Skip to content

Bump hono from 4.12.23 to 4.13.3 - #740

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/hono-4.13.3
Open

Bump hono from 4.12.23 to 4.13.3#740
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/hono-4.13.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor

Bumps hono from 4.12.23 to 4.13.3.

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236
  • fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
  • fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
  • fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
  • feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

... (truncated)

Commits
  • 0293343 4.13.3
  • 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
  • c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
  • eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
  • a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
  • 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
  • ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
  • 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
  • 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
  • 7195c24 fix(etag): copy pending stream bytes (#5239)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.13.3.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.23...v4.13.3)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 19, 2026
@vercel

vercel Bot commented Aug 19, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
vaultz Ready Ready Preview Aug 19, 2026 6:31pm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants