chore(deps): bump the production-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the production-minor-patch group with 3 updates in the / directory: @anthropic-ai/sdk, @hono/node-server and hono.

Updates @anthropic-ai/sdk from 0.125.0 to 0.129.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.129.0

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

sdk: v0.128.0

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.129.0 (2026-09-28)

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

0.128.0 (2026-09-22)

... (truncated)

Commits

• bf20586 Merge pull request #1218 from anthropics/release-please--branches--main--chan...
• da41a5a chore: release main
• 3a79b93 codegen metadata
• 4e77366 feat(api): add claude-sonnet-5-5
• 2c1d2d7 feat(api): add ClientToolUnion type for client-executed tools
• f9d3e98 fix(client): send upload filenames as given, with no placeholder
• 8ac4a26 feat(api): add typed event type values to the Managed Agents events list filter
• 083969b feat(tools): optionally start tool calls while the reply streams
• 9505bf3 codegen metadata
• b84783b fix(client): also send X-Stainless-Timeout for client-level timeouts
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.1 to 2.1.3

Release notes

Sourced from @​hono/node-server's releases.

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

• ci: add autofix.ci by @​yusukebe in honojs/node-server#392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in honojs/node-server#390
• chore: add better benchmarks by @​BlankParticle in honojs/node-server#391
• docs(readme): update the benchmark by @​yusukebe in honojs/node-server#394
• test(request): accept asynchronous body read errors by @​usualoma in honojs/node-server#403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits

• 720ac78 2.1.3
• 9821792 Merge commit from fork
• 35bca95 2.1.2
• 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
• fe7467c test(request): accept asynchronous body read errors (#403)
• 64dc09e docs(readm): update the benchmark (#394)
• 8f505ae chore: add better benchmarks (#391)
• 2469b1a fix: type error in early hints and add typecheck to CI (#390)
• 3f958da ci: add autofix.ci (#392)
• See full diff in compare view

Updates hono from 4.13.8 to 4.13.11

Release notes

Sourced from hono's releases.

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in honojs/hono#5433
• chore(package.json): invoke package scripts through pnpm instead of bun in honojs/hono#5434
• chore: replace prettier with oxfmt in honojs/hono#5435
• chore(deps): upgrade vitest to 5.0.1 in honojs/hono#5437
• chore: let oxfmt sort imports instead of eslint in honojs/hono#5442
• chore: replace eslint with oxlint in honojs/hono#5443
• chore: introduce Vite+ in honojs/hono#5444
• fix(types): allow returning a Blob as a response body in honojs/hono#5446
• chore: convert build scripts into plugins in honojs/hono#5448
• chore: stop editorconfig-checker from checking Markdown indent size in honojs/hono#5455
• ci: remove empty step left in cr.yml by the pnpm migration in honojs/hono#5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in honojs/hono#5459
• feat(adapters): add @​hono/bun as a workspace package in honojs/hono#5447
• chore(adapters/bun): ship ESM only in honojs/hono#5462
• feat(adapters): add the seven adapters as workspace packages in honojs/hono#5463
• feat(adapters/deno): publish to JSR in honojs/hono#5465
• test: move adapter runtime tests into adapters/* in honojs/hono#5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380

... (truncated)

Commits

• 37ce069 4.13.11
• 1e1207c test(serve-static): fix the test (#5479)
• 8b05c77 Merge commit from fork
• 18331a9 chore(adapters): release @​hono/netlify@​1.0.1
• 6cd583b chore(adapters): release @​hono/deno@​1.0.2
• 271dd0b ci: write the tag version into deno.json before publishing to JSR (#5469)
• ae93026 chore(adapters): release @​hono/deno@​1.0.1
• 72f0d8d feat(adapters/netlify): publish to JSR (#5468)
• f3d5e88 4.13.10
• 645ddd6 test: move adapter runtime tests into adapters/* (#5466)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions