build(deps): bump hono from 4.10.6 to 4.13.9

[dependabot]

Bumps hono from 4.10.6 to 4.13.9.

Release notes

Sourced from hono's releases.

v4.13.9

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380
• fix(accepts): match media types and language tags case-insensitively in honojs/hono#5376
• fix(linear-router): don't match an empty path segment as a param in honojs/hono#5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in honojs/hono#5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in honojs/hono#5379
• fix(aws-lambda): treat binary +xml archive media types as binary in honojs/hono#5424
• fix(aws-lambda): preserve empty query parameters in honojs/hono#5292
• fix(lambda-edge): sync content type detection with aws-lambda in honojs/hono#5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in honojs/hono#5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

What's Changed

• docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343
• perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340
• fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351
• fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311
• fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349
• fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357
• fix(request): keep the request media type when reusing a cached body in honojs/hono#5366
• docs(combine): fix except() JSDoc param and add missing @​returns in honojs/hono#5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

... (truncated)

Commits

• 7c3b0df 4.13.9
• 6cadf75 fix(lambda-edge): fail with a descriptive error on a malformed event (#5358)
• de310ac fix(lambda-edge): sync content type detection with aws-lambda (#5426)
• 28e8572 fix(aws-lambda): preserve empty query parameters (#5292)
• 0d86899 fix(aws-lambda): treat binary +xml archive media types as binary (#5424)
• 52febbc fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url (#5...
• f950277 fix(pretty-json): don't break responses with unparseable JSON bodies (#5377)
• 00ee875 fix(linear-router): don't match an empty path segment as a param (#5373)
• f5a5346 fix(accepts): match media types and language tags case-insensitively (#5376)
• cb5bea3 fix(jsx): replace Suspense and ErrorBoundary content across newlines (#5380)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #294.