Skip to content

chore(deps-dev): Bump hono from 4.13.9 to 4.13.11 in /packages/hono - #25716

Merged
Lms24 merged 3 commits into
developfrom
dependabot/npm_and_yarn/packages/hono/hono-4.13.11
Oct 27, 2026
Merged

Lms24 merged 3 commits into
developfrom
dependabot/npm_and_yarn/packages/hono/hono-4.13.11

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps hono from 4.13.9 to 4.13.11.

Release notes

Sourced from hono's releases.

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

Full Changelog: honojs/hono@v4.13.9...v4.13.10

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.13.9 to 4.13.11.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.9...v4.13.11)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.11
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 23, 2026 16:02
@dependabot
dependabot Bot requested review from chargome and s1gr1d and removed request for a team October 23, 2026 16:02
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 23, 2026
@Lms24
Lms24 enabled auto-merge (squash) October 23, 2026 17:13
Co-Authored-By: Andrei Borza <andrei.borza@sentry.io>
@github-actions

github-actions Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

size-limit report 📦

Compared: e743229 (PR test merge using develop at 84f5d12)

Against: 84f5d12 (develop) · base run #63636

✅ Baseline matches: this diff contains only this PR's changes.

Path Size % Change Change
@sentry/browser 29.98 kB - -
@sentry/browser - with treeshaking flags 28.13 kB - -
@sentry/browser - with treeshaking flags tracing without tracing 28.03 kB - -
@sentry/browser (incl. Tracing) 52.17 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 52.18 kB - -
@sentry/browser (incl. Tracing, Profiling) 55.12 kB - -
@sentry/browser (incl. Tracing, Replay) 91.97 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 80.86 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 96.7 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 109.64 kB - -
@sentry/browser (incl. Feedback) 47.51 kB - -
@sentry/browser (incl. sendFeedback) 35.05 kB - -
@sentry/browser (incl. FeedbackAsync) 40.15 kB - -
@sentry/browser (incl. Metrics) 31.01 kB - -
@sentry/browser (incl. Logs) 31.28 kB - -
@sentry/browser (incl. Metrics & Logs) 31.94 kB - -
@sentry/react 31.81 kB - -
@sentry/react (incl. Tracing) 54.5 kB - -
@sentry/vue 38.14 kB - -
@sentry/vue (incl. Tracing) 55.11 kB - -
@sentry/svelte 30.01 kB - -
@sentry/remix (Remix 3 client bundle) 57.19 kB - -
CDN Bundle 31.76 kB - -
CDN Bundle (incl. Tracing) 52.7 kB - -
CDN Bundle (incl. Logs, Metrics) 33.95 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 54.65 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 74.93 kB - -
CDN Bundle (incl. Tracing, Replay) 90.4 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 92.33 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 96.55 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 98.49 kB - -
CDN Bundle - uncompressed 93.51 kB - -
CDN Bundle (incl. Tracing) - uncompressed 156.36 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 100.06 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 162.33 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 230.28 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 276.7 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 282.66 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 290.4 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 296.35 kB - -
@sentry/nextjs (client) 57.38 kB - -
@sentry/sveltekit (client) 52.55 kB - -
@sentry/core/server 43.62 kB - -
@sentry/core/browser 13.81 kB - -
@sentry/node 153.96 kB - -
@sentry/node/import (ESM hook with diagnostics-channel injection) 81.58 kB - -
@sentry/node - without tracing 95.48 kB +0.01% +1 B 🔺
@sentry/node - without channel injection 134.63 kB +0.01% +1 B 🔺
@sentry/aws-serverless 103.64 kB -0.01% -1 B 🔽
@sentry/cloudflare (withSentry) - minified 197.26 kB - -
@sentry/cloudflare (withSentry) 490.08 kB - -
@sentry/nextjs/cloudflare (withSentry) - minified 217.85 kB - -

View base workflow run

Co-Authored-By: Andrei Borza <andrei.borza@sentry.io>
@github-actions

github-actions Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Optional E2E tests

Some optional checks were not successful. They do not block the merge. 4 not successful, 61 successful. See the run.

