Bump koa from 2.16.3 to 2.16.4

[dependabot]

Bumps koa from 2.16.3 to 2.16.4.

Release notes

Sourced from koa's releases.

v2.16.4

What's Changed

• fix(security): Host Header Injection via ctx.hostname by @​killagu GHSA-7gcc-r8m5-44qm

Commits

• ca76ea6 2.16.4
• b76ddc0 Merge commit from fork
• See full diff in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Error		Mar 10, 2026 5:47pm
hashdotdesign	Ready	Preview, Comment	Mar 10, 2026 5:47pm
hashdotdesign-tokens	Ready	Preview, Comment	Mar 10, 2026 5:47pm
petrinaut	Ready	Preview	Mar 10, 2026 5:47pm

[cursor]

PR Summary

Low Risk
Lockfile-only patch update to a dependency; behavior changes should be minimal, with the main impact being the upstream security fix.

Overview
Updates the koa dependency in yarn.lock from 2.16.3 to 2.16.4.

This is a patch-level upgrade that pulls in upstream security fixes (notably for Host header injection via ctx.hostname).

^{Written by Cursor Bugbot for commit 4e252be. This will update automatically on new commits. Configure here.}

[augmentcode]

🤖 Augment PR Summary

Summary: Updates the Koa dependency from 2.16.3 to 2.16.4.

Why: Pulls in the upstream security fix for Host Header Injection affecting ctx.hostname (per Koa v2.16.4 release notes) and updates the lockfile accordingly.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.