chore(deps): update all npm patch dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@electric-sql/pglite (source)	0.5.4 → 0.5.7
@hono/node-server	2.1.0 → 2.1.1
fta-cli	3.0.0 → 3.0.1
hono (source)	4.13.0 → 4.13.4
jose	6.2.8 → 6.2.10
vitest (source)	4.1.10 → 4.1.11

---

Release Notes

electric-sql/pglite (@​electric-sql/pglite)

v0.5.7

Compare Source

Patch Changes

• 2f9cf75: Fix convert_to

v0.5.6

Compare Source

Patch Changes

• 69b7d87: Apply the second options argument when calling PGlite.create(undefined, options).
• 6c14380: fixes for process.exitCode

v0.5.5

Compare Source

Patch Changes

• a290741: Reset retained protocol parser state after a malformed backend message so later queries can recover.
• 6b6f28d: Fix PGlite.create({ fs }) on a fresh database calling the provided filesystem's init() twice: the inner initdb instance no longer inherits the user-provided fs and always runs on its own scratch filesystem. Previously any VFS holding exclusive resources (e.g. OPFS sync access handles) failed with a contention error on first create.
• 354f4ae: Fix formatQuery (used by live.query/live.incrementalQuery to inline parameters) emitting %NL instead of the positional %N$L format specifier. A bare %NL is "min width N" and consumes format() arguments sequentially, so placeholders that are out of textual order silently bound the wrong values, and repeated placeholders failed with too few arguments for format().
• 219af1e: Expose the fields node-postgres derives from the CommandComplete command tag on Results: command (e.g. SELECT, INSERT, CREATE), and rowCount (the per-statement count from the tag). The tag was already received and parsed internally to compute affectedRows, but these values were not surfaced. Matching node-postgres' command/rowCount result fields lets pg-compatible adapters report them without re-parsing SQL.
• 20839a7: Preserve the host process.exitCode when closing a PGlite instance. close() calls _emscripten_force_exit(0), whose Emscripten runtime sets process.exitCode = 0, clobbering any exit code the host process had already set. This mirrors the existing save/restore guards in #init() and execProtocolRaw(), so closing a database no longer silently resets the host process's exit code.
• 7e784a4: Reject operations performed through transaction handles after the transaction has closed.

honojs/node-server (@​hono/node-server)

v2.1.1

Compare Source

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in #​389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

sgb-io/fta (fta-cli)

v3.0.1

Compare Source

• Upgraded various internal Rust dependencies

honojs/hono (hono)

v4.13.4

Compare Source

v4.13.3

Compare Source

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #​5227
• fix(etag): copy pending stream bytes in #​5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #​5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #​5235
• docs(context): add custom headers append option example to Context JSDoc in #​5248
• fix(trie-router): match suffix wildcard routes in #​5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #​5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #​5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #​5247
• feat(pretty-json): support structured JSON content-types (+json) in #​5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

Compare Source

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #​5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in #​5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in #​5199
• fix(client): serialize multiple cookies correctly in #​5202
• fix(etag): stabilize digest across stream chunks in #​5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #​5209
• perf(cors): pre-join static array header options during initialization in #​5210
• fix(client): send falsy JSON bodies in #​5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in #​5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

Compare Source

panva/jose (jose)

v6.2.10

Compare Source

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

vitest-dev/vitest (vitest)

v4.1.11

Compare Source

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in #​10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in #​10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in #​10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in #​10974 (fe5a1)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.