Bump the production-dependencies group with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates:

Package	From	To
@googleapis/androidpublisher	36.0.0	37.0.0
@hono/node-server	2.0.12	2.1.0
googleapis-common	8.0.3	9.0.0
hono	4.12.32	4.13.0
yaml	2.8.1	2.9.0

Updates @googleapis/androidpublisher from 36.0.0 to 37.0.0

Changelog

Sourced from @​googleapis/androidpublisher's changelog.

v37.0.0

01-28-2019 10:29 PST

This release has breaking changes. But it's also got a lot of good stuff too. Keep reading!

google-auth-library 3.0

The google-auth-library module has been upgrade to 3.0. This comes with it's own breaking changes, which are covered here.

gaxios upgrade

Previous versions of this library used the axios library as an underlying HTTP transport. In an effort to fix a variety of problems, this has been swapped out for an API compatible library: gaxios. While we've tried really hard to ensure compatibility with axios, it's entirely possible there are subtle differences. If you run into trouble - just let us know!

Removed APIs

The replicapoolupdater_v1beta1 API has been removed.

New features

Webpack support

This library is now webpack-able! Samples and docs are still coming, but you should be able to bundle for the browser now.

New APIs

The following APIs have been introduced:

• file_v1
• bigtableadmin_v2
• cloudbuild_v1alpha1
• cloudidentity_v1
• cloudidentity_v1beta1
• containeranalysis_v1alpha1
• containeranalysis_v1beta1
• content_v2_1
• iap_v1
• libraryagent_v1
• remotebuildexecution_v1
• remotebuildexecution_v1alpha
• remotebuildexecution_v2

Changes

It includes the following changes:

• feat: run the generator (#1564)
• feat: run the generator (#1541)
• feat: webpack support for all APIs (#1554)
• feat: generating webpackable packages (#1547)

Documentation

• docs: specify gaxios over axios (#1558)
• docs(samples): add people samples for get & create contacts (#1543)
• docs: fix typo in README.md (#1549)
• docs: improve the compute sample in the README (#1537)
• docs(samples): rework the compute list vms sample (#1534)
• docs: correct the README (#1522)

... (truncated)

Commits

• 7e3d978 Release v37.0.0 (#1568)
• ecb2c28 build: check for 404s in the docs (#1562)
• d49aa49 docs: run the docs command (#1566)
• d1af168 feat: run the generator (#1564)
• 9ccda50 chore(deps): update dependency eslint-config-prettier to v4 (#1565)
• 73f8f9c docs: specify gaxios over axios (#1558)
• 7f7f3cf fix(deps): update dependency googleapis-common to ^0.7.0 (#1560)
• c62efb1 docs(samples): add people samples for get & create contacts (#1543)
• 2ad63f6 feat: webpack support for all APIs (#1554)
• d8ba2ac fix(deps): update googleapis-common and google-auth-library (#1556)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.0.12 to 2.1.0

Release notes

Sourced from @​hono/node-server's releases.

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

Commits

• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• See full diff in compare view

Updates googleapis-common from 8.0.3 to 9.0.0

Changelog

Sourced from googleapis-common's changelog.

9.0.0 (2026-07-29)

⚠ BREAKING CHANGES

• Update nodejs-googleapis-common to minimum Node version of 22. (#8997)

Features

• Update nodejs-googleapis-common to minimum Node version of 22. (#8997) (5f9dfeb), refs #8985

Commits

• ad53939 chore: release main (#9012)
• 5f9dfeb feat!: Update nodejs-googleapis-common to minimum Node version of 22. (#8997)
• See full diff in compare view

Updates hono from 4.12.32 to 4.13.0

Release notes

Sourced from hono's releases.

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in honojs/hono#5118
• perf(url): replace regex tests with indexOf honojs/hono#5121
• perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122
• perf(urls): refactor tryDecodeURIComponent honojs/hono#5158
• perf(request): allocate #validatedData lazily honojs/hono#5175
• perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
app.query('/search', async (c) => {
const conditions = await c.req.json()
return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

... (truncated)

Commits

• 192768f 4.13.0
• b0c2d90 Merge pull request #5154 from honojs/next
• 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
• 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
• 3feb355 fix(jsx): allow a function component to return an array (#5179)
• 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
• 30277ae feat(jwt,jwk): add a configurable WWW-Authenticate realm (#5141)
• 1f707c5 feat(middleware): add method-not-allowed middleware (#5132)
• 2df0b47 feat(jsx): add React-compatible overloads to useRef (#5063)
• 3bc96ba feat(cache): add first-class support for QUERY requests (#5119)
• Additional commits viewable in compare view

Updates yaml from 2.8.1 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

v2.8.3

• Add trailingComma ToString option for multiline flow formatting (#670)
• Catch stack overflow during node composition (1e84ebb)

v2.8.2

• Serialize -0 as -0 (#638)
• Do not double newlines for empty map values (#642)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions