[dependabot]

Bumps hono from 4.13.4 to 4.13.11.

Release notes

Sourced from hono's releases.

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in @hono/node-server v2.1.3.

v4.13.10

Adapters are now separate packages

The runtime adapters are now published as their own packages: @hono/bun, @hono/deno, @hono/cloudflare-workers, @hono/aws-lambda, @hono/lambda-edge, @hono/netlify, @hono/vercel, and @hono/service-worker. @hono/deno is also on JSR.

hono/<adapter> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:

- import { serveStatic } from 'hono/bun'
+ import { serveStatic } from '@hono/bun'

hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.

What's Changed

• chore: migrate the package manager from bun to pnpm in honojs/hono#5433
• chore(package.json): invoke package scripts through pnpm instead of bun in honojs/hono#5434
• chore: replace prettier with oxfmt in honojs/hono#5435
• chore(deps): upgrade vitest to 5.0.1 in honojs/hono#5437
• chore: let oxfmt sort imports instead of eslint in honojs/hono#5442
• chore: replace eslint with oxlint in honojs/hono#5443
• chore: introduce Vite+ in honojs/hono#5444
• fix(types): allow returning a Blob as a response body in honojs/hono#5446
• chore: convert build scripts into plugins in honojs/hono#5448
• chore: stop editorconfig-checker from checking Markdown indent size in honojs/hono#5455
• ci: remove empty step left in cr.yml by the pnpm migration in honojs/hono#5456
• chore(deps): upgrade vite-plus to 1.0.0-rc.1 in honojs/hono#5459
• feat(adapters): add @​hono/bun as a workspace package in honojs/hono#5447
• chore(adapters/bun): ship ESM only in honojs/hono#5462
• feat(adapters): add the seven adapters as workspace packages in honojs/hono#5463
• feat(adapters/deno): publish to JSR in honojs/hono#5465
• test: move adapter runtime tests into adapters/* in honojs/hono#5466

Full Changelog: honojs/hono@v4.13.9...v4.13.10

v4.13.9

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380

... (truncated)

Commits

• 37ce069 4.13.11
• 1e1207c test(serve-static): fix the test (#5479)
• 8b05c77 Merge commit from fork
• 18331a9 chore(adapters): release @​hono/netlify@​1.0.1
• 6cd583b chore(adapters): release @​hono/deno@​1.0.2
• 271dd0b ci: write the tag version into deno.json before publishing to JSR (#5469)
• ae93026 chore(adapters): release @​hono/deno@​1.0.1
• 72f0d8d feat(adapters/netlify): publish to JSR (#5468)
• f3d5e88 4.13.10
• 645ddd6 test: move adapter runtime tests into adapters/* (#5466)
• Additional commits viewable in compare view

[defangdevs]

CI is red because this PR only touched apps/api/package.json and not pnpm-lock.yaml, so pnpm install --frozen-lockfile fails with ERR_PNPM_OUTDATED_LOCKFILE — every downstream job (Lint, Test, Build, etc.) fails at the install step. The prior hono bump (#52) included the lockfile update; this one didn't.

@dependabot recreate

[defangdevs]

CI is red across almost every job (Test, Build, Lint, Secret Scan, etc.), not just E2E Smoke — root cause is the same for all of them: this PR only bumped hono in apps/api/package.json (4.13.4 → 4.13.11) but didn't update pnpm-lock.yaml, so pnpm install --frozen-lockfile fails at the first step of every job:

ERR_PNPM_OUTDATED_LOCKFILE  Cannot install with "frozen-lockfile" because pnpm-lock.yaml is not up to date with apps/api/package.json

@dependabot recreate

[defangdevs]

The `@dependabot recreate` above didn't fix it — the regenerated commit (2f7b9e7) still only touched `apps/api/package.json`, not `pnpm-lock.yaml`. This looks like a repo-wide gap in dependabot's pnpm workspace/catalog resolution here, not something retrying will fix (same signature as #52's lockfile issue, but #52's own commit happened to include the lockfile — this one and #56 don't).

Pushed `381b2591b` directly to this branch with a regenerated `pnpm-lock.yaml` (via `pnpm install --no-frozen-lockfile`, pinned pnpm 9.15.9, verified `--frozen-lockfile` now passes locally). CI should go green on the new commit; the hono/valibot peer bump is otherwise untouched.

🤖 Generated with Claude Code

[defangdevs]

Lockfile was fixed, but Type Check/Test/Build still failed for a separate reason: hono 4.13.11 tightens a TS2742 check ("inferred type cannot be named without a non-portable reference") on two handlers whose signatures depended on hono's internal, unexported types — `deleteNodeRoute` (`src/routes/nodes/delete.ts`) and `jsonValidator` (`src/schemas/_validator.ts`, via `@hono/valibot-validator`'s own inferred return type).

Pushed `c0cfc832c` adding explicit, portable return-type annotations for both (no behavior change — `c.req.valid('json')` narrowing for `jsonValidator` callers is preserved via a new `JsonValidatorMiddleware` alias built from hono's public types). Verified locally: `tsc --noEmit` and `pnpm build` both pass clean in `apps/api`.

Secret Scan's remaining failure ("A reviewed Gitleaks baseline entry has expired") is unrelated and repo-wide — tracked separately on #57. CodSpeed's failure is the known pre-existing 401 (#46), also unrelated to this bump.

🤖 Generated with Claude Code

[defangdevs]

Root cause of the stuck checks: this PR had drifted far enough behind `main` (mastra/core, ai, workers-ai-provider bumps landed in the meantime) that it became unmergeable, and GitHub doesn't run `pull_request`-triggered CI on a branch it can't form a merge ref for — that's why no check ran on the previous commit for two days, not an Actions outage.

Pushed `e832091`, merging `main` in and regenerating the lockfile. CI is running now on the merged commit.

🤖 Generated with Claude Code

[defangdevs]

My merge commit (e832091) had a bug: `git add pnpm-lock.yaml` ran before `pnpm install --no-frozen-lockfile` regenerated it, so it committed the pre-merge lockfile (still `hono@4.13.4`) despite `package.json` already saying `4.13.11` — same `ERR_PNPM_OUTDATED_LOCKFILE` as before, caused by me this time, not dependabot.

Pushed `ce1aacd` with the lockfile actually regenerated and staged in the right order. Verified locally: `pnpm install --frozen-lockfile`, `tsc --noEmit`, and `pnpm build` all pass. CI is running now.

🤖 Generated with Claude Code

[defangdevs]

Lint was still red (`@typescript-eslint/no-explicit-any` on the `any` I used for `JsonValidatorMiddleware`'s Env generic). Pushed `e15bb4f` replacing it with hono's own `Env` type (`{ Bindings?; Variables? }`), which is the correct unconstrained default. Verified locally: `tsc --noEmit`, `eslint`, and `pnpm build` all pass clean in `apps/api`.

The `Test` failure on the previous run (`automation-flows.test.tsx`, a 5s timeout on 1 of 4432 tests) is an unrelated CI-load flake, not caused by this bump — it's in web UI code this PR never touches. `Preflight Evidence` is the known always-red-on-bot-PRs gate.

🤖 Generated with Claude Code

[defangdevs]

CI is green on `e15bb4f`: Lint, Type Check, Test, Build, Secret Scan, and all Durable Object Workers shards all pass. The two remaining red checks are pre-existing and unrelated to this bump — Preflight Evidence (known always-red on bot/dependabot PRs) and CodSpeed's benchmark run (known 401 since 2026-07-11, #46).

This PR should be mergeable now.

🤖 Generated with Claude Code