Bumps [hono](https://github.com/honojs/hono) from 4.13.1 to 4.13.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.13.7</h2>
<h2>Security fixes</h2>
<p>This release includes a fix for the following security issue:</p>
<h3><code>hono/jsx</code> renders plain strings unescaped in boundary
components, leading to XSS</h3>
<p>Affects: <code>Suspense</code>, <code>ErrorBoundary</code>, and
<code>Context.Provider</code> in <code>hono/jsx</code>, and
<code>renderToString()</code> / <code>renderToReadableStream()</code> in
<code>hono/jsx/dom/server</code>. Fixes missing HTML escaping for a
plain string placed directly as a child or <code>fallback</code> of
these components, or as the root value of the server rendering
functions, so untrusted strings could be emitted as markup.
GHSA-hxh3-vqpv-xpqv</p>
<hr />
<p>Users who render untrusted strings inside <code>Suspense</code>,
<code>ErrorBoundary</code>, or <code>Context.Provider</code>, or pass
them directly to <code>hono/jsx/dom/server</code>, are strongly
encouraged to upgrade to this version.</p>
<h2>v4.13.6</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(client): keep a param value of "index" in $url() and
$path() in <a
href="https://redirect.github.com/honojs/hono/pull/5297">honojs/hono#5297</a></li>
<li>fix(client): normalize root WebSocket URLs in <a
href="https://redirect.github.com/honojs/hono/pull/5291">honojs/hono#5291</a></li>
<li>fix(types): allow symbol keys in Context<!-- raw HTML omitted -->
get and set fallbacks in <a
href="https://redirect.github.com/honojs/hono/pull/5300">honojs/hono#5300</a></li>
<li>chore: bump <code>editorconfig-checker</code> in <a
href="https://redirect.github.com/honojs/hono/pull/5336">honojs/hono#5336</a></li>
<li>refactor(on-handler): use forEach for consistent handler iteration
in <a
href="https://redirect.github.com/honojs/hono/pull/5326">honojs/hono#5326</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.13.5...v4.13.6">https://github.com/honojs/hono/compare/v4.13.5...v4.13.6</a></p>
<h2>v4.13.5</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Query parser reads parameters after the URL fragment, causing
cache-key and proxy interpretation differentials</h3>
<p>Affects: Cache Middleware and applications behind a proxy, WAF, or
logging layer that inspects query strings. Fixes query parsing that did
not stop at the URL fragment, so a <code>?</code> after a <code>#</code>
was treated as the start of a query string and the application could
read parameters that the other component never saw.
GHSA-crvj-82cr-hjcx</p>
<h3>Incomplete fix for CVE-2026-39408: <code>toSSG()</code> still writes
files outside the output directory</h3>
<p>Affects: <code>toSSG()</code> for Static Site Generation. Fixes a
path normalization gap where consecutive parent-directory segments in
<code>ssgParams</code> values were not fully collapsed, bypassing the
containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv</p>
<h3>Unbounded dot-notation nesting in <code>parseBody()</code> can cause
memory exhaustion</h3>
<p>Affects: <code>parseBody()</code> when dot-notation parsing is
enabled. Fixes unbounded expansion of dot-separated field names, where a
small request body could allocate a disproportionately large object
graph and concurrent requests could exhaust the heap.
GHSA-g6gw-c38x-mqfc</p>
<hr />
<p>Users who use Cache Middleware, deploy behind a proxy or WAF that
inspects query strings, use Static Site Generation, or use
<code>parseBody({ dot: true })</code> are strongly encouraged to upgrade
to this version.</p>
<h2>v4.13.4</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(request): handle params on unmatched requests in <a
href="https://redirect.github.com/honojs/hono/pull/5268">honojs/hono#5268</a></li>
<li>fix(jsx/dom): execute previous ref cleanup when ref prop changes on
re-render in <a
href="https://redirect.github.com/honojs/hono/pull/5264">honojs/hono#5264</a></li>
<li>fix(reg-exp-router): associate wildcard middleware with matching
routes in <a
href="https://redirect.github.com/honojs/hono/pull/5266">honojs/hono#5266</a></li>
<li>perf(router): share null object creation in <a
href="https://redirect.github.com/honojs/hono/pull/5267">honojs/hono#5267</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="eebdf7be39"><code>eebdf7b</code></a>
4.13.7</li>
<li><a
href="2b8ed402cd"><code>2b8ed40</code></a>
Merge commit from fork</li>
<li><a
href="cac0c4d3fe"><code>cac0c4d</code></a>
4.13.6</li>
<li><a
href="dac5d5794c"><code>dac5d57</code></a>
refactor(on-handler): use forEach for consistent handler iteration (<a
href="https://redirect.github.com/honojs/hono/issues/5326">#5326</a>)</li>
<li><a
href="ec648d6837"><code>ec648d6</code></a>
chore: bump <code>editorconfig-checker</code> (<a
href="https://redirect.github.com/honojs/hono/issues/5336">#5336</a>)</li>
<li><a
href="e2740d5a1b"><code>e2740d5</code></a>
fix(types): allow symbol keys in Context<any> get and set
fallbacks (<a
href="https://redirect.github.com/honojs/hono/issues/5300">#5300</a>)</li>
<li><a
href="499c35ebda"><code>499c35e</code></a>
fix(client): normalize root WebSocket URLs (<a
href="https://redirect.github.com/honojs/hono/issues/5291">#5291</a>)</li>
<li><a
href="50b8788cf5"><code>50b8788</code></a>
fix(client): keep a param value of "index" in $url() and
$path() (<a
href="https://redirect.github.com/honojs/hono/issues/5297">#5297</a>)</li>
<li><a
href="06880c4a2b"><code>06880c4</code></a>
4.13.5</li>
<li><a
href="531e9c5a3a"><code>531e9c5</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.13.1...v4.13.7">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
318aabe74e