[dependabot]

Bumps hono from 4.13.13 to 4.13.16.

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in honojs/hono#5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in honojs/hono#5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in honojs/hono#5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

What's Changed

• docs(contributing): ask for issues instead of RPs honojs/hono#5526
• docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range honojs/hono#5537
• chore: unified oxfmt and oxlint config honojs/hono#5518
• docs(readme): remove the deepwiki badge honojs/hono#5548

... (truncated)

Commits

• c91b60a 4.13.16
• e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
• bf16471 Merge commit from fork
• d88fab3 Merge commit from fork
• 34f9043 Merge commit from fork
• 8a103aa Merge commit from fork
• 15bbd96 Merge commit from fork
• 3cb29de 4.13.15
• 17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
• ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
hyperdx-oss	Ignored	Preview	Nov 13, 2026 3:06pm UTC
hyperdx-storybook	Ignored	Preview	Nov 13, 2026 3:06pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: d9ff9f4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🟢 Tier 1 — Trivial

Docs, images, lock files, a dependency bump, or an automated release. No functional code changes detected.

Why this tier:

• Bot author: dependabot[bot]

Review process: Auto-merge once CI passes. No human review required.
SLA: Resolves automatically.

Stats

• Production files changed: 0
• Production lines changed: 0
• Branch: dependabot/npm_and_yarn/hono-4.13.16
• Author: dependabot[bot]

To override this classification, remove the review/tier-1 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[github-actions]

PR Review

✅ No issues found.

[github-actions]

Duplicate code analysis

No new duplicate code introduced by this PR.

---

jscpd compared this branch against origin/main
across app, api and common-utils. Only new clones are listed; the codebase
currently holds 108 in total (1.18%).
Run yarn dupes locally to reproduce, or yarn dupes:all for the full picture.

[github-actions]

Deep Review

✅ No critical issues found.

This PR is a single-line lockfile change bumping the transitive dependency hono from 4.13.13 to 4.13.16 (a security-patch release). The multi-agent review surfaced no P0/P1/P2 findings against the diff, and nothing survived the re-grade rubric.

Why no findings:

• hono is a transitive dependency of @modelcontextprotocol/sdk@1.29.0 (the MCP server), not a direct dependency — no package.json in the repo declares it, and no source file imports hono or hono/*.
• The behavioral changes in 4.13.16 that now throw (/assets*-style routes, duplicate parameter names, empty-string-matching custom patterns, validator('form'), csrf(), css helper) are reachable only through code that configures hono directly. ClickStack does not do so, so none of those paths are exercised by repo-controlled code.
• The bump stays within the ^4.11.4 range the SDK already pins, and the resolution plus checksum fields in yarn.lock are updated consistently with a single resolved entry.
• Prior PR comments are automated bot status only (Vercel deployment summaries, changeset-bot) — no substantive review feedback requiring verification.

---

Reviewers (6): correctness, testing, maintainability, project-standards, previous-comments, security

Testing gaps: None applicable — the change is a transitive lockfile bump with no executable code to cover; existing CI install/build validates lockfile integrity.

[github-actions]

E2E Test Results

✅ All tests passed • 468 passed • 1 skipped • 1252s

Status	Count
✅ Passed	468
❌ Failed	0
⚠️ Flaky	0
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →