chore(deps): bump hono from 4.12.9 to 4.13.5

[dependabot]

Bumps hono from 4.12.9 to 4.13.5.

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
• fix(client): skip undefined header and cookie values in honojs/hono#5244
• fix(client): skip an undefined entry inside a query array in honojs/hono#5272
• fix(client): skip an undefined entry inside a form array in honojs/hono#5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
• fix(client): omit empty query delimiter in honojs/hono#5283
• fix(request): drop stale content length for cloned FormData in honojs/hono#5282
• fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
• fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
• fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• 3a67f7f Merge commit from fork
• 9c28d72 Merge commit from fork
• 017000d 4.13.4
• 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
• 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
• c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
• 612b59c fix(request): drop stale content length for cloned FormData (#5282)
• 73794bd fix(client): omit empty query delimiter (#5283)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

---

This change is 

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5f5bbae

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• feature

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 35db7423-b5d5-4d7d-966a-68a859e9f8e3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Required label not found on this PR.

[greptile-apps]

Required label not found on this PR.

[greptile-apps]

Required label not found on this PR.

[greptile-apps]

Required label not found on this PR.

[warestack]

Warestack Governance Checks

Warestack is installed for this GitHub account, but this repository is not ready to run governance checks yet.

Warestack lets your team define, enforce, and audit engineering standards directly on GitHub pull requests without leaving your workflow.

Get started in 2 minutes:

1. Finish Warestack setup to activate governance for Dustin4444/typescript-sdk
2. Configure rules for pull request quality, CI requirements, commit conventions, and more
3. Receive automated feedback on every pull request

---

This message is posted once per new pull request while this repository is not configured.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hono@​4.13.11

View full report

[greptile-apps]

Required label not found on this PR.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[dependabot]

Superseded by #122.