Skip to content

chore(deps): bump hono from 4.12.26 to 4.13.1 in /agent - #27

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/agent/hono-4.12.32
Open

chore(deps): bump hono from 4.12.26 to 4.13.1 in /agent#27
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/agent/hono-4.12.32

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown

Bumps hono from 4.12.26 to 4.13.1.

Release notes

Sourced from hono's releases.

v4.13.1

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark v4.12 v4.13 Speedup
pingGET / 165.83 ns 163.99 ns 1.01x
queryGET /id/1?name=bun 674.40 ns 616.99 ns 1.09x
jsonGET /user 528.99 ns 422.44 ns 1.25x
bodyPOST /json 1.16 µs 1.00 µs 1.15x

The individual changes:

In addition, the RegExpRouter rewrite described below makes route registration plus the first match roughly 20% faster.

Thanks @​kibertoad for the contributions!

First-class QUERY method support

The QUERY method — a safe, idempotent method that carries a request body — is now a first-class citizen in Hono. You can define QUERY handlers with app.query():

const app = new Hono()
</tr></table>

... (truncated)

Commits
  • cf78528 4.13.1
  • f6aa913 fix(etag): skip unsafe methods or error responses on non-* case (#5196)
  • cd31bc1 fix(utils/stream): re-acquire writer lock when pipe() throws (#4988)
  • 569b419 fix(trie-router): count every slash a pattern consumes (#5189)
  • 192768f 4.13.0
  • b0c2d90 Merge pull request #5154 from honojs/next
  • 8f07028 fix(compress): set Vary: Accept-Encoding on negotiated responses (#5137)
  • 8a0b18f feat(reg-exp-router): throw UnsupportedPathError during route registration (#...
  • 3feb355 fix(jsx): allow a function component to return an array (#5179)
  • 5d911d2 feat(utils/headers): add HTTP fields newly registered with IANA (#5153)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026
@vercel

vercel Bot commented Jul 28, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
earlynotwrong Ready Ready Preview Aug 14, 2026 10:36am

@socket-security

socket-security Bot commented Jul 28, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​hono@​4.12.26 ⏵ 4.13.1100 +1100 +1697 +196 +1100

View full report

@dependabot dependabot Bot changed the title chore(deps): bump hono from 4.12.26 to 4.12.32 in /agent chore(deps): bump hono from 4.12.26 to 4.13.1 in /agent Aug 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/agent/hono-4.12.32 branch from 9aa9a3e to 9f69bfe Compare August 14, 2026 09:34
Bumps [hono](https://github.com/honojs/hono) from 4.12.26 to 4.13.1.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.26...v4.13.1)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/agent/hono-4.12.32 branch from 9f69bfe to f024eb3 Compare August 14, 2026 10:29
thisyearnofear pushed a commit that referenced this pull request Aug 15, 2026
…-sides incident)

Cycle #27 bought Typhoon YES (edge 0.64); cycle #29 bought the same market's
NO (edge 0.24) — opposite forecasts 1.5h apart, 193 TST locked in a
self-hedged position that loses fees either way. Three fixes:

1. One-thesis-per-market guard: skip any buy signal in a market with a
   tracked position (or one entered earlier this cycle).
2. reconcileWithChain(): the chain is the source of truth. At cycle start,
   adopt any on-chain open position the tracked ledger lost — the cycle-#29
   buy landed on-chain and in trades.jsonl, but a pm2 deploy reloaded the
   runner before positions.json/exposure.json were written. Entry metadata
   is recovered from the trade ledger; orphans without it are managed and
   redeemed but never scored for calibration. Adopt-only (never drop on
   subgraph absence — stale drops could free exposure for a double entry).
   Exposure is recomputed from the tracked set each cycle.
3. Persist positions + exposure immediately after each successful buy, not
   at cycle end, so a mid-cycle reload can't orphan a trade.

Also: the anchoring digest no longer hashes tradesPlaced — the thesis is the
view, not the execution count; with the guard, cycle N+1 derives an identical
view with 0 trades and must dedupe instead of re-anchoring (spends gas).

The ambiguity-resolution test now seeds the tracked ledger directly (the
guard makes new both-sides entries impossible by design). 538 tests.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
thisyearnofear pushed a commit that referenced this pull request Aug 18, 2026
…s ahead of Exa

Briefings have been dead since the Vercel gateway credit died (08-15):
briefings=0 every cycle since #27, because the original design coupled
search to the gateway credit (one generateText call per briefing).

briefing() now walks three rungs, first answer wins:

1. firecrawl - keyless POST api.firecrawl.dev/v2/search, highlights on by
   default, tbs=qdr:w freshness window. Pure retrieval - no synthesis LLM,
   so it cannot die with inference credit. Verified live from the VPS
   (~1.3s); the probe for the Typhoon query returned exactly the JMA
   evidence the lost trade needed.
2. parallel - the free anonymous Parallel Search MCP
   (search.parallel.ai/mcp, JSON-RPC tools/call web_search),
   objective-based with LLM-excerpted passages. Verified live (~1.5s).
3. exa-gateway - the original Exa rung, demoted to last; still gated on
   the promo window + gateway key.

Guardrails:
- Each rung owns a circuit breaker on the shared provider map:
  quota/credit-exhaustion errors trip a daily-reset (next 00:00 UTC)
  window, explicit 429s a 5-min window, anything else the standard 30 min.
  Breaker functions widened from LlmProviderName to string so web-search
  rungs can register without touching the LLM type.
- Budget (maxCallsPerCycle=10) now counts NETWORK CALLS, not briefing
  attempts - a three-rung cascade must not triple the free-tier spend.
- Cache hits always serve, including while breakers are open.
- Legacy single runSearch injection still replaces the whole ladder
  (older tests/configs stay valid).

Provenance: webSource (firecrawl/parallel/exa) added to ForecastProvenance,
the tracked position, the Telegram entry tag (web:firecrawl), and the
arena-card tag + legend. FIRECRAWL_API_KEY / PARALLEL_API_KEY are optional
limit-raisers, documented in .env.example (keyless tiers work without).

569 tests (was 560). tsc clean (agent + root).

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants