Bumps the npm_and_yarn group with 2 updates in the /ui directory: body-parser and hono.

Updates body-parser from 2.2.2 to 2.3.0

Sourced from body-parser's releases.

v2.3.0

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in expressjs/body-parser#681
• build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @​dependabot[bot] in expressjs/body-parser#682
• build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @​dependabot[bot] in expressjs/body-parser#683
• build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @​dependabot[bot] in expressjs/body-parser#685
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @​dependabot[bot] in expressjs/body-parser#684
• perf(urlencoded): move empty-body guard to avoid extra function closure by @​Phillip9587 in expressjs/body-parser#647
• Improve ESM compatibility by @​Phillip9587 in expressjs/body-parser#697
• docs: add recommendations for configuring payload limits by @​bjohansebas in expressjs/body-parser#699
• build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @​dependabot[bot] in expressjs/body-parser#701
• build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @​dependabot[bot] in expressjs/body-parser#702
• build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in expressjs/body-parser#700
• chore: add explicit type commonjs to package.json by @​Phillip9587 in expressjs/body-parser#711
• deps: update dependencies to latest versions by @​Phillip9587 in expressjs/body-parser#708
• build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @​dependabot[bot] in expressjs/body-parser#712
• build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @​dependabot[bot] in expressjs/body-parser#713
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in expressjs/body-parser#714
• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#698
• build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @​dependabot[bot] in expressjs/body-parser#719
• build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @​dependabot[bot] in expressjs/body-parser#718
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @​dependabot[bot] in expressjs/body-parser#717
• perf: eliminate conditional check in json strict mode hot path by @​Phillip9587 in expressjs/body-parser#651
• ci: add node.js 26 to text matrix by @​Phillip9587 in expressjs/body-parser#726
• build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @​dependabot[bot] in expressjs/body-parser#725
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @​dependabot[bot] in expressjs/body-parser#724
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @​dependabot[bot] in expressjs/body-parser#723
• Upgrade "content-type" by @​blakeembrey in expressjs/body-parser#728
• refactor: switch to const/let and enable eslint no-var rule by @​Phillip9587 in expressjs/body-parser#729
• Update outdated reference to MDN docs by @​krzysdz in expressjs/body-parser#730
• build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @​dependabot[bot] in expressjs/body-parser#731
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in expressjs/body-parser#732
• chore: updated deps to latest by @​Phillip9587 in expressjs/body-parser#733
• 2.3.0 by @​UlisesGascon in expressjs/body-parser#735

New Contributors

• @​krzysdz made their first contribution in expressjs/body-parser#730

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

• Security fix for GHSA-v422-hmwv-36x6
• fix: use static exports instead of lazy getters to improve ESM compatibility
• feat: add subpath exports for individual parsers
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit
• deps:
  • content-type@^2.0.0
  • http-errors@^2.0.1
  • iconv-lite^0.7.2
  • qs@^6.15.2
  • raw-body@^3.0.2
  • type-is@^2.1.0

• d0f2ace 2.3.0 (#735)
• 7d03f2f chore: updated deps to latest (#733)
• 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
• 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
• ff0f6b9 docs: update outdated reference to MDN docs (#730)
• 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
• 37f36a2 deps: update content-type and type-is (#728)
• e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
• e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
• a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
• Additional commits viewable in compare view

Updates hono from 4.12.26 to 4.12.31

Sourced from hono's releases.

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130
• fix(utils/body): reuse cached formData in parseBody() by @​yusukebe in honojs/hono#5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @​yusukebe in honojs/hono#5133
• fix(sse): emit retry feild when retry is 0 by @​yusukebe in honojs/hono#5135
• test(validator): fix misspelled identifier in transform type test by @​yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

• chore(benchmark/routers): bump deps in honojs/hono#5107
• chore(benchmark): remove not used benchmarks in honojs/hono#5108
• chore: update to ts6 in prep for ts7 in honojs/hono#5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025
• fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020
• fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096
• fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in honojs/hono#5092
• chore: fix no-op tsc in test script by @​yusukebe in honojs/hono#5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in honojs/hono#5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in honojs/hono#5081
• test(workerd): add compatibilityDate by @​yusukebe in honojs/hono#5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in honojs/hono#5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in honojs/hono#5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in honojs/hono#5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in honojs/hono#5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in honojs/hono#5084

New Contributors

• @​codebybilal18 made their first contribution in honojs/hono#5081
• @​Arman-Luthra made their first contribution in honojs/hono#5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in honojs/hono#5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in honojs/hono#5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in honojs/hono#5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in honojs/hono#5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in honojs/hono#5071

... (truncated)

• cadff88 4.12.31
• 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
• aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
• d796450 fix(request): fix multipart boundary mismatch in cloneRawRequest (#5133)
• 80959d4 fix(utils/body): reuse cached formData in parseBody() (#5131)
• 21b44b6 refactor(aws-lambada): remove FIXME in @ts-expect-error (#5130)
• 5f73897 docs(combine): close quote in combine JSDoc example (#5126)
• c285f9a chore(benchmark): add app.fetch() overhead benchmark (#5117)
• fb9d7bf test(context): assert case-insensitive header names in response helpers (#5116)
• b2ae3a2 4.12.30
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.