Bump the npm group across 2 directories with 2 updates

[dependabot]

Bumps the npm group with 1 update in the /starter-kits/javascript/openapi-validation directory: openapi-backend.
Bumps the npm group with 1 update in the /starter-kits/javascript/typescript-hono directory: hono.

Updates openapi-backend from 5.21.1 to 5.21.2

Changelog

Sourced from openapi-backend's changelog.

5.21.2 - 2026-09-29

Two security fixes. Upgrade if you use security handlers or apiRoot.

Security

• A security handler that threw or rejected with a falsy reason (throw undefined, Promise.reject(null)) was counted as passing, and a security scheme named authorized could overwrite the computed verdict. Both now fail authentication. High severity, a regression from the 5.18.0 fix. GHSA-fwvf-w25j-mj87 (5ae65a2)
• apiRoot was stripped by prefix without a path boundary, so //pets routed to /pets and /apiadmin to /api/admin. The router no longer aliases paths. Medium severity. GHSA-m748-x4gc-4w5w (073c498)

Commits

• 796f75c 5.21.2
• 5ae65a2 Merge commit from fork
• 073c498 Merge commit from fork
• 5bfce13 docs: link to openapi-backend-codeql from README (#1011)
• 2b967fb Remove libraries.io badge (doesn't update)
• 7a08445 chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 (#1008)
• e4e8021 chore(deps-dev): bump prettier from 3.0.3 to 3.9.8 (#1003)
• d9a29ea 5.21.1
• See full diff in compare view

Updates hono from 4.13.11 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in honojs/hono#5445
• fix(jsx): allow JSXNode function component results in honojs/hono#5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
• test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
• fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
• chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

Commits

• 08a023c 4.13.13
• ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
• f23b146 fix(jsx): allow JSXNode function component results (#5476)
• 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
• deff529 test(client): simulate network error for undefined route in parseResponse tes...
• 6abd35b 4.13.12
• 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
• afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
• e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
• c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
• Additional commits viewable in compare view