chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 11 updates by dependabot[bot] · Pull Request #150 · middleapi/standard-server

dependabot · 2026-10-09T02:24:48Z

Bumps the dev-dependencies-minor-patch group with 11 updates in the / directory:

Package	From	To
@hono/node-server	`2.1.1`	`2.1.3`
@types/node	`26.4.1`	`26.6.4`
fastify	`5.12.1`	`5.12.5`
h3	`2.0.1-rc.26`	`2.0.2`
pkg-pr-new	`0.0.87`	`0.0.91`
ws	`8.21.3`	`8.22.0`
@types/ws	`8.18.1`	`8.18.2`
@types/aws-lambda	`8.10.163`	`8.10.164`
supertest	`7.2.2`	`7.3.1`
tsx	`4.23.13`	`4.23.15`
@types/bun	`1.4.0`	`1.4.2`

Updates @hono/node-server from 2.1.1 to 2.1.3

Release notes

Sourced from @hono/node-server's releases.

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

ci: add autofix.ci by @yusukebe in honojs/node-server#392

fix: type error in early hints and add typecheck to CI by @BlankParticle in honojs/node-server#390

chore: add better benchmarks by @BlankParticle in honojs/node-server#391

docs(readme): update the benchmark by @yusukebe in honojs/node-server#394

test(request): accept asynchronous body read errors by @usualoma in honojs/node-server#403

fix(listener): avoid mutating response headers when setting Content-Length by @usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits

720ac78 2.1.3
9821792 Merge commit from fork
35bca95 2.1.2
90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
fe7467c test(request): accept asynchronous body read errors (#403)
64dc09e docs(readm): update the benchmark (#394)
8f505ae chore: add better benchmarks (#391)
2469b1a fix: type error in early hints and add typecheck to CI (#390)
3f958da ci: add autofix.ci (#392)
See full diff in compare view

Updates @types/node from 26.4.1 to 26.6.4

Commits

See full diff in compare view

Updates fastify from 5.12.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

[Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in fastify/fastify#7019

[Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

Fix for GHSA-9q9j-q6p8-xq58

Fix for GHSA-hwr6-493r-vm6h

Fix for GHSA-p68q-wchp-6fh7

Fix for GHSA-667r-xxjv-c9mm

What's Changed

[Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in fastify/fastify#6973

[Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

ba235fd Bumped v5.12.5
ad06a4c Merge commit from fork
7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
1690e35 Bumped v5.12.4
1c991c4 Bumped v5.12.3
942a2be Bumped v5.12.2
853f6e2 test(validation): cover normalization and async branches
f02d8d4 fix(validation): do not unwrap async validator results
93c239a fix: reject malformed URLs before custom 404 handlers
Additional commits viewable in compare view

Updates h3 from 2.0.1-rc.26 to 2.0.2

Release notes

Sourced from h3's releases.

v2.0.2

compare changes

🩹 Fixes

node: Call onError for stream errors in Node.js handlers (#1571)

response: Use matching reason phrases in redirect and noContent (#1570)

middleware: Pass through handled responses in onError (#1574)

🌊 Types

session: Remove @ts-nocheck from iron-crypto (#1572)

route: Infer defineRoute handler input from validation schemas (ec527f0)

🏡 Chore

session: Retarget legacy seal fallback removal to v3 (#1573)

session: Mark legacySealFallback as deprecated (44dbfb8)

❤️ Contributors

Pooya Parsa (@pi0)

Bao Nguyen (@giaBaoJS)

Kaan Çelebi (@kaanisthatyou)

Daniel Shafer (@dannyshafer)

v2.0.1

H3 v2 is now stable! 🎉

[!NOTE] A full release article is coming soon on the H3 blog.

H3 v2 is a full rewrite on top of web standards (Request, Response, URL, Headers). It stays compatible with most v1 utilities and is faster and smaller than v1.

👉 Get started: https://h3.dev/guide 👉 Upgrading from v1: https://h3.dev/migration

Highlights

🌐 Web standards first: Handlers receive event.req (a standard Request) and event.url, and set response headers through event.res. Return any value (string, object, Response, stream, Blob, ...) and H3 converts it to a Response.

🚀 Runs everywhere: The same app runs on Node.js, Bun, Deno, Cloudflare Workers, Service Workers and browsers. srvx provides a universal server layer, and event.req.runtime gives access to runtime-specific details when needed.

⚡ Fast and small: Routing uses rou3 v1, and the core is a fraction of v1's bundle size. Every handler can be called directly with handler.fetch().

🧩 Middleware and plugins: Onion-style (event, next) middleware, built-in helpers (onRequest, onResponse, onError, basicAuth, bodyLimit, ...) and reusable definePlugin() extensions.

🔒 Type safety: Typed handlers, responses and errors (HTTPError), plus validated handlers and body/query/params validation with any Standard Schema library.

📏 Route rules (h3/rules): Add headers, redirects, CORS, caching and proxying to groups of routes with one config object. See the Route Rules guide.

🧰 Built-in utilities: Cookies (including chunked), sessions, CORS, proxy, static files, cache headers, SSE, WebSockets via crossws, JSON-RPC/MCP helpers and an h3/tracing plugin. See https://h3.dev/utils.

Requirements

Node.js >= 20.19 (if you run on Node.js)

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.2

compare changes

🩹 Fixes

node: Call onError for stream errors in Node.js handlers (#1571)

response: Use matching reason phrases in redirect and noContent (#1570)

middleware: Pass through handled responses in onError (#1574)

📖 Documentation

Add v2 blog article (9adeeee)

🌊 Types

session: Remove @ts-nocheck from iron-crypto (#1572)

route: Infer defineRoute handler input from validation schemas (ec527f0)

🏡 Chore

session: Retarget legacy seal fallback removal to v3 (#1573)

session: Mark legacySealFallback as deprecated (44dbfb8)

Update deps (ac79e5f)

Update release script (07d7d2c)

❤️ Contributors

Pooya Parsa (@pi0)

Pi0x x@pi0.io

Bao Nguyen (@giaBaoJS)

Kaan Çelebi (@kaanisthatyou)

Daniel Shafer (@dannyshafer)

v2.0.1-rc.33

compare changes

🚀 Enhancements

rules: Skip redirect when the request is already at the target (#1559)

🩹 Fixes

cookie: Include partitioned in the distinct-cookie key (#1553)

sse: Preserve buffered events during overlapping flushes (#1555)

static: Set vary header when a single encoding is accepted (#1556)

static: Honor q-values and case in accept-encoding (#1560)

mime: Add .mjs and .cjs to COMMON_MIME_TYPES (#1566)

rules: Normalize rule keys like routes and tighten the shape guard (7cbf21c)

... (truncated)

Commits

66cfb8a chore(release): v2.0.2
07d7d2c chore: update release script
ac79e5f chore: update deps
44dbfb8 chore(session): mark legacySealFallback as deprecated
ec527f0 types(route): infer defineRoute handler input from validation schemas
b52a9e7 fix(middleware): pass through handled responses in onError (#1574)
403bd02 fix(response): use matching reason phrases in redirect and noContent (#1570)
bca3a8e fix(node): call onError for stream errors in Node.js handlers (#1571)
fb34b0f types(session): remove @ts-nocheck from iron-crypto (#1572)
024b278 chore(session): retarget legacy seal fallback removal to v3 (#1573)
Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.87 to 0.0.91

Commits

3cf47a1 release: v0.0.91
62357c7 release: v0.0.90
4ac7860 release: v0.0.89
b594954 release: v0.0.88
See full diff in compare view

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

Introduced the protocols option (8b918b01).

Bug fixes

Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

297202c [dist] 8.22.0
8b918b0 [feature] Introduce the protocols option
73e03eb [ci] Update actions/setup-node action to v7
d9b8954 [fix] Change the ready state after validating the arguments (#2337)
See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

See full diff in compare view

Updates @types/aws-lambda from 8.10.163 to 8.10.164

Commits

See full diff in compare view

Updates supertest from 7.2.2 to 7.3.1

Release notes

Sourced from supertest's releases.

v7.3.1

Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind 884cd26

fix: bind ephemeral server to the loopback address it connects to e74a1e0

forwardemail/supertest@v7.3.0...v7.3.1

v7.3.0

fix: stabilize ephemeral server requests and assertions 71dc5fb

Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd8535d99 3b5ba5c

Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2.3.2 c3419b2

Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1 7e409db

Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expansion-1.1.21 b55a7f9

Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslist-4.29.0 7a5deaa

Merge pull request #900 from forwardemail/dependabot/npm_and_yarn/fast-uri-3.1.8 a75f6ee

Merge pull request #901 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.15.2 c2cb33e

Merge pull request #896 from pnookala-godaddy/codex/ephemeral-loopback-bind 7fb34e7

chore(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 c357584

chore(deps-dev): bump browserslist from 4.25.1 to 4.29.0 2a01b57

chore(deps-dev): bump fast-uri from 3.0.6 to 3.1.8 343394d

chore(deps-dev): bump brace-expansion from 1.1.12 to 1.1.21 6b203e9

Merge pull request #881 from forwardemail/dependabot/npm_and_yarn/qs-6.14.2 d40ca7e

fix: match ephemeral server address family b6f5995

chore(deps-dev): bump lodash from 4.17.21 to 4.18.1 81766ca

chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 985ac7c

chore(deps): bump minimatch 58baa5f

chore(deps): bump qs from 6.14.1 to 6.14.2 c406e82

forwardemail/supertest@v7.2.2...v7.3.0

Commits

3634bdd 7.3.1
884cd26 Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind
e74a1e0 fix: bind ephemeral server to the loopback address it connects to
a3f5cb8 7.3.0
71dc5fb fix: stabilize ephemeral server requests and assertions
3b5ba5c Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd85...
c3419b2 Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2...
7e409db Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1
b55a7f9 Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expan...
7a5deaa Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslis...
Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

exclude bare builtins from namespace inheritance (38e1588)

expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)

make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

npm package (@latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

npm package (@latest dist-tag)

