chore(deps-dev): bump hono from 4.12.34 to 4.13.5 by dependabot[bot] · Pull Request #35 · Alex1990/tiny-oss

dependabot · 2026-09-09T12:16:41Z

Bumps hono from 4.12.34 to 4.13.5.

Release notes

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.12.34 to 4.13.5. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.34...v4.13.5) --- updated-dependencies: - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

Two defects surfaced while exercising the `deps` and external-PR routes on real GitHub items (#35, #21): - write actions always used `gh issue …`, which fails on a PR task — and "PRs are a triage surface" means most tasks are PRs. The subcommand now follows `task.kind`. - `run.mjs` could only import issues, so the local coverage exercise could not create the task files the A1 sweep is meant to find. Added `--pr <n>` with the same OPEN validation as the issue path. Also: a `retry` outcome no longer proposes a label, since such a run never did any work.

…moke First real end-to-end run (all steps green, 3m05s) surfaced three things: - `LOOP_MODEL` was `deepseek/deepseek-flash`, which is not in pi's DeepSeek catalogue — the real ids are `deepseek-v4-flash`, `deepseek-v4-flash-vision-exp` and `deepseek-v4-pro`. pi **silently falls back** on an unknown `--model` rather than failing, so the run looked healthy while using an unintended model. The id is corrected, and the install step now validates it against `pi --list-models deepseek` and fails the job on a mismatch. - There was no cheap way to check the pipeline: an empty `stage` still gets the input's `default:` (`triage`), so the smoke cost 102,860 tokens. Added a `smoke` input that exercises checkout/toolchain/pi install/R2 pull+push and skips the agent — the entry to use when onboarding a repo or when a credential is in doubt. - Three comments still pointed at `scripts/loop/lib/` after the rename to `shared/`, and `run.mjs` referenced a `run-stage.mjs` that never existed. Defect log records D18-D20 as fixed and D21 (the dependabot coverage-comment 403) as open, awaiting a maintainer decision. Report-boundary compliance of the real run was verified independently — repository-wide, no item carries a loop label and #21/#35 have no comments — not from the run's own summary.

Two defects surfaced while exercising the `deps` and external-PR routes on real GitHub items (#35, #21): - write actions always used `gh issue …`, which fails on a PR task — and "PRs are a triage surface" means most tasks are PRs. The subcommand now follows `task.kind`. - `run.mjs` could only import issues, so the local coverage exercise could not create the task files the A1 sweep is meant to find. Added `--pr <n>` with the same OPEN validation as the issue path. Also: a `retry` outcome no longer proposes a label, since such a run never did any work.

… smoke First real end-to-end run (all steps green, 3m05s) surfaced three things: - `LOOP_MODEL` was `deepseek/deepseek-flash`, which is not in pi's DeepSeek catalogue — the real ids are `deepseek-v4-flash`, `deepseek-v4-flash-vision-exp` and `deepseek-v4-pro`. pi **silently falls back** on an unknown `--model` rather than failing, so the run looked healthy while using an unintended model. The id is corrected, and the install step now validates it against `pi --list-models deepseek` and fails the job on a mismatch. - There was no cheap way to check the pipeline: an empty `stage` still gets the input's `default:` (`triage`), so the smoke cost 102,860 tokens. Added a `smoke` input that exercises checkout/toolchain/pi install/R2 pull+push and skips the agent — the entry to use when onboarding a repo or when a credential is in doubt. - Three comments still pointed at `scripts/loop/lib/` after the rename to `shared/`, and `run.mjs` referenced a `run-stage.mjs` that never existed. Defect log records D18-D20 as fixed and D21 (the dependabot coverage-comment 403) as open, awaiting a maintainer decision. Report-boundary compliance of the real run was verified independently — repository-wide, no item carries a loop label and #21/#35 have no comments — not from the run's own summary.

Two defects surfaced while exercising the `deps` and external-PR routes on real GitHub items (#35, #21): - write actions always used `gh issue …`, which fails on a PR task — and "PRs are a triage surface" means most tasks are PRs. The subcommand now follows `task.kind`. - `run.mjs` could only import issues, so the local coverage exercise could not create the task files the A1 sweep is meant to find. Added `--pr <n>` with the same OPEN validation as the issue path. Also: a `retry` outcome no longer proposes a label, since such a run never did any work.

… smoke First real end-to-end run (all steps green, 3m05s) surfaced three things: - `LOOP_MODEL` was `deepseek/deepseek-flash`, which is not in pi's DeepSeek catalogue — the real ids are `deepseek-v4-flash`, `deepseek-v4-flash-vision-exp` and `deepseek-v4-pro`. pi **silently falls back** on an unknown `--model` rather than failing, so the run looked healthy while using an unintended model. The id is corrected, and the install step now validates it against `pi --list-models deepseek` and fails the job on a mismatch. - There was no cheap way to check the pipeline: an empty `stage` still gets the input's `default:` (`triage`), so the smoke cost 102,860 tokens. Added a `smoke` input that exercises checkout/toolchain/pi install/R2 pull+push and skips the agent — the entry to use when onboarding a repo or when a credential is in doubt. - Three comments still pointed at `scripts/loop/lib/` after the rename to `shared/`, and `run.mjs` referenced a `run-stage.mjs` that never existed. Defect log records D18-D20 as fixed and D21 (the dependabot coverage-comment 403) as open, awaiting a maintainer decision. Report-boundary compliance of the real run was verified independently — repository-wide, no item carries a loop label and #21/#35 have no comments — not from the run's own summary.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026

Alex1990 merged commit 88d54e1 into main Sep 10, 2026
1 of 2 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/hono-4.13.5 branch September 10, 2026 19:03

Alex1990 mentioned this pull request Sep 11, 2026

chore(loop): correct the D33 note (dependabot PRs never reach triage) #41

Merged

Navigation Menu

Repository navigation

chore(deps-dev): bump hono from 4.12.34 to 4.13.5 - #35

chore(deps-dev): bump hono from 4.12.34 to 4.13.5#35
Alex1990 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.13.5

dependabot Bot commented on behalf of github Sep 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 9, 2026

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.13.3

What's Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion