[dependabot]

Bumps hono from 4.10.7 to 4.13.12.

Release notes

Sourced from hono's releases.

v4.13.12

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
• test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
• fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
• chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in honojs/hono#5433
• chore(package.json): invoke package scripts through pnpm instead of bun in honojs/hono#5434
• chore: replace prettier with oxfmt in honojs/hono#5435
• chore(deps): upgrade vitest to 5.0.1 in honojs/hono#5437
• chore: let oxfmt sort imports instead of eslint in honojs/hono#5442
• chore: replace eslint with oxlint in honojs/hono#5443
• chore: introduce Vite+ in honojs/hono#5444
• fix(types): allow returning a Blob as a response body in honojs/hono#5446
• chore: convert build scripts into plugins in honojs/hono#5448
• chore: stop editorconfig-checker from checking Markdown indent size in honojs/hono#5455
• ci: remove empty step left in cr.yml by the pnpm migration in honojs/hono#5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in honojs/hono#5459
• feat(adapters): add @​hono/bun as a workspace package in honojs/hono#5447

... (truncated)

Commits

• 6abd35b 4.13.12
• 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
• afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
• e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
• c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
• c437d75 test(build): type-check the bundled declarations from a consumer project (#5486)
• be1f749 fix(build): keep internal types private in bundled d.ts and avoid a self-refe...
• 37ce069 4.13.11
• 1e1207c test(serve-static): fix the test (#5479)
• 8b05c77 Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps hono from 4.10.7 to 4.13.12. This includes a security fix for serveStatic that prevents middleware bypass via double-decoded request paths (GHSA-5r4p-p66f-jhc7). No code changes are required in this repository; hono/<adapter> imports are deprecated but the project already uses the separate @hono/* packages.

^{Written for commit 0fc5818. Summary will update on new commits.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The pinned dependency and lockfile entries are consistent, with no incompatible usage identified.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the MCP mock server’s Hono dependency to include upstream fixes, including a security patch.

Changes:

• Pins Hono at 4.13.12.
• Updates all corresponding lockfile resolutions.

File	Description
package.json	Updates the direct Hono dependency.
pnpm-lock.yaml	Synchronizes Hono and peer dependency resolutions.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dependabot]

Superseded by #226.