chore(deps): bump hono from 4.12.32 to 4.13.4

[dependabot]

Bumps hono from 4.12.32 to 4.13.4.

Release notes

Sourced from hono's releases.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
• fix(client): skip undefined header and cookie values in honojs/hono#5244
• fix(client): skip an undefined entry inside a query array in honojs/hono#5272
• fix(client): skip an undefined entry inside a form array in honojs/hono#5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
• fix(client): omit empty query delimiter in honojs/hono#5283
• fix(request): drop stale content length for cloned FormData in honojs/hono#5282
• fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
• fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
• fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236
• fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
• fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
• fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
• feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
• fix(client): serialize multiple cookies correctly in honojs/hono#5202
• fix(etag): stabilize digest across stream chunks in honojs/hono#5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
• perf(cors): pre-join static array header options during initialization in honojs/hono#5210
• fix(client): send falsy JSON bodies in honojs/hono#5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

... (truncated)

Commits

• 017000d 4.13.4
• 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
• 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
• c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
• 612b59c fix(request): drop stale content length for cloned FormData (#5282)
• 73794bd fix(client): omit empty query delimiter (#5283)
• 28a9c12 fix(accepts): support wildcard media types and specificity ordering in defaul...
• 1096d66 fix(client): support custom buildSearchParams and filter undefined query in $...
• c4a4407 fix(client): skip an undefined entry inside a form array (#5280)
• 2059584 fix(client): skip an undefined entry inside a query array (#5272)
• Additional commits viewable in compare view

[nhopeatall]

LGTM — routine Dependabot minor bump of hono 4.12.32 → 4.13.4, verified safe.

Verification

• Version consistency: ^4.13.4 in package.json, the root dependency in package-lock.json, and the resolved node_modules/hono entry all agree on 4.13.4; the integrity hash was updated in lockstep.
• Single source of truth: hono is only a root-workspace dependency (not in web/package.json), and there is exactly one node_modules/hono lock entry — nothing was left un-bumped.
• No breaking changes: 4.12→4.13 is a minor bump; the release notes are bug fixes / perf / small features. The codebase consumes Hono, the Context/Handler types, hono/cookie, hono/cors, and hono/logger — none affected by breaking changes. hono/client (the most-churned area in this range) is not used here.
• Tests: the 133 hono-dependent unit tests (corsConfig, auth login/logout, webhook handlers/parsing, webhook-signature) all pass locally.
• Typecheck: tsc --noEmit is clean — no type errors from the updated Context/Handler type surface.
• CI: 5/5 checks passing.

No issues found.

🕵️ claude-code · claude-opus-4-8 · run details