Update non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server	2.1.1 → 2.1.3
@types/node (source)	24.13.3 → 24.19.1
hono (source)	4.13.5 → 4.13.13
tsx (source)	4.23.13 → 4.23.15

---

Release Notes

honojs/node-server (@​hono/node-server)

v2.1.3

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

Compare Source

What's Changed

• ci: add autofix.ci by @​yusukebe in #​392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in #​390
• chore: add better benchmarks by @​BlankParticle in #​391
• docs(readme): update the benchmark by @​yusukebe in #​394
• test(request): accept asynchronous body read errors by @​usualoma in #​403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in #​402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

honojs/hono (hono)

v4.13.13

Compare Source

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'

const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))

const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in #​5439
• docs(request): fix jsdoc comments for some getters in #​5445
• fix(jsx): allow JSXNode function component results in #​5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in #​5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

Compare Source

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in #​5485
• test(build): type-check the bundled declarations from a consumer project in #​5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in #​5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in #​5487
• fix(combine): return a Response from a short-circuiting middleware in some() in #​5391
• chore(deps): upgrade vite-plus to 1.0.0 in #​5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Compare Source

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in #​5433
• chore(package.json): invoke package scripts through pnpm instead of bun in #​5434
• chore: replace prettier with oxfmt in #​5435
• chore(deps): upgrade vitest to 5.0.1 in #​5437
• chore: let oxfmt sort imports instead of eslint in #​5442
• chore: replace eslint with oxlint in #​5443
• chore: introduce Vite+ in #​5444
• fix(types): allow returning a Blob as a response body in #​5446
• chore: convert build scripts into plugins in #​5448
• chore: stop editorconfig-checker from checking Markdown indent size in #​5455
• ci: remove empty step left in cr.yml by the pnpm migration in #​5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in #​5459
• feat(adapters): add @​hono/bun as a workspace package in #​5447
• chore(adapters/bun): ship ESM only in #​5462
• feat(adapters): add the seven adapters as workspace packages in #​5463
• feat(adapters/deno): publish to JSR in #​5465
• test: move adapter runtime tests into adapters/* in #​5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

Compare Source

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in #​5380
• fix(accepts): match media types and language tags case-insensitively in #​5376
• fix(linear-router): don't match an empty path segment as a param in #​5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in #​5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in #​5379
• fix(aws-lambda): treat binary +xml archive media types as binary in #​5424
• fix(aws-lambda): preserve empty query parameters in #​5292
• fix(lambda-edge): sync content type detection with aws-lambda in #​5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in #​5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

Compare Source

What's Changed

• docs: fix typos in code comments and link third-party middleware section in #​5343
• perf(jsx/dom): reduce lookup work for large keyed updates in #​5340
• fix(aws-lambda): respect backpressure when streaming the response body in #​5351
• fix(accepts, language): skip accept entries with quality 0 when matching in #​5311
• fix(accept): treat the q parameter name as case-insensitive in #​5349
• fix(accept): clamp a negative q to 0, not 1 in #​5357
• fix(request): keep the request media type when reusing a cached body in #​5366
• docs(combine): fix except() JSDoc param and add missing @​returns in #​5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in #​5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Compare Source

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

Compare Source

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in #​5297
• fix(client): normalize root WebSocket URLs in #​5291
• fix(types): allow symbol keys in Context get and set fallbacks in #​5300
• chore: bump editorconfig-checker in #​5336
• refactor(on-handler): use forEach for consistent handler iteration in #​5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

privatenumber/tsx (tsx)

v4.23.15

Compare Source

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

Compare Source

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#​802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 12:00 on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.