Skip to content

chore(deps): bump hono from 4.12.30 to 4.13.5 - #262

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.13.5
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.13.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps hono from 4.12.30 to 4.13.5.

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc


Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
  • fix(client): skip undefined header and cookie values in honojs/hono#5244
  • fix(client): skip an undefined entry inside a query array in honojs/hono#5272
  • fix(client): skip an undefined entry inside a form array in honojs/hono#5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
  • fix(client): omit empty query delimiter in honojs/hono#5283
  • fix(request): drop stale content length for cloned FormData in honojs/hono#5282
  • fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
  • fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
  • fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits
  • 06880c4 4.13.5
  • 531e9c5 Merge commit from fork
  • 3a67f7f Merge commit from fork
  • 9c28d72 Merge commit from fork
  • 017000d 4.13.4
  • 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
  • 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
  • c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
  • 612b59c fix(request): drop stale content length for cloned FormData (#5282)
  • 73794bd fix(client): omit empty query delimiter (#5283)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.12.30 to 4.13.5.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.30...v4.13.5)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 9, 2026
@coderabbitai

coderabbitai Bot commented Sep 9, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 463ebd10-95b3-4c9b-b747-4d2f5ebeb5ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@adesege adesege left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark

Details
Benchmark suite Current: 961d858 Previous: ccb3f17 Ratio
test/benchmarks/request-response.bench.ts > Request/Response > simple GET - 200 49262.82399786543 ops/sec (±2.68%) 44355.827899388205 ops/sec (±1.52%) 0.90
test/benchmarks/request-response.bench.ts > Request/Response > GET with route params - 200 56250.51318643537 ops/sec (±0.94%) 49077.55133303189 ops/sec (±1.07%) 0.87
test/benchmarks/request-response.bench.ts > Request/Response > POST with JSON body - 201 27493.38046416375 ops/sec (±1.21%) 24127.579263272528 ops/sec (±1.28%) 0.88
test/benchmarks/request-response.bench.ts > Request/Response > POST invalid body - validation error 4426.7719868902805 ops/sec (±2.93%) 4332.798367697519 ops/sec (±3.08%) 0.98
test/benchmarks/request-response.bench.ts > Request/Response > GET unknown route - 404 7655.1735627725 ops/sec (±1.34%) 6877.491973422911 ops/sec (±1.38%) 0.90
src/__benchmarks__/application.bench.ts > Application - Bootstrap > constructor only 320998.2993510194 ops/sec (±2.77%) 367439.1967778971 ops/sec (±2.58%) 1.14
src/__benchmarks__/application.bench.ts > Application - Bootstrap > full initialize() 38373.607361251496 ops/sec (±2.03%) 40916.51636711715 ops/sec (±2.82%) 1.07
src/__benchmarks__/application.bench.ts > Application - Service Resolution > resolve service after bootstrap 44738.96223502935 ops/sec (±1.40%) 46221.77899438597 ops/sec (±1.51%) 1.03
src/__benchmarks__/application.bench.ts > Application - Multi-Controller Bootstrap > initialize with 5 controllers (8 routes) 47378.47007973655 ops/sec (±0.84%) 47297.584538015675 ops/sec (±0.94%) 1.00
src/__benchmarks__/application.bench.ts > Application - Multi-Controller Bootstrap > resolve service after multi-controller bootstrap 46365.29228017831 ops/sec (±0.93%) 46712.398512126 ops/sec (±0.86%) 1.01
src/di/__benchmarks__/container.bench.ts > Container - Registration > register class provider 4448851.4394445205 ops/sec (±1.59%) 3659523.004609583 ops/sec (±0.26%) 0.82
src/di/__benchmarks__/container.bench.ts > Container - Registration > registerSingleton 4114089.63796015 ops/sec (±2.25%) 3674735.919157303 ops/sec (±0.23%) 0.89
