Bump the npm group across 2 directories with 2 updates

[dependabot]

Bumps the npm group with 2 updates in the /example directory: hono and aws-cdk.
Bumps the npm group with 1 update in the /package directory: hono.

Updates hono from 4.13.4 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

Commits

• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• 3a67f7f Merge commit from fork
• 9c28d72 Merge commit from fork
• See full diff in compare view

Updates aws-cdk from 2.1138.0 to 2.1139.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1139.0

2.1139.0 (2026-08-26)

Features

• cli: default to errors-only progress when run by an AI agent (#1850) (37bbd4d), closes #1800
• deps: upgrade aws-cdk-lib (#1868) (7ff50e7)
• show the target environment in cdk diff stack headers (#1885) (f875d81), closes #286

Bug Fixes

• aws-cdk: cdk migrate deduplication drops resources with compound identifiers (#1879) (d30e791)
• aws-cdk: remove SIGINT listener leak in TelemetrySession (#1863) (83dcea3), closes #1862
• cli: --yes mode requires a TTY when a request's default is falsy (#1892) (acc6f4d)
• cli: cdk CLI alias package declares an entrypoint that does not exist (#1897) (2a6a802)
• cli: guide Stage users to a working pattern in stack-selection error (#1847) (d51353e), closes #1451 #1451
• cli: recognize the AI_AGENT convention and more coding agents (#1855) (6f7d58e), closes /github.com/anthropics/claude-code/blob/770933ea1ad2fa7b858191e397a65e6644771c64/CHANGELOG.md#L2349 /github.com/charmbracelet/crush/blob/7d78d7422a92918441a68d01d96d48fa3b9fd9db/internal/shell/shell.go#L46 /github.com/anomalyco/opencode/blob/b155b15694dbcc6768f11d2f25cc2bdd1f738ab4/packages/opencode/src/index.ts#L75 /github.com/anomalyco/opencode/blob/b155b15694dbcc6768f11d2f25cc2bdd1f738ab4/packages/opencode/src/index.ts#L76 /github.com/github/copilot-cli/blob/3f9c5e1ce792150a852804132e2b08c58e9a8e95/changelog.md#L1971 /github.com/QwenLM/qwen-code/blob/099a71c9364473303adb31e0dfb5f488b31634d9/packages/core/src/services/shellExecutionService.ts#L806 /github.com/openai/codex/blob/4a942885c8b4745757a9f86ad2075e16c42483c5/codex-rs/protocol/src/shell_environment.rs#L7 /github.com/openai/codex/blob/4a942885c8b4745757a9f86ad2075e16c42483c5/codex-rs/core/src/spawn.rs#L26 /github.com/openai/codex/blob/4a942885c8b4745757a9f86ad2075e16c42483c5/codex-rs/core/src/unified_exec/process_manager.rs#L93 /github.com/cline/cline/blob/16875140fbc7bae51aad79c203837b4f51e54aa5/apps/vscode/src/hosts/vscode/terminal/VscodeTerminalRegistry.ts#L31
• toolkit-lib: finalizing deployment after refactor intermittently fails while stacks are still in UPDATE_IN_PROGRESS (#1805) (beb1e2f), closes #1804

Commits

• d51353e fix(cli): guide Stage users to a working pattern in stack-selection error (#1...
• 793316b refactor(cli): consolidate stack selection on toolkit-lib selectors (#1896)
• 2a6a802 fix(cli): cdk CLI alias package declares an entrypoint that does not exist ...
• 83dcea3 fix(aws-cdk): remove SIGINT listener leak in TelemetrySession (#1863)
• acc6f4d fix(cli): --yes mode requires a TTY when a request's default is falsy (#1892)
• c31e049 refactor(cli): make IoHost listener removers using-compatible (#1888)
• e895513 refactor(cli): scope IoHost listeners via suppressMessages decorator (#1887)
• f875d81 feat: show the target environment in cdk diff stack headers (#1885)
• 0bae125 test(cli): snapshot the cdk synth output contract (#1865)
• d30e791 fix(aws-cdk): cdk migrate deduplication drops resources with compound identif...
• Additional commits viewable in compare view

Updates hono from 4.13.4 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

Commits

• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• 3a67f7f Merge commit from fork
• 9c28d72 Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/aws-cdk	2.1139.0	Unknown	Unknown
npm/hono	4.13.5	Unknown	Unknown
npm/hono	4.13.5	Unknown	Unknown

Scanned Files

• example/package.json
• package/package.json