From 318aabe74e3e7c9d1b57cc1ba216132ef06c82ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 16:10:41 +0200
Subject: [PATCH] chore(deps): bump hono from 4.13.1 to 4.13.7 in
 /integration-test/src/jvmTest/typescript (#987)

Bumps [hono](https://github.com/honojs/hono) from 4.13.1 to 4.13.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.13.7</h2>
<h2>Security fixes</h2>
<p>This release includes a fix for the following security issue:</p>
<h3><code>hono/jsx</code> renders plain strings unescaped in boundary
components, leading to XSS</h3>
<p>Affects: <code>Suspense</code>, <code>ErrorBoundary</code>, and
<code>Context.Provider</code> in <code>hono/jsx</code>, and
<code>renderToString()</code> / <code>renderToReadableStream()</code> in
<code>hono/jsx/dom/server</code>. Fixes missing HTML escaping for a
plain string placed directly as a child or <code>fallback</code> of
these components, or as the root value of the server rendering
functions, so untrusted strings could be emitted as markup.
GHSA-hxh3-vqpv-xpqv</p>
<hr />
<p>Users who render untrusted strings inside <code>Suspense</code>,
<code>ErrorBoundary</code>, or <code>Context.Provider</code>, or pass
them directly to <code>hono/jsx/dom/server</code>, are strongly
encouraged to upgrade to this version.</p>
<h2>v4.13.6</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(client): keep a param value of &quot;index&quot; in $url() and
$path() in <a
href="https://redirect.github.com/honojs/hono/pull/5297">honojs/hono#5297</a></li>
<li>fix(client): normalize root WebSocket URLs in <a
href="https://redirect.github.com/honojs/hono/pull/5291">honojs/hono#5291</a></li>
<li>fix(types): allow symbol keys in Context<!-- raw HTML omitted -->
get and set fallbacks in <a
href="https://redirect.github.com/honojs/hono/pull/5300">honojs/hono#5300</a></li>
<li>chore: bump <code>editorconfig-checker</code> in <a
href="https://redirect.github.com/honojs/hono/pull/5336">honojs/hono#5336</a></li>
<li>refactor(on-handler): use forEach for consistent handler iteration
in <a
href="https://redirect.github.com/honojs/hono/pull/5326">honojs/hono#5326</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.13.5...v4.13.6">https://github.com/honojs/hono/compare/v4.13.5...v4.13.6</a></p>
<h2>v4.13.5</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Query parser reads parameters after the URL fragment, causing
cache-key and proxy interpretation differentials</h3>
<p>Affects: Cache Middleware and applications behind a proxy, WAF, or
logging layer that inspects query strings. Fixes query parsing that did
not stop at the URL fragment, so a <code>?</code> after a <code>#</code>
was treated as the start of a query string and the application could
read parameters that the other component never saw.
GHSA-crvj-82cr-hjcx</p>
<h3>Incomplete fix for CVE-2026-39408: <code>toSSG()</code> still writes
files outside the output directory</h3>
<p>Affects: <code>toSSG()</code> for Static Site Generation. Fixes a
path normalization gap where consecutive parent-directory segments in
<code>ssgParams</code> values were not fully collapsed, bypassing the
containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv</p>
<h3>Unbounded dot-notation nesting in <code>parseBody()</code> can cause
memory exhaustion</h3>
<p>Affects: <code>parseBody()</code> when dot-notation parsing is
enabled. Fixes unbounded expansion of dot-separated field names, where a
small request body could allocate a disproportionately large object
graph and concurrent requests could exhaust the heap.
GHSA-g6gw-c38x-mqfc</p>
<hr />
<p>Users who use Cache Middleware, deploy behind a proxy or WAF that
inspects query strings, use Static Site Generation, or use
<code>parseBody({ dot: true })</code> are strongly encouraged to upgrade
to this version.</p>
<h2>v4.13.4</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(request): handle params on unmatched requests in <a
href="https://redirect.github.com/honojs/hono/pull/5268">honojs/hono#5268</a></li>
<li>fix(jsx/dom): execute previous ref cleanup when ref prop changes on
re-render in <a
href="https://redirect.github.com/honojs/hono/pull/5264">honojs/hono#5264</a></li>
<li>fix(reg-exp-router): associate wildcard middleware with matching
routes in <a
href="https://redirect.github.com/honojs/hono/pull/5266">honojs/hono#5266</a></li>
<li>perf(router): share null object creation in <a
href="https://redirect.github.com/honojs/hono/pull/5267">honojs/hono#5267</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/eebdf7be39abf0a872671835ccce0c4f03ea497a"><code>eebdf7b</code></a>
4.13.7</li>
<li><a
href="https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e"><code>2b8ed40</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/cac0c4d3fe29aca4e426031067cbbb3b9131e30c"><code>cac0c4d</code></a>
4.13.6</li>
<li><a
href="https://github.com/honojs/hono/commit/dac5d5794c6134711e469c5e69d09cd6274e1fc1"><code>dac5d57</code></a>
refactor(on-handler): use forEach for consistent handler iteration (<a
href="https://redirect.github.com/honojs/hono/issues/5326">#5326</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/ec648d683768ec5093315e5dc694c05594fec185"><code>ec648d6</code></a>
chore: bump <code>editorconfig-checker</code> (<a
href="https://redirect.github.com/honojs/hono/issues/5336">#5336</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/e2740d5a1bd0b4254e517e3af8b60789284bc7bd"><code>e2740d5</code></a>
fix(types): allow symbol keys in Context&lt;any&gt; get and set
fallbacks (<a
href="https://redirect.github.com/honojs/hono/issues/5300">#5300</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/499c35ebda35777fd35a7dd1906dd4f2687da61e"><code>499c35e</code></a>
fix(client): normalize root WebSocket URLs (<a
href="https://redirect.github.com/honojs/hono/issues/5291">#5291</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/50b8788cf54cb60112b7cd93642bc5094901475c"><code>50b8788</code></a>
fix(client): keep a param value of &quot;index&quot; in $url() and
$path() (<a
href="https://redirect.github.com/honojs/hono/issues/5297">#5297</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/06880c4a2b04de9dd74217f26dd831209b9c01f1"><code>06880c4</code></a>
4.13.5</li>
<li><a
href="https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178"><code>531e9c5</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.13.1...v4.13.7">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 integration-test/src/jvmTest/typescript/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/integration-test/src/jvmTest/typescript/package-lock.json b/integration-test/src/jvmTest/typescript/package-lock.json
index 5c6746d..d9312b7 100644
--- a/integration-test/src/jvmTest/typescript/package-lock.json
+++ b/integration-test/src/jvmTest/typescript/package-lock.json
@@ -1538,9 +1538,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.1",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.1.tgz",
-      "integrity": "sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==",
+      "version": "4.13.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
+      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"