[dependabot]

Bumps hono from 4.12.27 to 4.13.7.

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
junior-docs	Error		Oct 15, 2026 4:07am UTC

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ce751e6. Configure here.}

[cursor]

Lockfile installs a second Zod

Medium Severity

This lockfile refresh pins zod@4.6.5 for injected @sentry/junior-plugin-api, @sentry/junior-linear, @sentry/junior-sentry, and @sentry/junior-vercel, and for @better-auth/core, while the catalog and every importer still resolve zod@4.5.4. Injected copies and Better Auth core therefore load a second Zod beside the app's catalog copy.

Additional Locations (2)

• pnpm-lock.yaml#L9767-L9778
• pnpm-lock.yaml#L12101-L12105

 

^{Reviewed by Cursor Bugbot for commit ce751e6. Configure here.}

[dependabot]

Superseded by #2196.