[dependabot]

Bumps hono from 4.13.14 to 4.13.17.

Release notes

Sourced from hono's releases.

v4.13.17

What's Changed

• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in honojs/hono#5608
• fix(utils/url): do not match a query key across separators in honojs/hono#5607
• fix(etag,pretty-json): cancel the discarded response body in honojs/hono#5606
• fix(client): detect the JSON media type with whitespace before a parameter in honojs/hono#5609
• fix(timing): honor a precision of 0 in setMetric in honojs/hono#5363
• fix(utils/mime,ssg): match media types case-insensitively in honojs/hono#5449
• fix(timing): escape double quotes and backslashes in Server-Timing descriptions in honojs/hono#5478
• fix(etag): preserve commas within quoted entity tags in honojs/hono#5353
• fix(accepts): preserve exact media type quality over subtype wildcards in honojs/hono#5427
• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in honojs/hono#5611
• fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in honojs/hono#5430
• fix(ssg): do not reuse created directories across toSSG runs in honojs/hono#5381
• fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in honojs/hono#5483
• fix(jsx): escape element and object attribute values in honojs/hono#5512
• fix(jsx): do not render ref objects as attributes in honojs/hono#5615
• fix(factory): keep independent return types for nine handlers in honojs/hono#5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

... (truncated)

Commits

• 61f7c59 4.13.17
• 1534ffa fix(factory): keep independent return types for nine handlers (#5618)
• eb754bd fix(jsx): do not render ref objects as attributes (#5615)
• 6cbe361 fix(jsx): escape element and object attribute values (#5512)
• 8b7f9e9 fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events (#...
• 7852e0a fix(ssg): do not reuse created directories across toSSG runs (#5381)
• bcfd02b fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary (#5430)
• 456fe46 fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in C...
• 98b35af fix(accepts): preserve exact media type quality over subtype wildcards (#5427)
• b3f1272 fix(etag): preserve commas within quoted entity tags (#5353)
• Additional commits viewable in compare view