[dependabot]

Bumps hono from 4.13.13 to 4.13.14.

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

• docs(contributing): ask for issues instead of RPs honojs/hono#5526
• docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range honojs/hono#5537
• chore: unified oxfmt and oxlint config honojs/hono#5518
• docs(readme): remove the deepwiki badge honojs/hono#5548
• fix(serve-static): only serve GET and HEAD requests honojs/hono#5514
• fix(build): keep barrel imports in the bundled d.ts honojs/hono#5557
• fix(jsx): preserve self-closing void elements in cloneElement honojs/hono#5314
• fix(css): keep "//" inside an unquoted url() when minifying honojs/hono#5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying honojs/hono#5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files honojs/hono#5436
• fix(helper/route): match regex params in basePath() the same way as the router honojs/hono#5498
• fix(trie-router): keep first value for duplicate path params honojs/hono#5423
• fix(hono-base): disallow getPath when strict is false honojs/hono#5563
• fix(css): Fix multiline CSS handling in style replacement honojs/hono#5405
• feat(bearer-auth): allow MessageFunction to return a Response honojs/hono#5269
• fix(utils/url): preserve encoded duplicate query order honojs/hono#5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

Commits

• bac5c4a 4.13.14
• eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
• 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
• 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
• e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
• 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
• e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
• d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
• ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
• 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps hono from 4.13.13 to 4.13.14, a semver patch update that includes bug fixes for routing, CSS minification, and serve-static handling. No breaking changes are expected.

^{Written for commit 638374f. Summary will update on new commits.}

[Copilot]

🟢 Approval recommended

There are no active review issues for the Hono patch-version dependency update.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Updates Hono from 4.13.13 to 4.13.14 for the Python SDK’s MCP mock-server test infrastructure.

Changes:

• Keeps Hono exactly pinned at the new patch version.
• Updates the lockfile integrity hash and Hono peer-dependency references.

File	Description
pnpm-lock.yaml	Updates Hono’s locked version, integrity hash, and adapter references.
package.json	Bumps the Hono development dependency to 4.13.14.

_{Review effort: Balanced}

[glebedel]

s2d2 Security Autopilot evidence, 2026-11-03

Bump: hono 4.13.13 to 4.13.14 (development scope, patch update).
Verdict: SAFE.

• dev-only patch, CI green
• CI green on the current head (10 checks)
• Merge state: BLOCKED (a human approving review is required; s2d2 never approves PRs)

Posted by s2d2 Security Autopilot for Guillaume. Reply here if this is wrong.

[glebedel]

Redundant: grouped PR #250 already contains this exact bump (same versions and SHAs in the same files) with CI green. No open Dependabot alert on this package. Closed by s2d2 Security Autopilot for Guillaume. Reopen if this is wrong.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.