chore(deps): bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: @hono/node-server, @hono/zod-openapi and @eslint-react/eslint-plugin.

Updates @hono/node-server from 2.0.8 to 2.0.9

Release notes

Sourced from @​hono/node-server's releases.

v2.0.9

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in honojs/node-server#371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in honojs/node-server#372
• fix: recover complete request bodies after client disconnect by @​usualoma in honojs/node-server#375

New Contributors

• @​otnc made their first contribution in honojs/node-server#371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

Commits

• 9842021 2.0.9
• 51f3bf5 fix: recover complete request bodies after client disconnect (#375)
• fdb87ba fix(serve-static): correct Range header parsing edge cases (#372)
• 912e3fd fix(websocket): polyfill missing ErrorEvent global (#371)
• See full diff in compare view

Updates @hono/zod-openapi from 1.4.0 to 1.5.1

Release notes

Sourced from @​hono/zod-openapi's releases.

@​hono/zod-openapi@​1.5.1

Patch Changes

• Updated dependencies [7bc11dffa7dd5b639c614b12c34bd76722d76354]:
  • @​hono/zod-validator@​0.9.0

@​hono/zod-openapi@​1.5.0

Minor Changes

• #1878 443a8dc5cd8a6a65daa2bec1f251adfc605b05ce Thanks @​SAY-5! - feat: inherit defaultHook from parent app on nested routes mounted via app.route()

  Behavior change: if a parent app has a defaultHook and a mounted sub-app does not declare its own, the sub-app's routes now use the parent's defaultHook instead of the built-in validation response.

Patch Changes

• #2033 740123c01aadb6c2ed742d1c67c2763a4cdc4f1f Thanks @​yusukebe! - fix: resolve defaultHook through the ancestor chain on nested routes

• #2031 bf52ec2f18e32479ec85c00922c8aede68dc8286 Thanks @​tokiya-takai! - fix(zod-openapi): preserve onError()/notFound() set after basePath()

  OpenAPIHono.basePath() used to rebuild the instance by spreading the plain Hono clone returned by super.basePath(). That spread copied the clone's arrow-function instance fields (onError, notFound, request, fetch), which stay bound to the discarded clone — so calling .onError() (or .notFound()) after .basePath() mutated the throwaway clone instead of the returned app and silently had no effect (the parent's handler ran instead). basePath() now transplants only the routing state onto a properly constructed OpenAPIHono, keeping its own correctly-bound methods. Fixes #2021.

Changelog

Sourced from @​hono/zod-openapi's changelog.

1.5.1

Patch Changes

• Updated dependencies [7bc11dffa7dd5b639c614b12c34bd76722d76354]:
  • @​hono/zod-validator@​0.9.0

1.5.0

Minor Changes

• #1878 443a8dc5cd8a6a65daa2bec1f251adfc605b05ce Thanks @​SAY-5! - feat: inherit defaultHook from parent app on nested routes mounted via app.route()

  Behavior change: if a parent app has a defaultHook and a mounted sub-app does not declare its own, the sub-app's routes now use the parent's defaultHook instead of the built-in validation response.

Patch Changes

• #2033 740123c01aadb6c2ed742d1c67c2763a4cdc4f1f Thanks @​yusukebe! - fix: resolve defaultHook through the ancestor chain on nested routes

• #2031 bf52ec2f18e32479ec85c00922c8aede68dc8286 Thanks @​tokiya-takai! - fix(zod-openapi): preserve onError()/notFound() set after basePath()

  OpenAPIHono.basePath() used to rebuild the instance by spreading the plain Hono clone returned by super.basePath(). That spread copied the clone's arrow-function instance fields (onError, notFound, request, fetch), which stay bound to the discarded clone — so calling .onError() (or .notFound()) after .basePath() mutated the throwaway clone instead of the returned app and silently had no effect (the parent's handler ran instead). basePath() now transplants only the routing state onto a properly constructed OpenAPIHono, keeping its own correctly-bound methods. Fixes #2021.

Commits

• 70623e3 Version Packages (#2037)
• 8e59b17 Version Packages (#2032)
• 740123c fix(zod-openapi): resolve defaultHook through the ancestor chain on nested ro...
• 443a8dc fix(zod-openapi): inherit defaultHook from parent app on nested routes (#1878)
• bf52ec2 fix(zod-openapi): preserve onError/notFound bindings set after basePath() (#2...
• b86478a ci: apply automated fixes
• 5e32c00 chore: migrate to pnpm (#2006)
• c5ba38b chore(deps-dev): bump tsdown from 0.22.2 to 0.22.3 (#1996)
• f89ea30 chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 (#1866)
• bf845ad chore: unblock TypeScript v6 (#1937)
• Additional commits viewable in compare view

Updates @eslint-react/eslint-plugin from 5.14.8 to 5.14.10

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.14.10 (2026-07-15)

What's Changed

🐞 Fixes

• @eslint-react/ast: Extract.getCalleeName now returns null for computed member expressions (e.g. obj[foo](), obj["foo"](), obj[foo]()) instead of the property name, so callers don't treat dynamically chosen methods as static method names. (#1906)

🏗️ Internal

• Added unit tests for Extract.getCalleeName.

Full Changelog: Rel1cx/eslint-react@v5.14.9...v5.14.10

Attestation

https://github.com/Rel1cx/eslint-react/attestations/35301835

v5.14.9 (2026-07-15)

What's Changed

🐞 Fixes

• @eslint-react/ast: removed Extract.getPropertyName and added Extract.getCalleeName for simpler callee name resolution. (#1905)
• Rules that match calls by method name no longer treat computed string-literal property access as a static match (e.g. obj["foo"]() is no longer resolved to "foo"). This avoids relying on the runtime value of computed keys and aligns callee matching across the codebase. Affected rules:
  • react-dom/no-dangerously-set-innerhtml
  • react-dom/no-find-dom-node
  • react-dom/no-flush-sync
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
  • react-x/globals
  • react-x/immutability
• core.isJsxLike: no longer treats React['createElement'] calls as JSX-like, since the callee is accessed through a computed member expression.

🏗️ Internal

• Simplified callee name checks across core, react-dom, react-web-api, and react-x rules using Extract.getCalleeName.
• Bumped @effect/platform, effect, fumadocs-core, fumadocs-mdx, fumadocs-ui, postcss, pnpm, and tsdown.

Full Changelog: Rel1cx/eslint-react@v5.14.8...v5.14.9

Attestation

https://github.com/Rel1cx/eslint-react/attestations/35295648

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.14.10 (2026-07-15)

🐞 Fixes

• @eslint-react/ast: Extract.getCalleeName now returns null for computed member expressions (e.g. obj[foo](), obj["foo"](), obj[foo]()) instead of the property name, so callers don't treat dynamically chosen methods as static method names. (#1906)

🏗️ Internal

• Added unit tests for Extract.getCalleeName.

Full Changelog: Rel1cx/eslint-react@v5.14.9...v5.14.10

v5.14.9 (2026-07-15)

🐞 Fixes

• @eslint-react/ast: removed Extract.getPropertyName and added Extract.getCalleeName for simpler callee name resolution. (#1905)
• Rules that match calls by method name no longer treat computed string-literal property access as a static match (e.g. obj["foo"]() is no longer resolved to "foo"). This avoids relying on the runtime value of computed keys and aligns callee matching across the codebase. Affected rules:
  • react-dom/no-dangerously-set-innerhtml
  • react-dom/no-find-dom-node
  • react-dom/no-flush-sync
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
  • react-x/globals
  • react-x/immutability
• core.isJsxLike: no longer treats React['createElement'] calls as JSX-like, since the callee is accessed through a computed member expression.

🏗️ Internal

• Simplified callee name checks across core, react-dom, react-web-api, and react-x rules using Extract.getCalleeName.
• Bumped @effect/platform, effect, fumadocs-core, fumadocs-mdx, fumadocs-ui, postcss, pnpm, and tsdown.

Full Changelog: Rel1cx/eslint-react@v5.14.8...v5.14.9

Commits

• 479970c release: 5.14.10
• 8f1107b release: 5.14.9
• 8644320 chore(deps): bump dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions