Skip to content

chore(deps): bump hono from 4.13.8 to 4.13.11 - #285

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.13.11
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.13.11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor

Bumps hono from 4.13.8 to 4.13.11.

Release notes

Sourced from hono's releases.

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

What's Changed

  • fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.13.8 to 4.13.11.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.8...v4.13.11)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.11
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 21, 2026
@coderabbitai

coderabbitai Bot commented Oct 21, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: strataljs/stratal/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 1d85ee3d-08b0-4ded-badb-a341804fa0d4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@adesege adesege left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark

Details
Benchmark suite Current: ecf2e47 Previous: 33a9b0d Ratio
test/benchmarks/request-response.bench.ts > Request/Response > simple GET - 200 36821.2466372957 ops/sec (±1.15%) 33571.82240506 ops/sec (±1.61%) 0.91
test/benchmarks/request-response.bench.ts > Request/Response > GET with route params - 200 41103.09318355658 ops/sec (±0.68%) 42296.20545659609 ops/sec (±0.81%) 1.03
test/benchmarks/request-response.bench.ts > Request/Response > POST with JSON body - 201 16667.716148794636 ops/sec (±1.07%) 16198.962164891995 ops/sec (±1.14%) 0.97
test/benchmarks/request-response.bench.ts > Request/Response > POST invalid body - validation error 4227.467871709107 ops/sec (±2.75%) 4357.429603749932 ops/sec (±3.06%) 1.03
test/benchmarks/request-response.bench.ts > Request/Response > GET unknown route - 404 6503.83173286527 ops/sec (±1.37%) 6242.12389221152 ops/sec (±1.41%) 0.96
src/__benchmarks__/application.bench.ts > Application - Bootstrap > constructor only 383466.3549293656 ops/sec (±0.42%) 376141.31090912863 ops/sec (±0.45%) 0.98
src/__benchmarks__/application.bench.ts > Application - Bootstrap > full initialize() 40755.98940343985 ops/sec (±0.82%) 37908.79798783361 ops/sec (±1.08%) 0.93
src/__benchmarks__/application.bench.ts > Application - Service Resolution > resolve service after bootstrap 40587.674486851865 ops/sec (±1.31%) 43880.587834925194 ops/sec (±1.35%) 1.08
src/__benchmarks__/application.bench.ts > Application - Multi-Controller Bootstrap > initialize with 5 controllers (8 routes) 44453.38423171648 ops/sec (±0.73%) 42475.946310407635 ops/sec (±0.78%) 0.96
src/__benchmarks__/application.bench.ts > Application - Multi-Controller Bootstrap > resolve service after multi-controller bootstrap 42931.60185232618 ops/sec (±3.07%) 41587.68346141239 ops/sec (±0.83%) 0.97
src/di/__benchmarks__/container.bench.ts > Container - Registration > register class provider 4299355.630255014 ops/sec (±1.54%) 4153235.8754029158 ops/sec (±0.21%) 0.97
src/di/__benchmarks__/container.bench.ts > Container - Registration > registerSingleton 4027598.429235797 ops/sec (±2.06%) 4015988.369507708 ops/sec (±1.68%) 1.00
src/di/__benchmarks__/container.bench.ts > Container - Registration > registerValue 4461819.241491024 ops/sec (±2.15%) 4484785.076131648 ops/sec (±2.09%) 1.01
src/di/__benchmarks__/container.bench.ts > Container - Registration > registerFactory 4535668.757226934 ops/sec (±2.24%) 4646900.299235859 ops/sec (±0.73%) 1.02
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve class token 1415124.2622268253 ops/sec (±0.35%) 1399508.2590134072 ops/sec (±0.43%) 0.99
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve symbol token 1436781.79884555 ops/sec (±1.27%) 1411490.9696135977 ops/sec (±1.33%) 0.98
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve value token 1977489.8022551255 ops/sec (±0.16%) 1991883.3626032965 ops/sec (±1.43%) 1.01
src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve singleton token 1401946.648523274 ops/sec (±0.38%) 1367437.3080772788 ops/sec (±0.43%) 0.98
src/di/__benchmarks__/container.bench.ts > Container - Resolution > isRegistered check 2101920.448782467 ops/sec (±0.15%) 2032039.9674906908 ops/sec (±0.13%) 0.97
src/di/__benchmarks__/container.bench.ts > Container - Conditional Binding > when().use().give().otherwise() 2484538.8571117115 ops/sec (±3.26%) 2456045.051979611 ops/sec (±2.98%) 0.99
src/di/__benchmarks__/container.bench.ts > Container - Conditional Binding > when() with cached predicate 2429864.6295509613 ops/sec (±1.75%) 2468959.111174536 ops/sec (±1.74%) 1.02
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register single module 1404945.881984545 ops/sec (±0.38%) 1288106.5547444636 ops/sec (±0.75%) 0.92
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register 3-level module tree 680811.5057308183 ops/sec (±0.37%) 670542.5811318906 ops/sec (±0.40%) 0.98
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register dynamic module (forRoot) 1192293.9499234061 ops/sec (±0.38%) 1112476.506823362 ops/sec (±0.42%) 0.93
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Initialization > initialize with lifecycle hooks 881749.5362000185 ops/sec (±0.53%) 788390.5430542759 ops/sec (±2.12%) 0.89
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllControllers 609324.2049308604 ops/sec (±0.33%) 588907.9281531516 ops/sec (±0.48%) 0.97
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllConsumers 582843.123403757 ops/sec (±0.40%) 571604.366355137 ops/sec (±1.70%) 0.98
src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllJobs 598736.4828017835 ops/sec (±0.34%) 610619.7166722866 ops/sec (±0.54%) 1.02
src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register controller with 5 OpenAPI routes 17949.88702341063 ops/sec (±7.38%) 16860.786008618084 ops/sec (±8.67%) 0.94
src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register single-route controller 85023.61212228048 ops/sec (±8.42%) 81099.36045043867 ops/sec (±8.84%) 0.95
src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register multiple controllers 19775.884059508775 ops/sec (±6.00%) 19125.92487336735 ops/sec (±6.68%) 0.97
src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 10 routes by specificity 335982.0983412874 ops/sec (±1.67%) 334136.87529524195 ops/sec (±0.63%) 0.99
src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 50 routes by specificity 63293.6679614229 ops/sec (±0.33%) 61051.61134544165 ops/sec (±0.50%) 0.96
src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 100 routes by specificity 30475.76460519449 ops/sec (±0.32%) 30273.584404234512 ops/sec (±0.43%) 0.99
src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - static path 12495182.525547713 ops/sec (±0.13%) 11702814.993550757 ops/sec (±0.12%) 0.94
src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - single param 1976575.0551981772 ops/sec (±1.43%) 1750608.2003759728 ops/sec (±1.98%) 0.89
src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - multiple params 1461724.5061186284 ops/sec (±0.32%) 1371956.2603574654 ops/sec (±0.40%) 0.94

This comment was automatically generated by workflow using github-action-benchmark.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant