling by @SamMorrowDrums in github/github-mcp-server#3109 * fix(http): make server lockdown mode an upper bound over requests by @SamMorrowDrums in github/github-mcp-server#3112 * Centralize sanitization of untrusted GitHub response fields by @SamMorrowDrums in github/github-mcp-server#3114 * Filter invisible Unicode after HTML entity normalization by @SamMorrowDrums in github/github-mcp-server#3110 * fix(raw): reject traversal segments when constructing raw content URLs by @SamMorrowDrums in github/github-mcp-server#3108 * refactor: condense lockdown comments in GetPullRequestCommits by @SamMorrowDrums in github/github-mcp-server#3115 * Limit HTTP request bodies before MCP middleware parsing by @SamMorrowDrums in github/github-mcp-server#3111 * fix(lockdown): isolate repo-access cache per caller identity by @SamMorrowDrums in github/github-mcp-server#3113 * perf(sanitize): make clean text allocation-free on the hot path by @SamMorrowDrums in github/github-mcp-server#3120 * test(sanitize): drop the optimization scaffolding by @SamMorrowDrums in github/github-mcp-server#3121 * fix(copilot): explain review request denials instead of forwarding a bare 404 by @dylanpulver in github/github-mcp-server#3119 * build(deps): bump the npm_and_yarn group across 1 directory with 4 updates by @dependabot[bot] in github/github-mcp-server#3091 ## New Contributors * @Mahmoud772122777 made their first contribution in github/github-mcp-server#3050 * @SyedAnas01 made their first contribution in github/github-mcp-server#3056 * @Hashim1999164 made their first contribution in github/github-mcp-server#3081 * @tgockel made their first contribution in github/github-mcp-server#3064 * @theinfosecguy made their first contribution in github/github-mcp-server#3071 * @dylanpulver made their first contribution in github/github-mcp-server#3119 **Full Changelog**: https://github.com/github/github-mcp- See merge request: Harmonybrew/homebrew-core!17166
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 2 updates in the /ui directory: @hono/node-server and ip-address.
Updates
@hono/node-serverfrom 1.19.14 to 2.0.12Release notes
Sourced from @hono/node-server's releases.
... (truncated)
Commits
a813b6c2.0.12caf48bafix(response): copy headers when init is a foreign Response (#382)3b1dd68test: replace supertest (#379)834e54f2.0.11ba72bcdperf(request): fast-path PATCH method (#380)962baa4perf(request): fast-path QUERY methods (#376)62284d6test: use a custom helper for path traversal tests (#377)7c1457e2.0.103a21938Merge commit from fork98420212.0.9Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@hono/node-serversince your current version.Updates
ip-addressfrom 10.2.0 to 10.4.0Release notes
Sourced from ip-address's releases.
Commits
fbb8db210.4.045a2b11Validate the byte arrays Address6 is given (#217)bac8810Keep the package loadable on node 12, and enforce it (#216)9b3d848Add a security policy and a README section on security posturee84a7b3Order the README API reference Address4, Address6, AddressError015160bCollapse each class in the README API reference34061a8Pin checkout and setup-node to commits in the release jobc5fae5dPin action-gh-release to a commit and move it to 3.0.2e0ef048Replace CircleCI with GitHub Actions5e3ceb7Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.