Update dependency hono to v4.13.7

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
hono (source)	4.13.5 → 4.13.7

---

Release Notes

honojs/hono (hono)

v4.13.7

Compare Source

v4.13.6

Compare Source

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	a5301bf
Status:	✅  Deploy successful!
Preview URL:	https://198a0c36.mouseterm.pages.dev
Branch Preview URL:	https://renovate-hono-4-x-lockfile.mouseterm.pages.dev

View logs

[dormouse-bot]

Reviewing as a draft — flagging anything that looks worth a quick fix. Mark ready for a full review.

The lockfile change is mechanical and correct: hono is a relay dependency under ^4.6.0, so rangeStrategy: update-lockfile leaves relay/package.json alone, and the new integrity hash matches what the registry publishes for 4.13.7. hono has no dependencies of its own, so the only other edits are the peer-suffix rewrites on @hono/node-server and @hono/node-ws; no 4.13.5 reference survives anywhere in the lockfile. Cooldown is satisfied — 4.13.7 published 2026-09-04, and the patch rule asks for 1 day.

Build & Test is red on the disclosure gate and will stay red until website/src/data/dependencies-npm.json is regenerated. relay is a product root in productDependencyFilters, so hono is inside the disclosure walk, and docs/specs/security-supply-chain.md -> "Disclosure" makes a stale snapshot a FAIL IF. Renovate can't run node website/scripts/generate-deps.js, so an npm bump that touches a shipped package always leaves it behind — #587 needed the same follow-up commit. I ran the generator against a clean pnpm install --frozen-lockfile tree and it produces exactly one line ("version": "4.13.5" → "4.13.7" in the hono record); the cargo and runtime snapshots are unchanged. Pushing that to this branch so the PR can go green — if Renovate rebases, it will need reapplying.

Worth knowing this is a security release, not a routine patch. 4.13.7 fixes an XSS in hono/jsx — Suspense, ErrorBoundary, and Context.Provider render a plain string child or fallback unescaped, as do renderToString() / renderToReadableStream() from hono/jsx/dom/server (GHSA-hxh3-vqpv-xpqv). Nothing here is exposed: hono/jsx appears nowhere in the repo, and the only hono imports are Hono and hono/body-limit in relay/src/app.ts (plus Hono in relay/test/signin.test.mjs).

The reason it arrived as a draft, unlabeled, Monday-batched PR rather than through vulnerabilityAlerts is that GHSA-hxh3-vqpv-xpqv is not in the GitHub Advisory Database yet — GET /advisories/GHSA-hxh3-vqpv-xpqv returns nothing, and the repo has no open Dependabot alert for hono. Nothing to fix in the Renovate config; it's just a reminder that the cooldown-exempt path in .github/renovate.json fires on the advisory database, so a fix disclosed only in a project's own release notes still takes the routine route.

Verification

• Registry metadata for 4.13.5 and 4.13.7 is identical apart from the version (license MIT, same author, homepage https://hono.dev, no dependencies), which is why the regenerated snapshot is a one-line diff.
• pnpm --filter relay test passes locally against 4.13.7 — 275 tests, 0 failures.
• Failing step in the Build & Test run is Dependency disclosure is current.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.