[Deicyde]

Problem

npm audit of wiki/package-lock.json on main flags the Worker's runtime framework, hono 4.12.34 (vulnerable at or below 4.13.6):

• GHSA-crvj-82cr-hjcx: the query parser reads parameters after the URL fragment, which causes cache-key and proxy interpretation differentials.
• GHSA-g6gw-c38x-mqfc: unbounded dot-notation nesting in parseBody() can exhaust memory.
• GHSA-gqvv-2mrq-wpjv: toSSG() can write outside its output directory.

The Worker doesn't use parseBody, toSSG or Hono's cache middleware, so only the query-parser fix plausibly applies here: the Worker parses query strings behind Cloudflare's proxy. It's still the runtime dependency, and the fix is a minor-version bump.

Change

• hono 4.12.34 → 4.13.13, keeping the exact pin.
• The package-lock.json change is limited to the root dependency and hono's own entry (version, tarball and integrity, which match the registry). @hono/node-server's peer range (^4) still holds.

How tested

• Read the release notes for v4.13.0 through v4.13.13. They list no breaking changes: performance work in 4.13.0, the security fixes above, and deprecations (app.mount, hono/<adapter> imports) that still work in v4.
• The Worker imports only hono and hono/cookie, and uses none of the APIs whose behavior changed (serveStatic, secureHeaders, parseBody, app.mount).
• CI on this PR runs the full Worker, Python and browser suites.

Risks

• 4.13.0 optimized the core request and response path. CI's full suites are the check.

Release

• Release-affecting (per site/ops/brain_release_authority.py): wiki/package.json and wiki/package-lock.json. It ships only through a Brain release and promotion. Merge it before release B is built to include it there; otherwise it rides the next release.

What Jack must do

• Nothing beyond the release.
• Not included, each needing its own decision:
  • wrangler 4.151.1 fixes high advisories in miniflare, sharp and undici, but it is the promoter's deploy tool, so its timing relative to release B matters.
  • vitest 5 is a major upgrade that fixes the critical tinypool advisory in dev-only test tooling.
  • ajv 8.20.0 may change the generated companion validator.

[Deicyde]

Recommendation: close as superseded by #84 (updated). #84 moved main to hono 4.13.12, which already carries every published hono security fix (see the evidence above). 4.13.13 adds only the Mount Middleware and deprecates app.mount(), and the Worker uses neither. Dependabot (#80) can propose later versions on its own schedule.

Posted by the WikiLean PR swarm (lead); updated 2026-10-18.

[Deicyde]

Recommendation: close as superseded by #84.

• Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84 already moved main to hono 4.13.12. It merged in cdc2b1c6, changing wiki/package.json and wiki/package-lock.json. Those are the same lines this PR changes, which is why it now conflicts.
• 4.13.12 already carries the security fixes. Every published hono advisory is patched at 4.13.11 or earlier:
  • GHSA-5r4p-p66f-jhc7 (serveStatic double decode): 4.13.11
  • GHSA-hxh3-vqpv-xpqv (JSX boundary XSS): 4.13.7
  • GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv and GHSA-crvj-82cr-hjcx: 4.13.5
  • the three 4.12.34 advisories
• 4.13.13 has no security fixes. Its release notes add the Mount Middleware (hono/mount) and deprecate app.mount(). The Worker doesn't use either.
• What follows from closing: Dependabot (CI: Dependabot for npm (wiki), pip and GitHub Actions #80) can propose 4.13.13 or later on its own schedule, and the "merge wiki: hono 4.12.34 -> 4.13.13 (security fixes) #81 before CI: Dependabot for npm (wiki), pip and GitHub Actions #80" ordering no longer applies.