chore(deps): bump hono from 4.10.7 to 4.13.13
Bumps hono from 4.10.7 to 4.13.13.
Release notes
Sourced from hono's releases.
v4.13.13
Mount Middleware
app.mount()is now available as the Mount Middleware,hono/mount. It is just a handler, so you register it withapp.all():import { Router as IttyRouter } from 'itty-router' import { Hono } from 'hono' import { mount } from 'hono/mount'const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))
app.mount()still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:- app.mount('/itty-router', ittyRouter.handle) + app.all('/itty-router/*', mount(ittyRouter.handle))What's Changed
- test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
- docs(request): fix jsdoc comments for some getters in honojs/hono#5445
- fix(jsx): allow JSXNode function component results in honojs/hono#5476
- feat(mount): introduce Mount Middleware and deprecate
app.mountin honojs/hono#5221Full Changelog: https://github.com/honojs/hono/compare/v4.13.12...v4.13.13
v4.13.12
What's Changed
- fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
- test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
- fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
- fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
- fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
- chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464
Full Changelog: https://github.com/honojs/hono/compare/v4.13.11...v4.13.12
v4.13.11
Security fixes
serveStaticdecodes the request path a second time, leading to bypass of middleware on static pathsAffects:
hono/serve-staticand the adapters built on it (hono/bun,hono/deno,hono/cloudflare-workers,@hono/bun,@hono/deno,@hono/cloudflare-workers). FixesserveStaticdecoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7
... (truncated)
Commits
08a023c4.13.13ae595defeat(mount): introduce Mount Middleware and deprecateapp.mount(#5221)f23b146fix(jsx): allow JSXNode function component results (#5476)6d73a74docs(request): fix jsdoc comments for some getters (#5445)deff529test(client): simulate network error for undefined route in parseResponse tes...6abd35b4.13.1295eb860chore(deps): upgrade vite-plus to 1.0.0 (#5464)afb2068fix(combine): return a Response from a short-circuiting middleware in some() ...e5bb206fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)c3053ccfix(etag): correctly match mixed-case header name in retainedHeader option (#...- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Summary by cubic
Bumps hono from 4.10.7 to 4.13.13, fixing a security issue where serveStatic decoded an already-decoded request path and could bypass middleware mounted on a static prefix.
Migration
app.mount()is deprecated and will be removed in v5. Replaceapp.mount(path, handler)withapp.all(path + '/*', mount(handler))using the new Mount Middleware fromhono/mount.