chore(deps): bump hono from 4.13.13 to 4.13.16 (#3647)

Bumps [hono](https://github.com/honojs/hono) from 4.13.13 to 4.13.16.
e notes</summary>
<p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p>
<blockquote>
<h2>v4.13.16</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3><code>mount()</code> and <code>app.mount()</code> can forward a path that bypasses middleware scoped inside the mount prefix</h3>
<p>Affects: <code>mount()</code> in <code>hono/mount</code> and <code>app.mount()</code>. A dynamic prefix such as <code>/api/:tenant/*</code> was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded <code>\</code> became <code>/</code> and <code>..</code> collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as <code>/assets*</code> and duplicate parameter names now throw. GHSA-4m76-xfj5-7975</p>
<h3>RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator</h3>
<p>Affects: <code>RegExpRouter</code>, including the default <code>SmartRouter</code>. Wildcard middleware was not applied in three cases: a parameter written as <code>{[^/]+}</code> in the middleware path only, a <code>/prefix*</code> route next to <code>/prefix/*</code> middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as <code>{[0-9]*}</code>, throw <code>UnsupportedPathError</code>. Regenerate <code>PreparedRegExpRouter</code> data. GHSA-h7mg-cq63-vhpq</p>
<h3><code>validator('form')</code> skips validation for <code>multipart/form-data</code> requests with extra parameters</h3>
<p>Affects: <code>validator('form')</code> in <code>hono/validator</code>. A <code>multipart/form-data</code> request with an extra parameter such as <code>charset</code> was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v</p>
<h3><code>css</code> helper does not escape a closing tag assembled from template parts and values, allowing HTML injection</h3>
<p>Affects: <code>css</code> in <code>hono/css</code>. A <code>&lt;/style&gt;</code> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6</p>
<h3><code>csrf()</code> does not check requests sent by hyperlink auditing (<code>text/ping</code>)</h3>
<p>Affects: <code>csrf()</code> in <code>hono/csrf</code>. A POST sent by Chromium's <code>&lt;a ping&gt;</code> has the content type <code>text/ping</code> and was not checked against <code>Origin</code> and <code>Sec-Fetch-Site</code>. GHSA-46wx-v44x-9hh2</p>
<hr />
<p>Users who rely on path-scoped middleware with <code>mount()</code>, wildcard middleware with the default router, <code>validator('form')</code>, the <code>css</code> helper with untrusted values, or <code>csrf()</code> are strongly encouraged to upgrade to this version.</p>
<h2>What's Changed</h2>
<ul>
<li>fix(jwt): reject a signature segment outside the base64url alphabet and a header with <code>crit</code> in <a href="https://redirect.github.com/honojs/hono/pull/5597">honojs/hono#5597</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.13.15...v4.13.16">https://github.com/honojs/hono/compare/v4.13.15...v4.13.16</a></p>
<h2>v4.13.15</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(auth): escape backslashes in the WWW-Authenticate realm by <a href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5590">honojs/hono#5590</a></li>
<li>docs(contributing): drop the note about linking a fork branch by <a href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5593">honojs/hono#5593</a></li>
<li>fix(context): allow <code>c.header()</code> after the response body is consumed by <a href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5587">honojs/hono#5587</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.13.14...v4.13.15">https://github.com/honojs/hono/compare/v4.13.14...v4.13.15</a></p>
<h2>v4.13.14</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contributing): ask for issues instead of RPs <a href="https://redirect.github.com/honojs/hono/pull/5526">honojs/hono#5526</a></li>
<li>docs(readme): sync the contributing list with CONTRIBUTING.md <a href="https://redirect.github.com/honojs/hono/pull/5527">honojs/hono#5527</a></li>
<li>fix(adapters): accept Hono v5 prereleases in the <code>hono</code> peer range <a href="https://redirect.github.com/honojs/hono/pull/5537">honojs/hono#5537</a></li>
<li>chore: unified oxfmt and oxlint config <a href="https://redirect.github.com/honojs/hono/pull/5518">honojs/hono#5518</a></li>
<li>docs(readme): remove the deepwiki badge <a href="https://redirect.github.com/honojs/hono/pull/5548">honojs/hono#5548</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/honojs/hono/commit/c91b60a251186fb024557c6d55a11d8e388f179c"><code>c91b60a</code></a> 4.13.16</li>
<li><a href="https://github.com/honojs/hono/commit/e1dd58856eea8c3e91494ca6a12578325b01cf46"><code>e1dd588</code></a> fix(jwt): reject a signature segment outside the base64url alphabet and a hea...</li>
<li><a href="https://github.com/honojs/hono/commit/bf16471913b5199212dac33f5d170f94745dd26a"><code>bf16471</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/d88fab372415277a9e540e895650943dd08eef4a"><code>d88fab3</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/34f90432a1794b28e52802670efcd01963f716d6"><code>34f9043</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/8a103aa59bcfbffd5396b1548a0dff3688777c36"><code>8a103aa</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/15bbd96ad1b62a0b189db4fd8dc7bf8ef280c513"><code>15bbd96</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/3cb29de8f110654c37aa9b4c7eccdeae5254f5f2"><code>3cb29de</code></a> 4.13.15</li>
<li><a href="https://github.com/honojs/hono/commit/17ad0e21f5a91c939eeafa3df05793a8ea60f016"><code>17ad0e2</code></a> fix(context): allow <code>c.header()</code> after the response body is consumed (<a href="https://redirect.github.com/honojs/hono/issues/5587">#5587</a>)</li>
<li><a href="https://github.com/honojs/hono/commit/ee88684625077a2cd0e2f4613e593e2635ffe4c7"><code>ee88684</code></a> docs(contributing): drop the note about linking a fork branch (<a href="https://redirect.github.com/honojs/hono/issues/5593">#5593</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.13.13...v4.13.16">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.13.13&new-version=4.13.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ClickHouse/ClickStack/network/alerts).

</details>

Author: dependabot[bot]

yarn.lock

@@ -19290,9 +19290,9 @@ __metadata:
   linkType: hard
 
 "hono@npm:^4.11.4":
-  version: 4.13.13
-  resolution: "hono@npm:4.13.13"
-  checksum: 10c0/c8524e685a59b4f23a9bea15385eeac5622218949db251cb871b20fd9ef673b751b44ccdee6c22b3df56e5ed4c1b1cebad17b518bdc1823039da39b53ef9c1cf
+  version: 4.13.16
+  resolution: "hono@npm:4.13.16"
+  checksum: 10c0/8a06f1d49bb98fd38a2bc4d5c1f5410b4c5a9fbe2dff85fbad2191a1b55fde93b64b63b2deba97d3e241630aedd800c57d1f4dc539e5f93ece81809fa63cbed9
   languageName: node
   linkType: hard