chore(deps): update dependency hono to v4.13.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono (source)	4.12.34 → 4.13.5
hono (source)	^4.12.34 → ^4.13.5

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

---

Hono: Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

CVE-2026-84365 / GHSA-gqvv-2mrq-wpjv

More information

Details

Summary

The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments.

Details

Static site generation builds each output path from the route path and the values supplied through ssgParams, then verifies that the result stays inside the output directory. That check normalizes the path with the same routine that built it, and the routine did not fully collapse runs of consecutive parent-directory segments. A value carrying enough of them produces a path the check accepts, but the filesystem resolves outside the output directory.

The earlier fix handled a single parent-directory segment, so it blocks the sequence reported at the time while leaving longer runs unhandled. The check also treated output directories that differ only in how they are rooted as equivalent.

This arises when an application generates a static site from route parameter values it does not fully control — slugs coming from a CMS, an API, or user submissions.

Impact

A value reaching ssgParams from an untrusted source can cause build output to be written outside the intended output directory, carrying whatever content the route handler produced.

This may lead to:

• files being created or overwritten elsewhere in the build environment
• generated artifacts or deployment output being altered

This affects build-time static site generation only; request-time routing is not affected. Applications whose ssgParams values are entirely developer-controlled are not affected.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv
• https://nvd.nist.gov/vuln/detail/CVE-2026-84365
• https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221
• https://github.com/honojs/hono/releases/tag/v4.13.5
• https://github.com/advisories/GHSA-gqvv-2mrq-wpjv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

CVE-2026-84363 / GHSA-crvj-82cr-hjcx

More information

Details

Summary

Hono's query parsing does not stop at the URL fragment: a ? appearing after a # is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see.

Details

A fragment is never part of the query, and every standard URL consumer — browsers, new URL(), reverse proxies — ignores everything from the first # onward. Hono's routing followed that rule; its query helpers did not.

For one and the same request, this produces an interpretation differential:

• A component in front of the application that inspects the query string — filtering rules, parameter allow/deny lists, access logging — observes no parameters, while the application reads and acts on them.
• The cache middleware removed the fragment when building its cache key, so a response influenced by parameters carried inside the fragment could be stored under a key that did not reflect them and later returned to other users.

The same divergence reaches request validation and any middleware that reads query parameters.

This requires a request target containing a literal # to reach the application. Deployments on runtimes that normalise such a target — including Cloudflare Workers — are not affected, and neither are those behind an intermediary that strips the fragment.

Impact

An attacker can cause the application to act on parameters that components in front of it never observe.

This may lead to:

• filtering rules, allow/deny lists, and audit logging being blind to parameters the application still processes
• a cached response being stored under a key that does not reflect the parameters used to produce it, and served to other users
• stored cross-site scripting, where such a parameter is reflected into a cached HTML response without escaping

This issue affects applications that read query parameters and run on a runtime that passes a literal # through to the request URL.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx
• https://nvd.nist.gov/vuln/detail/CVE-2026-84363
• https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc
• https://github.com/honojs/hono/releases/tag/v4.13.5
• https://github.com/advisories/GHSA-crvj-82cr-hjcx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Hono: Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

CVE-2026-84364 / GHSA-g6gw-c38x-mqfc

More information

Details

Summary

When parseBody() expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent requests can exhaust the heap and terminate the process.

Details

Each dot-separated segment of a field name creates an intermediate object. Neither the segments within a single field name nor the total across a request was bounded, and empty segments were preserved, so a field name could encode one nesting level per byte.

Both shapes produce the effect: a single deeply dotted field name, and a large number of shallowly dotted ones within one body. A request body size limit does not prevent it, because the amplification happens after the body has been accepted.

Dot-notation parsing is not enabled by default.

Impact

An attacker who can reach an endpoint that parses request bodies with dot-notation enabled can send concurrent requests whose memory cost is disproportionate to their size.

This may lead to:

• exhaustion of the JavaScript heap and termination of the server process
• the service remaining unavailable until it is restarted

This issue affects applications that explicitly enable dot-notation parsing. Applications using the default behaviour are not affected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc
• https://nvd.nist.gov/vuln/detail/CVE-2026-84364
• https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178
• https://github.com/honojs/hono/releases/tag/v4.13.5
• https://github.com/advisories/GHSA-g6gw-c38x-mqfc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/hono (hono)

v4.13.5

Compare Source

v4.13.4

Compare Source

v4.13.3

Compare Source

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in #​5227
• fix(etag): copy pending stream bytes in #​5239
• fix(etag): avoid skipping headers when filtering 304 response headers in #​5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in #​5235
• docs(context): add custom headers append option example to Context JSDoc in #​5248
• fix(trie-router): match suffix wildcard routes in #​5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in #​5252
• fix(csrf): exempt OPTIONS request from CSRF validation in #​5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in #​5247
• feat(pretty-json): support structured JSON content-types (+json) in #​5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

Compare Source

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in #​5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in #​5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in #​5199
• fix(client): serialize multiple cookies correctly in #​5202
• fix(etag): stabilize digest across stream chunks in #​5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in #​5209
• perf(cors): pre-join static array header options during initialization in #​5210
• fix(client): send falsy JSON bodies in #​5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in #​5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

Compare Source

v4.13.0

Compare Source

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in #​5118
• perf(url): replace regex tests with indexOf #​5121
• perf(context): skip Headers creation when there are no headers to merge #​5122
• perf(urls): refactor tryDecodeURIComponent #​5158
• perf(request): allocate #validatedData lazily #​5175
• perf(request): probe the body cache without allocating #​5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()

app.query('/search', async (c) => {
  const conditions = await c.req.json()
  return c.json(await search(conditions))
})

Thanks @​shellhaki!

QUERY support across built-in middleware

The built-in middleware has been updated to handle QUERY requests properly:

Cache Middleware

The Cache Middleware now caches QUERY responses. Following RFC 10008 Section 2.7, the cache key incorporates a SHA-256 digest of the request content and its representation metadata, so different query bodies are cached separately:

app.query(
  '/search',
  cache({
    cacheName: 'search-cache',
    cacheControl: 'max-age=3600',
  })
)

Note: To support this, the internal cache key format has changed for all methods, including GET. Cached entries are now stored under an internal URL of the form /.hono/cache?__hono_cache_key=.... If you purge cache entries by URL outside of the middleware (e.g. calling caches.delete() with the original request URL), you will need to update that logic. Existing cache entries stored with the old format will simply be re-fetched.

ETag Middleware

The ETag Middleware now handles conditional requests for QUERY, returning 304 Not Modified when If-None-Match matches.

CORS Middleware

The CORS Middleware now includes QUERY in the default Access-Control-Allow-Methods, which is now GET, HEAD, PUT, POST, DELETE, PATCH, QUERY. If you specify allowMethods explicitly, nothing changes for you.

Thanks @​usualoma and @​Cherry!

Method Not Allowed Middleware

The new Method Not Allowed Middleware returns a 405 Method Not Allowed response with a proper Allow header when the request path matches a registered route but the method does not:

import { methodNotAllowed } from 'hono/method-not-allowed'

const app = new Hono()

app.use(methodNotAllowed({ app }))

app.get('/hello', (c) => c.text('Hello!'))
app.post('/hello', (c) => c.text('Posted!'))

// PUT /hello -> 405 Method Not Allowed
// Allow: GET, HEAD, POST

You can customize the response with the onMethodNotAllowed option:

app.use(
  methodNotAllowed({
    app,
    onMethodNotAllowed: (c, methods) =>
      c.json({ error: 'Method Not Allowed' }, 405, { Allow: methods.join(', ') }),
  })
)

Thanks @​usualoma!

RegExpRouter throws UnsupportedPathError at registration time

The RegExpRouter now detects unsupported path combinations when routes are registered, instead of at the first matching request. This means misconfigured routes fail fast at startup rather than at runtime. As a bonus, registration plus the first match is roughly 20% faster.

Thanks @​usualoma!

Other improvements

• hono/utils/headers has been synced with the IANA HTTP Field Name Registry, adding newly registered fields such as Accept-Query. Thanks @​akahoshi1421!
• The JWT and JWK middleware now accept a realm option for the WWW-Authenticate challenge on 401 responses, and challenge values are properly escaped. Thanks @​arhxam!
• JSX: useRef and RefObject are now aligned with React 19. Note that this is a type-level change — RefObject<T> is now { current: T }, so type a nullable ref as RefObject<T | null>, and pass useRef(undefined) instead of useRef(). Thanks @​ashunar0!
• JSX: a function component can now return an array of children without throwing during server-side rendering. Thanks @​natsuki-engr!
• The Compress Middleware now sets Vary: Accept-Encoding on negotiated responses. Thanks @​arhxam!

All changes

• perf(hono-base): avoid rest parameter in fetch by @​yusukebe in #​5113
• perf(context): iterate the header record with for..in by @​yusukebe in #​5118
• perf(url/request): replace regex tests with indexOf by @​yusukebe in #​5121
• perf(context): skip Headers creation when there are no headers to merge by @​yusukebe in #​5122
• perf(urls): refactor tryDecodeURIComponent by @​yusukebe in #​5158
• chore(benchmarks): correct src path on Windows, add json and middleware cases by @​kibertoad in #​5173
• perf(context): drop the throwaway env field initializer by @​kibertoad in #​5174
• perf(request): allocate #validatedData lazily by @​kibertoad in #​5175
• perf(request): probe the body cache without allocating by @​kibertoad in #​5176
• chore(benchmarks): stabilize measurements by forcing mitata batching by @​yusukebe in #​5183
• perf(hono-base): restore the rest parameter in fetch by @​yusukebe in #​5184
• perf(context): restore the env field initializer by @​yusukebe in #​5186
• feat: add first-class QUERY method support by @​shellhaki in #​5070
• feat(etag): support conditional requests for the QUERY method by @​Cherry in #​5111
• feat(cors): allow QUERY by default as a first-class method by @​usualoma in #​5115
• feat(cache): add first-class support for QUERY requests by @​usualoma in #​5119
• feat(jsx): add React-compatible overloads to useRef by @​ashunar0 in #​5063
• feat(middleware): add method-not-allowed middleware by @​usualoma in #​5132
• feat(jwt,jwk): add a configurable WWW-Authenticate realm by @​arhxam in #​5141
• feat(utils/headers): sync HTTP field types with the IANA registry by @​akahoshi1421 in #​5153
• fix(jsx): allow a function component to return an array by @​natsuki-engr in #​5179
• feat(reg-exp-router): throw UnsupportedPathError during route registration by @​usualoma in #​5171
• fix(compress): set Vary: Accept-Encoding on negotiated responses by @​arhxam in #​5137

Full Changelog: honojs/hono@v4.12.34...v4.13.0

Thank you to all contributors!

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	loopover-ui	25560a7	Sep 11 2026, 03:36 AM

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

❌ 5 Tests Failed:

Tests completed	Failed	Passed	Skipped
26802	5	26797	21

View the top 3 failed test(s) by shortest run time

test/unit/retention.test.ts > runRetentionPrune + processJob > processJob prune-retention deletes, dedupes signal_snapshots, and audits both

Stack Traces | 0.0513s run time

AssertionError: expected +0 to be 1 // Object.is equality

- Expected
+ Received

- 1
+ 0

 ❯ test/unit/retention.test.ts:742:69

test/unit/operator-dashboard.test.ts > operator dashboard payload > wires computeFindingAcceptance into the dashboard's acceptance card shape (#1967/#5213)

Stack Traces | 0.112s run time

AssertionError: expected { windowDays: 90, accepted: +0, …(2) } to deeply equal { windowDays: 90, accepted: 1, …(2) }

- Expected
+ Received

  {
-   "accepted": 1,
-   "rate": 0.5,
-   "total": 2,
+   "accepted": 0,
+   "rate": null,
+   "total": 0,
    "windowDays": 90,
  }

 ❯ test/unit/operator-dashboard.test.ts:298:32

test/unit/routes-gate-outcome-breakdown.test.ts > GET /v1/app/maintainer-dashboard gateOutcomeBreakdown (#2203) > excludes non-terminal and non-gate audit rows from gateOutcomeBreakdown totals

Stack Traces | 0.116s run time

AssertionError: expected { windowDays: 30, …(5) } to match object { total: 1, counts: { …(3) } }
(7 matching properties omitted from actual)

- Expected
+ Received

  {
    "counts": {
      "autoClosed": 0,
-     "autoMerged": 1,
+     "autoMerged": 0,
      "held": 0,
    },
-   "total": 1,
+   "total": 0,
  }

 ❯ test/unit/routes-gate-outcome-breakdown.test.ts:147:56

test/unit/signals.test.ts > world-class backend signals > covers issue lifecycle, review intelligence, registry diffs, and maintainer forecast boundaries

Stack Traces | 0.125s run time

AssertionError: expected [ 'valid_solved', 'stale', …(3) ] to deeply equal ArrayContaining{…}

- Expected
+ Received

- ArrayContaining [
-   "duplicate",
-   "invalid",
+ [
    "valid_solved",
+   "stale",
    "closed_not_solved",
-   "open",
+   "duplicate",
+   "invalid",
  ]

 ❯ test/unit/signals.test.ts:1452:58

test/unit/routes-gate-outcome-breakdown.test.ts > GET /v1/app/maintainer-dashboard gateOutcomeBreakdown (#2203) > surfaces repo-scoped gate-outcome counts on qualityDashboard for an owner session

Stack Traces | 0.254s run time

AssertionError: expected { windowDays: 30, …(5) } to match object { windowDays: 30, total: 3, …(2) }
(2 matching properties omitted from actual)

- Expected
+ Received

  {
    "counts": {
-     "autoClosed": 1,
-     "autoMerged": 1,
-     "held": 1,
+     "autoClosed": 0,
+     "autoMerged": 0,
+     "held": 0,
    },
    "rates": {
-     "autoClosed": 33.3,
-     "autoMerged": 33.3,
-     "held": 33.3,
+     "autoClosed": null,
+     "autoMerged": null,
+     "held": null,
    },
-   "total": 3,
+   "total": 0,
    "windowDays": 30,
  }

 ❯ test/unit/routes-gate-outcome-breakdown.test.ts:79:56

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}