Summary
Hono 4.13.5 fixes query parsing that could read parameters after a URL fragment, creating cache-key and proxy interpretation differentials. It also closes a toSSG path-normalisation gap that could write outside the output directory and bounds dot-notation expansion in parseBody() to prevent memory exhaustion.
Why it matters
These issues affect web applications deployed behind proxies, WAFs or static-site pipelines, so maintainers should treat the patch as an upgrade rather than a routine bugfix.
Related coverage
- Node.js 26.8 adds crypto, diagnostics and SQLite APIs
- pnpm 12 makes dependency resolution and runtime selection more deterministic
- Codex CLI 0.150 makes cross-task coordination and trust controls first-class