Check Status
❌ CI: Optional E2E Tests / E2E node-eve (latest) Test (optional) Failing after 2m Details
❌ CI: Optional E2E Tests / E2E node-openai-decisions-send-to-sentry (latest) Test (optional) Failing after 3m Details
❌ CI: Optional E2E Tests / E2E node-openai-decisions-send-to-sentry Test (optional) Failing after 4m Details
❌ CI: Optional E2E Tests / E2E node-anthropic-send-to-sentry (latest) Test (optional) Failing after 16s Details
Successful checks
Check Status
✅ CI: Optional E2E Tests / E2E cloudflare-flue-send-to-sentry Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E react-send-to-sentry Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E node-flue (latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E astro-7 Test (optional) Successful in 52s Details
✅ CI: Optional E2E Tests / E2E tanstackstart-react-cloudflare Test (optional) Successful in 18s Details
✅ CI: Optional E2E Tests / E2E cloudflare-pi-durable Test (optional) Successful in 26s Details
✅ CI: Optional E2E Tests / E2E node-express-send-to-sentry Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E astro-7-static Test (optional) Successful in 47s Details
✅ CI: Optional E2E Tests / E2E cloudflare-mastra Test (optional) Successful in 27s Details
✅ CI: Optional E2E Tests / E2E nextjs-15 (latest) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E angular (canary) Test (optional) Successful in 57s Details
✅ CI: Optional E2E Tests / E2E nuxt-5 Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nuxt-5-sourcemaps (static / nuxt generate) Test (optional) Successful in 20s Details
✅ CI: Optional E2E Tests / E2E solidstart-2 Test (optional) Successful in 37s Details
✅ CI: Optional E2E Tests / E2E gen-ai-libraries Test (optional) Successful in 39s Details
✅ CI: Optional E2E Tests / E2E supabase-nextjs Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E angular (canary) Test (optional) Successful in 51s Details
✅ CI: Optional E2E Tests / E2E gen-ai-libraries (cloudflare) Test (optional) Successful in 29s Details
✅ CI: Optional E2E Tests / E2E node-mastra Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-anthropic-send-to-sentry Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E cloudflare-agent Test (optional) Successful in 50s Details
✅ CI: Optional E2E Tests / E2E cloudflare-workers-send-to-sentry Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E nuxt-4 (canary) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E node-openai-send-to-sentry (latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nuxt-3 (canary) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E react-router-7-framework-instrumentation Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nuxt-5-sourcemaps (client source maps kept) Test (optional) Successful in 21s Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (vinext, bun) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-eve Test (optional) Successful in 39s Details
✅ CI: Optional E2E Tests / E2E tanstackstart-react-sourcemaps Test (optional) Successful in 19s Details
✅ CI: Optional E2E Tests / E2E node-pi-durable (latest) Test (optional) Successful in 25s Details
✅ CI: Optional E2E Tests / E2E nuxt-5-sourcemaps Test (optional) Successful in 22s Details
✅ CI: Optional E2E Tests / E2E nextjs-14 (latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nextjs-orpc Test (optional) Successful in 54s Details
✅ CI: Optional E2E Tests / E2E cloudflare-think (ai v6) Test (optional) Successful in 47s Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (deno) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E nextjs-14 (canary) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E vue-3 (canary) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E debug-id-sourcemaps Test (optional) Successful in 26s Details
✅ CI: Optional E2E Tests / E2E node-express-send-to-sentry-static Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E cloudflare-pi-durable (latest) Test (optional) Successful in 27s Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (cloudflare, latest) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E cloudflare-think Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (vinext) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-fastify-6 Test (optional) Successful in 22s Details
✅ CI: Optional E2E Tests / E2E nextjs-15 (turbo) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (canary, turbopack) Test (optional) Successful in 4m Details
✅ CI: Optional E2E Tests / E2E node-express-mcp-v1 Test (optional) Successful in 16s Details
✅ CI: Optional E2E Tests / E2E deno (latest) Test (optional) Successful in 49s Details
✅ CI: Optional E2E Tests / E2E nextjs-16 (canary, webpack) Test (optional) Successful in 5m Details
✅ CI: Optional E2E Tests / E2E nuxt-4-static (canary) Test (optional) Successful in 2m Details
✅ CI: Optional E2E Tests / E2E nextjs-16-tunnel (cloudflare) Test (optional) Successful in 50s Details
✅ CI: Optional E2E Tests / E2E nextjs-16-standalone (canary, turbopack) Test (optional) Successful in 21s Details
✅ CI: Optional E2E Tests / E2E node-flue Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-express-mcp-v2 Test (optional) Successful in 50s Details
✅ CI: Optional E2E Tests / E2E node-mastra (latest) Test (optional) Successful in 57s Details
✅ CI: Optional E2E Tests / E2E node-pi-durable Test (optional) Successful in 25s Details
✅ CI: Optional E2E Tests / E2E node-eve (orchestrion) Test (optional) Successful in 37s Details
✅ CI: Optional E2E Tests / E2E node-openai-send-to-sentry Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E node-fastify-6 (tracer provider) Test (optional) Successful in 1m Details
✅ CI: Optional E2E Tests / E2E vue-3 (no Options API) Test (optional) Successful in 54s Details

@Lms24
Lms24 merged commit 8eb2615 into develop Oct 27, 2026
680 of 686 checks passed
@Lms24
Lms24 deleted the dependabot/npm_and_yarn/packages/hono/hono-4.13.11 branch October 27, 2026 10:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant