Skip to content

chore(deps): bump hono and openclaw - #124

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d3b479f23e
Open

chore(deps): bump hono and openclaw#124
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d3b479f23e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor

Bumps hono and openclaw. These dependencies needed to be updated together.
Updates hono from 4.12.12 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

  • fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
  • test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
  • fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
  • fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
  • fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
  • chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits
  • 08a023c 4.13.13
  • ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
  • f23b146 fix(jsx): allow JSXNode function component results (#5476)
  • 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
  • deff529 test(client): simulate network error for undefined route in parseResponse tes...
  • 6abd35b 4.13.12
  • 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
  • afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
  • e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
  • c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates openclaw from 2026.4.10 to 2026.9.8

Release notes

Sourced from openclaw's releases.

openclaw 2026.9.8

OpenClaw v2026.9.8

58 commits · 43 pull requests · 21 contributors

Changes included in this release

The release notes and changelog contain the same content, presented in two formats:

  • Release notes — formatted for people, with expandable sections.
  • Changelog — plain Markdown for AI agents and tools.

Thanks

@​609NFT @​aniketkrs @​aniruddhaadak80 @​EndeavorPioneer @​ericcaiwx-star @​fuller-stack-dev @​hailongguo0530-alt @​jasdeepohri-max @​miguelpt2026 @​NickM83 @​obviyus @​Patrick-Erichsen @​PennyVibe @​RomneyDa @​scotthuang @​steipete @​VACInc @​vincentkoc @​WG-Mojo @​xilopaint @​yashas-13

Release verification

openclaw 2026.9.7

OpenClaw v2026.9.7

518 direct commits · 2,818 pull requests · 334 contributors

Changes included in this release

The release notes and changelog contain the same content, presented in two formats:

  • Release notes — formatted for people, with expandable sections.
  • Changelog — plain Markdown for AI agents and tools.

Thanks

... (truncated)

Changelog

Sourced from openclaw's changelog.

Changelog

Release notes: https://docs.openclaw.ai/releases

Each release has its complete changelog below. Audited contribution records are retained separately when available.

... (truncated)

Commits
Install script changes

This version adds preinstall script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump hono and openclaw
33379b5 
Bumps [hono](https://github.com/honojs/hono) and [openclaw](https://github.com/openclaw/openclaw). These dependencies needed to be updated together.

Updates `hono` from 4.12.12 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.12...v4.13.13)

Updates `openclaw` from 2026.4.10 to 2026.9.8
- [Release notes](https://github.com/openclaw/openclaw/releases)
- [Changelog](https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md)
- [Commits](openclaw/openclaw@v2026.4.10...v2026.9.8)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: indirect
- dependency-name: openclaw
  dependency-version: 2026.9.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: exampleuser. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@coderabbitai

coderabbitai Bot commented Oct 7, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 415b4f92-9590-4bc9-b009-f9da2bf6c457

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown

⚠️ Large PR Detected

This PR is quite large (17711 lines changed across 1 files).

Consider breaking it into smaller PRs for easier review:

  • ✅ Smaller PRs are reviewed faster
  • ✅ Easier to identify bugs
  • ✅ Safer to revert if needed

If this is intentional (refactor, major feature), feel free to ignore.

@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown

🔍 Quality Preview

The full CI pipeline is running. Expected checks:

Check Status
TypeScript 🔄 Running
ESLint 🔄 Running
Tests 🔄 Running
Coverage 🔄 Running

Check the CI workflow for details.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/large

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants