[dependabot]

Bumps hono from 4.13.3 to 4.13.13.

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in honojs/hono#5445
• fix(jsx): allow JSXNode function component results in honojs/hono#5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
• test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
• fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
• chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits

• 08a023c 4.13.13
• ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
• f23b146 fix(jsx): allow JSXNode function component results (#5476)
• 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
• deff529 test(client): simulate network error for undefined route in parseResponse tes...
• 6abd35b 4.13.12
• 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
• afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
• e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
• c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | effort=max

动机

从源码安装依赖并验证 DSH 插件的维护者。 原锁文件把 MCP SDK 的 Hono 固定在 4.13.3；这次更新到 4.13.13，使同一依赖入口获得上游修复，同时保留现有插件加载和交互。 实际锁定的 Hono 不再把 URL fragment 后面的内容误当查询参数，普通请求和拒绝行为保留，插件构建及真实宿主检查通过。 这只更新源码验证环境的锁定依赖，不升级用户现有 DSH、发布新插件、改变 LoopX 权限或证明所有上游安全问题都已消除。 上游已发布的查询解析反例在实际被 MCP SDK 解析到的旧包上可复现，因此更新有具体维护价值；不是把“补丁版本”或兼容分数当验收。

改动思路

复用既有锁文件和上游包，插件没有新增运行层、授权层或兼容分支；是否安全取决于实际解析到的依赖与宿主行为，不能只看版本号或 diff 行数。 本 PR 仅改变源码依赖闭包；发布插件的 Host/Client 生产字节和用户 DSH 的升级路径不变。 保留正常冻结安装、现有 loader、HTTP carrier 和同会话 Driver，不添加 vendored fork 或第二套请求策略。旧锁与新锁均用 pnpm 10.33.0 安装；还分别构建并启动实际 DSH 0.2.0-rc.2 打包环境，核对原生请求边界、退出和禁用恢复。

具体改动

评审精确 8959e2af0f15b19c7c5aced46f759118c84b1bcc，实际不可变 PR 基线 c7d8c3c6fad76e297da6b5e5eaef7c28b647ccee。评审前读取 包契约：packages/dsh-loopx-plugin/README.md，spec_revision c7d8c3c6fad76e297da6b5e5eaef7c28b647ccee。Install implemented：原构建、打包和受支持宿主入口通过；GoalBar authority and privacy boundary implemented：原 HTTP 认证/Origin 边界及固定调用保留；Driver activation boundary implemented：默认安装不激活会话；Shadow observer (default off) implemented：已有未配置隔离测试通过。Maintainer release and marketplace handoff out_of_scope：本次没有命名发布、市场上架或用户升级，不把源码维护当发布完成。

关键代码讲解

• packages.hono@4.13.13：4.13.3 replaced by4.13.13; same Node engine floor.
• snapshots.MCP-SDK.hono：SDK and node-server snapshot edges select the new Hono; node-server itself stays2.1.0.
• packages.ajv-formats@3.0.1：Same tarball integrity; ajv becomes normal dependency in snapshot instead of optional peer. Four optional Session-cache peer edges also disappear while DSH-base normal cache dependency remains.

完整锁文件是 +1872/-1892，净 -20；这不是 3764 行新业务逻辑。逐节点检查 958→957 个 snapshot、3635→3624 条依赖边，无悬空引用；除 Hono 的包版本/摘要，还改了 ajv-formats 的 peer 元数据，并移除 controller/query/reference 的四条可选 Session-cache 边。不能把这些全部称为字符串格式变化。DSH-base 的正常 cache 依赖仍在，实际两臂都能从默认 DSH→base 解析该模块；测试、类型检查及真实宿主通过。任意自定义 DSH 组合没有因此被普遍认证。

对主干的风险

229 项测试、三层 TypeScript 类型检查、正常构建与标准 premerge 通过。两臂实际打包/HTTP runtime smoke 覆盖：bootstrap 先于 ready、技能可见性、Client 物化、loopback fence、当前会话绑定、Start/Pause、pending watch 取消、dispose；移除 LoopX 后 DSH 仍可用，并能在禁用该包时启动。这里使用隔离 DSH 和合成 LoopX CLI 边界，没有真实模型调用；浏览器挂载后的人工视觉层没有重跑，也没有据此扩展 UI、Windows 或发布资格。

基线和当前构建的 28 个 lib 文件逐字节一致，说明新 Hono 不被打进插件 Host/Client 生产字节。实际 MCP SDK 解析旧 4.13.3 时，fragment 后的 query-like 内容会被读成参数；解析当前 4.13.13 时该参数为空，普通查询、403 拒绝和 404 保持一致。这与上游 4.13.5 发布说明的意图一致。已读至 4.13.13 的完整发布区间，包括 adapter/mount 的兼容说明；没有为了新 API 改写本项目调用者。

Hono 内部修复不代表所有相关包都升级：@hono/node-server 仍为 2.1.0，而上游 4.13.11 说明另提其 2.1.3 修复；本 PR 不应宣称整个 SDK 的所有安全面已消除。当前 LoopX 路由没有新增 static serving 或权限入口。最初辅助探针误用没有 root export 的 DSH 包名解析，已改为从正常安装的 package manifest 路径核实际解析，不是产品失败或权限绕过。未查询、轮询或等待 CI。

我的整体评价

精确 head 的锁定依赖维护达到 goal_achieved，结论 APPROVE。long_horizon 为 preserved：原会话激活、暂停/禁用、重读和清理边界保留，不增后台模型或重试；user_experience 为 preserved：已有安装、错误和 HTTP 交互通过，无新增用户配置或确认。Hono 的上游解析修复是明确的有意变化，不能把整个依赖闭包称为完全等价。当前图虽有 peer 重写，实际默认消费者验证足以支持此有界更新；没有以行数、版本号或测试数代替设计判断。复用现有词汇和 owner，无新增共享状态。保留自定义宿主、其他版本、安装用户升级、浏览器/Windows/Docker、模型与长期成本的未测范围；不授予合并或发布。

English verdict: APPROVE — 8959e2af0f15b19c7c5aced46f759118c84b1bcc. The actual SDK-resolved Hono fixes the published fragment-query defect, while frozen installation,229tests,typecheck,byte-identical plugin outputs and base/head real packed DSH HTTP/default-off recovery checks pass. Peer graph changes are explicitly audited; this does not upgrade an existing user host or certify every upstream security surface.