From 3e8b1ebb38db943c1498ba114fbe434c6216ca00 Mon Sep 17 00:00:00 2001
From: John Coffey <johnellis@linux.com>
Date: Thu, 10 Sep 2026 06:21:56 -0700
Subject: [PATCH] Take hono to 4.13.7 and let Dependabot open the next one

Three medium advisories land on hono before 4.13.5: a toSSG() path
escape, a query parser that reads parameters past the URL fragment, and
unbounded dot-notation nesting in parseBody(). Only the second one
touches this server -- c.req.query() is read in imageproxy, icsproxy and
app -- and even there safeFetch validates the value it actually fetches
rather than a separate pre-check, so there was nothing to desync. toSSG
and parseBody are never called. The bump is still worth taking on its
own: it is a patch release with no API change.

The declared range moves with it, from ^4.7.4 to ^4.13.7, so the
security floor is recorded in server/package.json and not only in the
lockfile.

The dependabot.yml is the actual fix for how these were found. There was
no config, so nothing opened a PR and the alerts sat on a dashboard
until someone thought to look. Routine updates now group into one PR a
week; majors stay separate, because they are migrations.
---
 .github/dependabot.yml | 44 ++++++++++++++++++++++++++++++++++++++++++
 package-lock.json      |  8 ++++----
 server/package.json    |  2 +-
 3 files changed, 49 insertions(+), 5 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..cab9c31
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,44 @@
+version: 2
+updates:
+  # The npm entry sits at the root because that is where the single lockfile
+  # is: root, server and web are one npm workspace, so one entry covers all
+  # three. Pointing entries at server/ or web/ would find package.json files
+  # with no lockfile beside them and update nothing.
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    groups:
+      # Everything routine arrives as one PR a week, so the dashboard is not
+      # the only place these get noticed. Majors are deliberately left out of
+      # the group: they are migrations, not bumps -- vitest 3 to 4 is one --
+      # and each deserves its own PR and its own CI run.
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
+    groups:
+      actions:
+        patterns:
+          - "*"
+  # The runtime and build stages both pin node:22-alpine, so this is what
+  # keeps the published container images off a stale base between the weekly
+  # releases.
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: tuesday
+      time: "09:00"
+      timezone: Etc/UTC
diff --git a/package-lock.json b/package-lock.json
index f3691f2..628e4e7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2133,9 +2133,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.3",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.3.tgz",
-      "integrity": "sha512-r8AO2mYHoLxSHkgafNeC/BXyb2vWRxD3jem4Ts+ptav8oTG5FIRifAjuJEmZI4bSvvc2ns0GxmIYiZnHqN3mMw==",
+      "version": "4.13.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
+      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -3830,7 +3830,7 @@
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@hono/node-server": "^1.13.8",
-        "hono": "^4.7.4"
+        "hono": "^4.13.7"
       },
       "devDependencies": {
         "@types/node": "^22.13.10",
diff --git a/server/package.json b/server/package.json
index 14bf68d..4044769 100644
--- a/server/package.json
+++ b/server/package.json
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.13.8",
-    "hono": "^4.7.4"
+    "hono": "^4.13.7"
   },
   "devDependencies": {
     "@types/node": "^22.13.10",