Skip to content

chore(deps): bump hono and @hono/node-server - #110

Open
horsefacts wants to merge 2 commits into
mainfrom
deps/hono-bump
Open

horsefacts wants to merge 2 commits into
mainfrom
deps/hono-bump

Conversation

@horsefacts

Copy link
Copy Markdown
Contributor

Bumps hono to >= 4.13.16 and @hono/node-server to >= 2.1.6, updating overrides where needed. The lockfile was regenerated with the repository's pinned package manager in lockfile-only mode.

@socket-security

socket-security Bot commented Nov 13, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedhono@​4.13.13 ⏵ 4.13.16100 +1100 +69796100

View full report

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. This is a simple patch-level bump of hono and @ hono/node-server, and the lockfile matches the manifests.

What was reviewed:

  • package.json pins hono at 4.13.16. The workspace overrides swap the old @ hono/node-server@<2.1.3 floor for hono@<4.13.16 and @ hono/node-server@<2.1.6. Overrides stay in pnpm-workspace.yaml, as AGENTS.md requires, and the existing comments are kept.
  • The lockfile no longer references hono 4.13.13 or @ hono/node-server 2.1.3 anywhere. Every dependent snapshot now resolves to 4.13.16 / 2.1.6.
  • I also checked why hono peer ranges are rewritten to the exact version 4.13.16. pnpm applies overrides to peer ranges too, and this lockfile already does the same for vue: 3.5.42 and zod: 4.6.6, so it's expected and not a problem.
  • Per AGENTS.md, pnpm check, check:types and the test suites weren't run as part of this review.
Extended reasoning...

The change touches only dependency manifests: package.json, pnpm-workspace.yaml and pnpm-lock.yaml. hono moves from 4.13.13 to 4.13.16 and @ hono/node-server from 2.1.3 to 2.1.6, both patch releases. No application source changes. The bump does affect the HTTP framework the server runs on, but nothing here is new code. No CODEOWNERS file covers these paths, and the PR timeline has no reviewer objections, so I approved.

@github-actions

github-actions Bot commented Nov 13, 2026 •

Copy link
Copy Markdown

The latest Tipbot preview deployment for 4924df2

Name Status Preview Updated (UTC)
pr110 Error Error pr110.tip.bot Nov 14, 2026, 1:52 AM

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review found no issues

No high-confidence issues detected in this change.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant