This PR contains the following updates:
Package Updates Summary
| Type | Count |
|---|---|
| 📦 NPM Packages | 5 |
| 🔧 System Dependencies | 4 |
| Total | 9 |
📦 npm Dependencies
5 packages will be updated
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| stripe (source) | 22.3.2 -> 22.6.2 | ||||
| @stacksjs/bun-router (source) | 0.1.18 -> 0.1.20 | ||||
| better-dx (source) | 0.2.24 -> 0.2.25 | ||||
| fastify (source) | 5.12.3 -> 5.12.5 | ||||
| hono (source) | 4.13.7 -> 4.13.11 |
🔧 System Dependencies
4 packages will be updated across 1 file(s): deps.yml
| Package | Change | Type | File |
|---|---|---|---|
| git | ^2.47.0 → ^2.53.0 | 🟡 minor | deps.yml |
| gnu.org/gettext | ^0.21 → ^0.26 | 🟡 minor | deps.yml |
| sqlite | ^3.47.2 → ^3.53.4 | 🟡 minor | deps.yml |
| zlib.net | ^1.2.11 → ^1.3.2 | 🟡 minor | deps.yml |
Release Notes
stripe/stripe-node (stripe)
22.3.2 -> 22.6.2
v22.6.2
#2841Validate that webhook secrets are non-empty
See the changelog for more details.
Released by xavdid on 9/9/2026
v22.6.1
#2831Use cryptographically secure boundaries for multipart file uploads#2836update OtherString docstring#2835Fix request coercion for GET and DELETE parameters- Fixes serialization of schema-coerced values, including
Decimal, in GET and DELETE query parameters.
- Fixes serialization of schema-coerced values, including
#2829Harden API requestor code against malicious URLs
See the changelog for more details.
Released by zacchua-stripe on 9/1/2026
v22.6.0
This release changes the pinned API version to 2026-08-26.dahlia.
#2801Add discriminatedUnion kind to V2RuntimeSchema coercion- Adds runtime support for coercing int64/decimal fields within discriminated union variants in V2 API requests and responses.
- ⚠️ Throws when serializing a discriminated union parameter whose discriminator is missing or is not a string. This avoids skipping coercion entirely which could silently truncate
int64fields aboveNumber.MAX_SAFE_INTEGER.
#2818Add newEventNotificationHandlerclass for better thin event management- We've been putting a lot of time into rethinking the event handling experience in the SDKs. This new class is the culmination of that effort.
- They're designed for a tight coupling with both
StripeClientand the fully-typed nature of [thin events](https://docs.stripe.com/event-desti...
[View full release notes]
Released by xavdid on 8/27/2026
stacksjs/bun-router (@stacksjs/bun-router)
0.1.18 -> 0.1.20
v0.1.20
Released by github-actions[bot] on 9/28/2026
fastify/fastify (fastify)
5.12.3 -> 5.12.5
v5.12.5
⚠️ Security release
What's Changed
- [Backport 5.x] perf: reduce content-type parser overhead by github-actions[bot] in
fastify/fastify#7019 - [Backport 5.x] perf: avoid redundant request-part reads during validation by github-actions[bot] in
fastify/fastify#7020
Full Changelog: https://github.com/fastify/fastify/compare/v5.12.4...v5.12.5
Released by mcollina on 9/16/2026
v5.12.4
Fixed the fastify.js version mismatch.
Full Changelog: https://github.com/fastify/fastify/compare/v5.12.2...v5.12.4
Released by climba03003 on 9/11/2026
honojs/hono (hono)
4.13.7 -> 4.13.11
v4.13.11
Security fixes
serveStatic decodes the request path a second time, leading to bypass of middleware on static paths
Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7
serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.
The same fix ships in @hono/node-server v2.1.3.
Released by yusukebe on 9/29/2026
v4.13.10
Adapters are now separate packages
The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.
hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:
- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.
What's Changed
- chore: migrate the package manager from bun to pnpm in
honojs/hono#5433 - chore(package.json): invoke package scripts through pnpm instead of bun in
honojs/hono#5434 - chore: replace prettier with oxfmt in
honojs/hono#5435 - chore(deps): upgrade vitest to 5.0.1 in
honojs/hono#5437 - chore: let oxfmt sort imports instead of eslint in
honojs/hono#5442 - ch...
[View full release notes]
Released by yusukebe on 9/28/2026
v4.13.9
What's Changed
- fix(jsx): replace Suspense and ErrorBoundary content across newlines in
honojs/hono#5380 - fix(accepts): match media types and language tags case-insensitively in
honojs/hono#5376 - fix(linear-router): don't match an empty path segment as a param in
honojs/hono#5373 - fix(pretty-json): don't break responses with unparseable JSON bodies in
honojs/hono#5377 - fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in
honojs/hono#5379 - fix(aws-lambda): treat binary +xml archive media types as binary in
honojs/hono#5424 - fix(aws-lambda): preserve empty query parameters in
honojs/hono#5292 - fix(lambda-edge): sync content type detection with aws-lambda in
honojs/hono#5426 - fix(lambda-edge): fail with a descriptive error on a malformed event in
honojs/hono#5358
Full Changelog: https://github.com/honojs/hono/compare/v4.13.8...v4.13.9
Released by yusukebe on 9/24/2026
📊 Package Statistics
- stripe: 24,383,392 weekly downloads
- @stacksjs/bun-router: 9,996 weekly downloads
- better-dx: 27,669 weekly downloads
- fastify: 15,716,294 weekly downloads
- hono: 73,156,540 weekly downloads
- git: Available via pkgx package manager
- gnu.org/gettext: Available via pkgx package manager
- sqlite: Available via pkgx package manager
- zlib.net: Available via pkgx package manager
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Buddy 🤖
{"schemaVersion":1,"updates":[{"name":"git","current":"^2.47.0","target":"2.53.0","type":"minor","file":"deps.yml","dependencyType":"dependencies"},{"name":"gnu.org/gettext","current":"^0.21","target":"0.26","type":"minor","file":"deps.yml","dependencyType":"dependencies"},{"name":"sqlite","current":"^3.47.2","target":"3.53.4","type":"minor","file":"deps.yml","dependencyType":"dependencies"},{"name":"stripe","current":"22.3.2","target":"22.6.2","type":"minor","file":"package.json","dependencyType":"dependencies"},{"name":"zlib.net","current":"^1.2.11","target":"1.3.2","type":"minor","file":"deps.yml","dependencyType":"dependencies"},{"name":"@stacksjs/bun-router","current":"0.1.18","target":"0.1.20","type":"patch","file":"storage/framework/orm/package.json","dependencyType":"dependencies"},{"name":"better-dx","current":"0.2.24","target":"0.2.25","type":"patch","file":"storage/framework/cloud/package.json","dependencyType":"dependencies"},{"name":"fastify","current":"5.12.3","target":"5.12.5","type":"patch","file":"bench/routing/package.json","dependencyType":"dependencies"},{"name":"hono","current":"4.13.7","target":"4.13.11","type":"patch","file":"bench/routing/package.json","dependencyType":"dependencies"}],"group":"Non-Major Updates","generatedAt":"2026-09-29T07:56:01.382Z"} -->