Commits

ca66105 test: fix drive-less file URLs in ESM resolver fixtures
2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
38e1588 fix: exclude bare builtins from namespace inheritance
562c434 fix: make namespaced register() overloads portable for declaration emit
edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
70e7828 test: upgrade tinyspy for disposable API
9ed2022 ci: avoid duplicate release notifications
872e77f refactor: use disposables for cleanup
6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
See full diff in compare view

Updates @types/bun from 1.4.0 to 1.4.2

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… directory with 11 updates Bumps the dev-dependencies-minor-patch group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `2.1.1` | `2.1.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.4` | | [fastify](https://github.com/fastify/fastify) | `5.12.1` | `5.12.5` | | [h3](https://github.com/h3js/h3) | `2.0.1-rc.26` | `2.0.2` | | [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.87` | `0.0.91` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [@types/aws-lambda](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/aws-lambda) | `8.10.163` | `8.10.164` | | [supertest](https://github.com/ladjs/supertest) | `7.2.2` | `7.3.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.0` | `1.4.2` | Updates `@hono/node-server` from 2.1.1 to 2.1.3 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v2.1.1...v2.1.3) Updates `@types/node` from 26.4.1 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `fastify` from 5.12.1 to 5.12.5 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.1...v5.12.5) Updates `h3` from 2.0.1-rc.26 to 2.0.2 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/main/CHANGELOG.md) - [Commits](h3js/h3@v2.0.1-rc.26...v2.0.2) Updates `pkg-pr-new` from 0.0.87 to 0.0.91 - [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.91/packages/cli) Updates `ws` from 8.21.3 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.0) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `@types/aws-lambda` from 8.10.163 to 8.10.164 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/aws-lambda) Updates `supertest` from 7.2.2 to 7.3.1 - [Release notes](https://github.com/ladjs/supertest/releases) - [Commits](forwardemail/supertest@v7.2.2...v7.3.1) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `@types/bun` from 1.4.0 to 1.4.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 2.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch - dependency-name: fastify dependency-version: 5.12.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: h3 dependency-version: 2.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: pkg-pr-new dependency-version: 0.0.91 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/aws-lambda" dependency-version: 8.10.164 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: supertest dependency-version: 7.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies-minor-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch - dependency-name: "@types/bun" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

pkg-pr-new · 2026-10-09T02:25:31Z

@standard-server/aws-lambda

npm i https://pkg.pr.new/@standard-server/aws-lambda@150

@standard-server/core

npm i https://pkg.pr.new/@standard-server/core@150

@standard-server/fastify

npm i https://pkg.pr.new/@standard-server/fastify@150

@standard-server/fetch

npm i https://pkg.pr.new/@standard-server/fetch@150

@standard-server/node

npm i https://pkg.pr.new/@standard-server/node@150

@standard-server/peer

npm i https://pkg.pr.new/@standard-server/peer@150

@standard-server/shared

npm i https://pkg.pr.new/@standard-server/shared@150

commit: 898526c

codecov · 2026-10-09T02:26:40Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

codspeed · 2026-10-09T02:26:59Z

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

_{Comparing dependabot/npm_and_yarn/dev-dependencies-minor-patch-8029bc831c (898526c) with main (6dfa912)²}

108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (96b8fa5) during the generation of this report, so 6dfa912 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 9, 2026

dependabot Bot mentioned this pull request Oct 9, 2026

chore(deps-dev): bump h3 from 2.0.1-rc.26 to 2.0.1-rc.32 #106

Closed

Navigation Menu

Repository navigation

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 11 updates - #150

chore(deps-dev): bump the dev-dependencies-minor-patch group across 1 directory with 11 updates#150
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-minor-patch-8029bc831c

dependabot Bot commented on behalf of github Oct 9, 2026

Uh oh!

pkg-pr-new Bot commented Oct 9, 2026

Uh oh!

codecov Bot commented Oct 9, 2026

Uh oh!

codspeed Bot commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 9, 2026

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

v2.1.2

What's Changed

v5.12.5

⚠️ Security release

What's Changed

v5.12.4

v5.12.2

⚠️ Security release

What's Changed

v2.0.2

🩹 Fixes

🌊 Types

🏡 Chore

❤️ Contributors

v2.0.1

Highlights

Requirements

v2.0.2

🩹 Fixes

📖 Documentation

🌊 Types

🏡 Chore

❤️ Contributors

v2.0.1-rc.33

🚀 Enhancements

🩹 Fixes

8.22.0

Features

Bug fixes

v7.3.1

v7.3.0

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

Uh oh!

pkg-pr-new Bot commented Oct 9, 2026

Uh oh!

codecov Bot commented Oct 9, 2026

Codecov Report

Uh oh!

codspeed Bot commented Oct 9, 2026

Merging this PR will not alter performance

Footnotes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths