build(deps): bump the production-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: hono and valibot.

Updates hono from 4.13.3 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• Additional commits viewable in compare view

Updates valibot from 1.4.2 to 1.5.0

Release notes

Sourced from valibot's releases.

v1.5.0

Many thanks to @​tats-u, @​idleberg, @​yslpn, @​francisjohnjohnston-web, @​MaxFreedomPollard, @​mahirhir, @​ItzXynx, @​LeSingh1, @​maxtaran2010, @​ysknsid25, @​cyyynthia, @​spokodev and @​sanjibani for contributing to this release.

• Add codePoints, maxCodePoints, minCodePoints and notCodePoints validation actions to validate the number of Unicode code points (pull request #888)
• Add ksuid validation action to validate KSUIDs (pull request #1370)
• Change Standard Schema properties to use eager initialization for faster schema construction and replace internal _getStandardProps utility with _standardSchema (pull request #1534)
• Change url action to use URL.canParse when available to avoid constructing URL objects (pull request #1608)
• Fix stringifyJson action to preserve the dataset value when JSON.stringify returns undefined (pull request #1476)
• Fix literal schema and value, values, notValue and notValues actions to treat NaN as equal to itself (pull request #1573)
• Fix intersect schema to merge matching NaN values and invalid dates (pull request #1573)
• Fix cache and cacheAsync methods to clone the issues of a cached dataset, preventing parent schemas from adding their path item to the same issue on every cache hit (pull request #1620)
• Fix strictObject, looseObject, objectWithRest and their async variants to correctly handle unknown input keys that collide with Object.prototype members (pull request #1523)
• Fix intersect and intersectAsync schemas to ignore inherited properties when merging objects and preserve own properties without invoking inherited setters or changing the output prototype (pull request #1621)
• Fix ulid action to reject ULIDs that exceed the maximum 128-bit value (pull request #1498)
• Fix email action to reject non-ASCII characters accepted by Unicode case folding (pull request #1075)

v1.5.0 (to-json-schema)

• Add support for JSON Schema draft-2020-12 and OpenAPI 3.0 Schema Object format
• Add propertyNames support to record schemas for key validation constraints
• Add support for toBigint, toBoolean, toDate, toNumber and toString actions for typeMode: 'input'
• Add new toStandardJsonSchema function to convert Valibot schemas to Standard JSON Schema format
• Change return type from JSONSchema7 to a custom JsonSchema type

Commits

• 5016198 chore: prepare Valibot v1.5.0 release (#1627)
• 1ffb038 fix(intersect): skip inherited prototype props in _merge (#1621)
• 1c4983f fix(ulid): restrict first character to 0-7 per ULID spec (#1498)
• 5e449cd perf(url): use URL.canParse for validation (#1608)
• 4acda1b Make sure that email validators don't match unintentional non-ASCII local par...
• 95943ab fix: handle object keys that collide with Object.prototype in object schemas ...
• d65438c fix(cache): clone cached issues to stop issue paths from accumulating (#1620)
• 3ed804a dependabot: bump the github-actions group across 1 directory with 2 updates (...
• 0681f43 fix: use SameValueZero equality for special numeric values (#1573)
• 98ef8b4 Improve perf by changing ~standard implementation (#1534)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1f4461e0-814b-4946-87bc-28dcaf5bf451

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}