chore(deps): bump hono from 4.12.31 to 4.13.1

[dependabot]

Bumps hono from 4.12.31 to 4.13.1.

Release notes

Sourced from hono's releases.

v4.13.1

What's Changed

• fix(trie-router): count every slash a pattern consumes by @​Jaybhade in honojs/hono#5189
• fix(utils/stream): re-acquire writer lock when pipe() throws by @​Sriharsha-dev369 in honojs/hono#4988
• fix(etag): skip unsafe methods or error responses on non-* case by @​na-trium-144 in honojs/hono#5196

New Contributors

• @​Jaybhade made their first contribution in honojs/hono#5189
• @​Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in honojs/hono#5118
• perf(url): replace regex tests with indexOf honojs/hono#5121
• perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122
• perf(urls): refactor tryDecodeURIComponent honojs/hono#5158
• perf(request): allocate #validatedData lazily honojs/hono#5175
• perf(request): probe the body cache without allocating honojs/hono#5176

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
</tr></table>

... (truncated)

Commits

• cf78528 4.13.1
• f6aa913 fix(etag): skip unsafe methods or error responses on non-* case (#5196)
• cd31bc1 fix(utils/stream): re-acquire writer lock when pipe() throws (#4988)
• 569b419 fix(trie-router): count every slash a pattern consumes (#5189)
• 192768f 4.13.0
• b0c2d90 Merge pull request #5154 from honojs/next
• 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
• 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
• 3feb355 fix(jsx): allow a function component to return an array (#5179)
• 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
• Additional commits viewable in compare view

[cursor]

PR Summary

Low Risk
Dependency-only lockfile change with no app code edits; risk is limited to indirect HTTP/MCP/JWT behavior from upgraded hono and jose.

Overview
Updates pnpm-lock.yaml to pull hono 4.13.1 (from 4.12.31) and aligns @hono/node-server to 1.19.17. Hono enters the tree as a transitive dependency of @modelcontextprotocol/sdk (used by @anthropic-ai/claude-agent-sdk), not as a direct app dependency.

The lockfile also refreshes several packages in that MCP stack—jose, express-rate-limit, cors, ajv, and Express 5–related pins—plus minor AWS SDK client graph tweaks and the clearbit needle git resolution format. No application source files change.

hono 4.13.x brings request-path performance work, QUERY method support, and 4.13.1 fixes trie routing, streaming pipe() writer locks, and etag handling on unsafe methods/errors.

^{Reviewed by Cursor Bugbot for commit 06bf623. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 66c55c1. Configure here.}

[cursor]

Lockfile forces SSH for needle

High Severity

This lockfile rewrite changes clearbit's needle dependency from a public HTTPS tarball to a git@github.com SSH resolution (git+https://git@github.com:clearbit/needle.git). CI here runs pnpm i --frozen-lockfile without an SSH agent, so installs can fail with publickey errors even though the package is public.

Additional Locations (1)

• pnpm-lock.yaml#L15694-L15695

 

^{Reviewed by Cursor Bugbot for commit 66c55c1. Configure here.}