From 88e1ea81cb4b6973af564fe4439be053aade1166 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 26 Oct 2026 18:56:50 +0000
Subject: [PATCH] Update dependency koa to v2.16.4 [SECURITY]

---
 package.json                           |  2 +-
 packages/oats-koa-adapter/package.json |  2 +-
 packages/oats/package.json             |  2 +-
 pnpm-lock.yaml                         | 18 +++++++++---------
 pnpm-workspace.yaml                    |  2 ++
 5 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/package.json b/package.json
index 67bfdb22..93c5ae87 100644
--- a/package.json
+++ b/package.json
@@ -70,7 +70,7 @@
     "tsx": "^4.23.1"
   },
   "dependencies": {
-    "koa": "2.16.2",
+    "koa": "2.16.4",
     "koa-body": "6.0.1",
     "koa-mount": "4.0.0",
     "koa-router": "12.0.1",
diff --git a/packages/oats-koa-adapter/package.json b/packages/oats-koa-adapter/package.json
index 6b20cdec..11f7d2b6 100644
--- a/packages/oats-koa-adapter/package.json
+++ b/packages/oats-koa-adapter/package.json
@@ -42,7 +42,7 @@
     "@types/koa-router": "7.4.4",
     "@types/lodash": "4.14.195",
     "@types/node": "24.12.4",
-    "koa": "2.16.2",
+    "koa": "2.16.4",
     "koa-body": "6.0.1",
     "koa-router": "12.0.0",
     "typescript": "7.0.2"
diff --git a/packages/oats/package.json b/packages/oats/package.json
index d8cd1a1a..7932cb07 100644
--- a/packages/oats/package.json
+++ b/packages/oats/package.json
@@ -55,7 +55,7 @@
     "form-data": "4.0.6",
     "jest": "29.5.0",
     "jsverify": "0.8.4",
-    "koa": "2.16.2",
+    "koa": "2.16.4",
     "koa-body": "6.0.1",
     "koa-mount": "4.0.0",
     "koa-router": "12.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 50540dc6..307d52c7 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,8 +11,8 @@ importers:
   .:
     dependencies:
       koa:
-        specifier: 2.16.2
-        version: 2.16.2(supports-color@8.1.1)
+        specifier: 2.16.4
+        version: 2.16.4(supports-color@8.1.1)
       koa-body:
         specifier: 6.0.1
         version: 6.0.1
@@ -163,8 +163,8 @@ importers:
         specifier: 0.8.4
         version: 0.8.4
       koa:
-        specifier: 2.16.2
-        version: 2.16.2(supports-color@8.1.1)
+        specifier: 2.16.4
+        version: 2.16.4(supports-color@8.1.1)
       koa-body:
         specifier: 6.0.1
         version: 6.0.1
@@ -301,8 +301,8 @@ importers:
         specifier: 24.12.4
         version: 24.12.4
       koa:
-        specifier: 2.16.2
-        version: 2.16.2(supports-color@8.1.1)
+        specifier: 2.16.4
+        version: 2.16.4(supports-color@8.1.1)
       koa-body:
         specifier: 6.0.1
         version: 6.0.1
@@ -2700,8 +2700,8 @@ packages:
     engines: {node: '>= 12'}
     deprecated: 'Please use @koa/router instead, starting from v9! '
 
-  koa@2.16.2:
-    resolution: {integrity: sha512-+CCssgnrWKx9aI3OeZwroa/ckG4JICxvIFnSiOUyl2Uv+UTI+xIw0FfFrWS7cQFpoePpr9o8csss7KzsTzNL8Q==}
+  koa@2.16.4:
+    resolution: {integrity: sha512-3An0GCLDSR34tsCO4H8Tef8Pp2ngtaZDAZnsWJYelqXUK5wyiHvGItgK/xcSkmHLSTn1Jcho1mRQs2ehRzvKKw==}
     engines: {node: ^4.8.4 || ^6.10.1 || ^7.10.1 || >= 8.1.4}
 
   lazy-seq@1.0.0:
@@ -6293,7 +6293,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  koa@2.16.2(supports-color@8.1.1):
+  koa@2.16.4(supports-color@8.1.1):
     dependencies:
       accepts: 1.3.8
       cache-content-type: 1.0.1
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index e94624c6..bf28484b 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -4,6 +4,8 @@ packages:
 minimumReleaseAge: 10080
 minimumReleaseAgeExclude:
   - "@smartly/*"
+  # Renovate security update: koa@2.16.4
+  - koa@2.16.4
 
 # Supply chain hardening (see https://pnpm.io/settings)
 engineStrict: true