src/di/__benchmarks__/container.bench.ts > Container - Registration > registerValue 4632640.851105602 ops/sec (±0.76%) 3643329.0527346027 ops/sec (±0.97%) 0.79
src/di/__benchmarks__/container.bench.ts > Container - Registration > registerFactory 4530810.550140439 ops/sec (±2.23%) 3731349.291036125 ops/sec (±0.79%) 0.82
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve class token 1478752.3674579472 ops/sec (±0.52%) 1231183.1036989056 ops/sec (±0.71%) 0.83
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve symbol token 1437585.936742411 ops/sec (±1.49%) 1316018.4734202325 ops/sec (±0.72%) 0.92
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve value token 2022409.102046685 ops/sec (±1.49%) 1783899.5774658315 ops/sec (±0.30%) 0.88
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve singleton token 1399997.3616021737 ops/sec (±0.58%) 1315930.5814242992 ops/sec (±0.55%) 0.94
src/di/__benchmarks__/container.bench.ts > Container - Resolution > isRegistered check 2132287.6076637027 ops/sec (±0.21%) 1806360.778904609 ops/sec (±0.19%) 0.85
src/di/__benchmarks__/container.bench.ts > Container - Conditional Binding > when().use().give().otherwise() 2619666.5329843485 ops/sec (±3.27%) 1989351.3462046375 ops/sec (±2.25%) 0.76
src/di/__benchmarks__/container.bench.ts > Container - Conditional Binding > when() with cached predicate 2552301.147523273 ops/sec (±0.73%) 2077218.3049918814 ops/sec (±0.64%) 0.81
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register single module 1329959.8882833403 ops/sec (±0.44%) 1318623.2747570868 ops/sec (±0.43%) 0.99
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register 3-level module tree 675192.4511084221 ops/sec (±0.59%) 674368.8967327109 ops/sec (±0.61%) 1.00
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register dynamic module (forRoot) 1121858.9521838368 ops/sec (±0.47%) 1033574.8692689876 ops/sec (±0.46%) 0.92
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Initialization > initialize with lifecycle hooks 807002.463466829 ops/sec (±0.74%) 861264.3797109328 ops/sec (±0.67%) 1.07
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllControllers 607308.5169525032 ops/sec (±0.70%) 601067.2979531069 ops/sec (±0.70%) 0.99
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllConsumers 593497.0242906351 ops/sec (±3.24%) 598005.5897686194 ops/sec (±2.06%) 1.01
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllJobs 608083.2386801501 ops/sec (±0.50%) 606220.5693193878 ops/sec (±0.44%) 1.00
src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register controller with 5 OpenAPI routes 19829.23962797718 ops/sec (±7.96%) 20659.201604495036 ops/sec (±7.81%) 1.04
src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register single-route controller 90895.87456369643 ops/sec (±9.13%) 87549.06480088776 ops/sec (±9.59%) 0.96
src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register multiple controllers 20201.448759343733 ops/sec (±7.35%) 20055.348642388202 ops/sec (±7.48%) 0.99
src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 10 routes by specificity 365993.19920692994 ops/sec (±1.76%) 348297.84898624144 ops/sec (±1.02%) 0.95
src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 50 routes by specificity 65325.54559551136 ops/sec (±1.09%) 66342.982298651 ops/sec (±0.49%) 1.02
src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 100 routes by specificity 32461.462503102743 ops/sec (±0.49%) 32949.193140155745 ops/sec (±0.54%) 1.02
src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - static path 12289943.705056341 ops/sec (±0.11%) 12503091.774915366 ops/sec (±0.09%) 1.02
src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - single param 2175982.1939345715 ops/sec (±0.59%) 2209847.5226742206 ops/sec (±1.46%) 1.02
src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - multiple params 1617581.8026563008 ops/sec (±0.49%) 1332989.981337998 ops/sec (±0.60%) 0.82

This comment was automatically generated by workflow using github-action-benchmark.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant