chore(deps): bump hono from 4.12.31 to 4.13.3

[dependabot]

Bumps hono from 4.12.31 to 4.13.3.

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
• fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
• feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
• fix(client): serialize multiple cookies correctly in honojs/hono#5202
• fix(etag): stabilize digest across stream chunks in honojs/hono#5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
• perf(cors): pre-join static array header options during initialization in honojs/hono#5210
• fix(client): send falsy JSON bodies in honojs/hono#5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

• fix(trie-router): count every slash a pattern consumes by @​Jaybhade in honojs/hono#5189
• fix(utils/stream): re-acquire writer lock when pipe() throws by @​Sriharsha-dev369 in honojs/hono#4988
• fix(etag): skip unsafe methods or error responses on non-* case by @​na-trium-144 in honojs/hono#5196

New Contributors

• @​Jaybhade made their first contribution in honojs/hono#5189
• @​Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

... (truncated)

Commits

• 0293343 4.13.3
• 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
• c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
• eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
• a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
• 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
• ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
• 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
• 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
• 7195c24 fix(etag): copy pending stream bytes (#5239)
• Additional commits viewable in compare view

[cursor]

PR Summary

Low Risk
Dependency-only lockfile update; hono 4.13.x is a minor release with perf and bugfix focus, with no direct app code changes.

Overview
Updates hono from 4.12.31 to 4.13.2 via pnpm-lock.yaml, along with @hono/node-server (1.19.14 → 1.19.17) as its companion adapter.

The lockfile also shifts versions for packages pulled in through @modelcontextprotocol/sdk (used by the Claude agent SDK stack)—notably jose, ajv, cors, express-rate-limit, eventsource-parser, and Express 5–related bits like content-type, cookie, range-parser, and media-typer. clearbit’s needle dependency is recorded as a git URL instead of a tarball URL (same commit). A few packages pick up new deprecated metadata in the lockfile only (@zenfs/core, crypto-js, older glob entries).

No application source changes—install graph only.

^{Reviewed by Cursor Bugbot for commit 104a9d6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 66c55c1. Configure here.}

[cursor]

Lockfile forces SSH for needle

High Severity

This lockfile rewrite changes clearbit's needle dependency from a public HTTPS tarball to a git@github.com SSH resolution (git+https://git@github.com:clearbit/needle.git). CI here runs pnpm i --frozen-lockfile without an SSH agent, so installs can fail with publickey errors even though the package is public.

Additional Locations (1)

• pnpm-lock.yaml#L15694-L15695

 

^{Reviewed by Cursor Bugbot for commit 66c55c1. Configure here.}