chore(deps): bump hono from 4.13.13 to 4.13.17 - #9149

Sourced from hono's releases.

v4.13.17

What's Changed

• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in honojs/hono#5608
• fix(utils/url): do not match a query key across separators in honojs/hono#5607
• fix(etag,pretty-json): cancel the discarded response body in honojs/hono#5606
• fix(client): detect the JSON media type with whitespace before a parameter in honojs/hono#5609
• fix(timing): honor a precision of 0 in setMetric in honojs/hono#5363
• fix(utils/mime,ssg): match media types case-insensitively in honojs/hono#5449
• fix(timing): escape double quotes and backslashes in Server-Timing descriptions in honojs/hono#5478
• fix(etag): preserve commas within quoted entity tags in honojs/hono#5353
• fix(accepts): preserve exact media type quality over subtype wildcards in honojs/hono#5427
• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in honojs/hono#5611
• fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in honojs/hono#5430
• fix(ssg): do not reuse created directories across toSSG runs in honojs/hono#5381
• fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in honojs/hono#5483
• fix(jsx): escape element and object attribute values in honojs/hono#5512
• fix(jsx): do not render ref objects as attributes in honojs/hono#5615
• fix(factory): keep independent return types for nine handlers in honojs/hono#5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

... (truncated)

• 61f7c59 4.13.17
• 1534ffa fix(factory): keep independent return types for nine handlers (#5618)
• eb754bd fix(jsx): do not render ref objects as attributes (#5615)
• 6cbe361 fix(jsx): escape element and object attribute values (#5512)
• 8b7f9e9 fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events (#...
• 7852e0a fix(ssg): do not reuse created directories across toSSG runs (#5381)
• bcfd02b fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary (#5430)
• 456fe46 fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in C...
• 98b35af fix(accepts): preserve exact media type quality over subtype wildcards (#5427)
• b3f1272 fix(etag): preserve commas within quoted entity tags (#5353)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.