[dependabot]

Bumps hono from 4.13.4 to 4.13.11.

Release notes

Sourced from hono's releases.

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in honojs/hono#5433
• chore(package.json): invoke package scripts through pnpm instead of bun in honojs/hono#5434
• chore: replace prettier with oxfmt in honojs/hono#5435
• chore(deps): upgrade vitest to 5.0.1 in honojs/hono#5437
• chore: let oxfmt sort imports instead of eslint in honojs/hono#5442
• chore: replace eslint with oxlint in honojs/hono#5443
• chore: introduce Vite+ in honojs/hono#5444
• fix(types): allow returning a Blob as a response body in honojs/hono#5446
• chore: convert build scripts into plugins in honojs/hono#5448
• chore: stop editorconfig-checker from checking Markdown indent size in honojs/hono#5455
• ci: remove empty step left in cr.yml by the pnpm migration in honojs/hono#5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in honojs/hono#5459
• feat(adapters): add @​hono/bun as a workspace package in honojs/hono#5447
• chore(adapters/bun): ship ESM only in honojs/hono#5462
• feat(adapters): add the seven adapters as workspace packages in honojs/hono#5463
• feat(adapters/deno): publish to JSR in honojs/hono#5465
• test: move adapter runtime tests into adapters/* in honojs/hono#5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380

... (truncated)

Commits

• 37ce069 4.13.11
• 1e1207c test(serve-static): fix the test (#5479)
• 8b05c77 Merge commit from fork
• 18331a9 chore(adapters): release @​hono/netlify@​1.0.1
• 6cd583b chore(adapters): release @​hono/deno@​1.0.2
• 271dd0b ci: write the tag version into deno.json before publishing to JSR (#5469)
• ae93026 chore(adapters): release @​hono/deno@​1.0.1
• 72f0d8d feat(adapters/netlify): publish to JSR (#5468)
• f3d5e88 4.13.10
• 645ddd6 test: move adapter runtime tests into adapters/* (#5466)
• Additional commits viewable in compare view

[defangdevs]

Closing as superseded — dependabot recreated this same bump (hono 4.13.4 → 4.13.11 in apps/api) as #59, which is already being worked on. No need to fix both; CI fails here for the same reasons being addressed there.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.