fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/cache	action	patch	v5.0.3 → v5.0.4
chromadb	dependencies	minor	3.3.3 → 3.4.0
convex (source)	devDependencies	minor	1.33.1 → 1.34.0
hono (source)	overrides	patch	4.12.8 → 4.12.9
mongoose (source)	devDependencies	patch	9.3.1 → 9.3.2
com.fasterxml.jackson.core:jackson-databind (source)	dependencies	patch	2.21.1 → 2.21.2
com.google.protobuf:protobuf-java (source)	dependencies	patch	4.34.0 → 4.34.1

---

Release Notes

actions/cache (actions/cache)

v5.0.4

Compare Source

get-convex/convex-backend (convex)

v1.34.0

• The CLI can now automatically provide Convex AI context files
  (AGENTS.md, CLAUDE.md, guidelines/state files) to your project when using npx convex dev.
  You can manage Convex AI files using the new npx convex ai-files command:
  • npx convex ai-files install - Install or refresh AI files
  • npx convex ai-files update - Update to latest available AI files
  • npx convex ai-files status - Show what is installed and what is stale
  • npx convex ai-files disable - Suppress install and staleness messages in npx convex dev
  • npx convex ai-files enable - Re-enable install and staleness messages
  • npx convex ai-files remove - Remove Convex-managed AI files
• Adds new npx convex deployment commands:
  • npx convex deployment create allows you to create new cloud deployments for a project
  • npx convex deployment select allows you to select the deployment to use in your project
    directory when running commands
• CLI commands now support the --deployment flag to select a deployment to target.
  It accepts a deployment name (e.g. joyful-capybara-123), ref (e.g. dev/james), dev (for
  your personal dev deployment), or prod (for your project’s default production deployment). You
  can also select deployments in other projects with project-slug:ref or team-slug:project-slug:ref.
• Improves websocket client backoff behavior.
• No longer recreates convex/README.md when convex/ already exists.

honojs/hono (hono)

v4.12.9

Compare Source

What's Changed

• fix(request): remove parseBody from bodyCache to prevent TypeError by @​yusukebe in #​4807
• feat(client): add PickResponseByStatusCode type by @​yusukebe in #​4791
• fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest by @​yuintei in #​4810
• fix(service-worker): make fire() fallback behavior consistent with handle() by @​yusukebe in #​4821
• fix(cors): reflect request origin when credentials is true with wildcard by @​ctonneslan in #​4813

New Contributors

• @​yuintei made their first contribution in #​4810
• @​ctonneslan made their first contribution in #​4813

Full Changelog: honojs/hono@v4.12.8...v4.12.9

Automattic/mongoose (mongoose)

v9.3.2

Compare Source

==================

• fix(mongoose): throw error when trying to set null or undefined as options #​16130 #​16140
• fix(cast): include array value in query filter error message #​16127 White-Devil2839
• fix(cast): replace assert.ok with descriptive Error in castNumber #​16110 mrsandy1965
• fix(connection): standardize throw new Error to MongooseError #​16142 techcodie
• fix(query): use MongooseError instead of Error #​16132 ace-tk
• docs: add production environment example for autoIndex #​16151 mrsandy1965
• docs: upgrade self-referencing http:// links to https:// #​16150 mrsandy1965
• docs: fix incorrect Double cast comment and upgrade insecure plugin link #​16148 mrsandy1965
• docs: fix redundant text and http link in installation section #​16146 Puxhkar
• docs: fix typo 'mutiple' → 'multiple' in queries.md #​16147 mrsandy1965
• docs: use HTTPS for external links in docs navigation #​16133 ace-tk
• docs: use HTTPS for external links in CONTRIBUTING and homepage #​16134 ace-tk
• docs(populate): replace removed mapReduce() API link #​16135 ace-tk
• docs(models): replace removed count() and mapReduce() references #​16123 White-Devil2839
• docs: fix broken count() and update() links in queries docs White-Devil2839
• docs: fix broken update() link in validation docs #​16121 White-Devil2839
• docs: update GitHub link to use https #​16120 White-Devil2839
• docs(documents): fix incorrect variable name in nullish coalescing example #​16119 White-Devil2839
• docs: fix missing quotes in populate path examples #​16118 White-Devil2839
• docs: fix missing comma in populate dynamic ref example #​16117 White-Devil2839
• docs: clarify that transaction rollback marks fields as modified to allow re-saving #​16112 ramanverse

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - "after 9am and before 5pm Monday" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: prisma/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code EOVERRIDE
npm error Override for hono@4.12.9 conflicts with direct dependency
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-03-23T18_20_13_540Z-debug-0.log

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.