[dependabot]

Bumps the prod-minor-patch group with 2 updates: hono and marked.

Updates hono from 4.13.13 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

• docs(contributing): ask for issues instead of RPs honojs/hono#5526
• docs(readme): sync the contributing list with CONTRIBUTING.md honojs/hono#5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range honojs/hono#5537
• chore: unified oxfmt and oxlint config honojs/hono#5518
• docs(readme): remove the deepwiki badge honojs/hono#5548
• fix(serve-static): only serve GET and HEAD requests honojs/hono#5514
• fix(build): keep barrel imports in the bundled d.ts honojs/hono#5557
• fix(jsx): preserve self-closing void elements in cloneElement honojs/hono#5314
• fix(css): keep "//" inside an unquoted url() when minifying honojs/hono#5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying honojs/hono#5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files honojs/hono#5436
• fix(helper/route): match regex params in basePath() the same way as the router honojs/hono#5498
• fix(trie-router): keep first value for duplicate path params honojs/hono#5423
• fix(hono-base): disallow getPath when strict is false honojs/hono#5563
• fix(css): Fix multiline CSS handling in style replacement honojs/hono#5405
• feat(bearer-auth): allow MessageFunction to return a Response honojs/hono#5269
• fix(utils/url): preserve encoded duplicate query order honojs/hono#5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

Commits

• bac5c4a 4.13.14
• eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
• 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
• 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
• e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
• 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
• e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
• d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
• ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
• 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
• Additional commits viewable in compare view

Updates marked from 18.1.1 to 18.1.2

Release notes

Sourced from marked's releases.

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

• allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)
• apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)
• cli: await config functions before parsing (#4138) (3a11ad1)
• cli: create no-clobber output files atomically (#4135) (e7c4f64)
• do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)
• expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)
• honor per-call async options when composing hooks (#4139) (379be9d)
• keep a line starting with # but no space in the list item (#4127) (6b63189)
• keep duplicate link definitions in the tokens (#4132) (2784acc)
• keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)
• keep lazy setext underlines in list items as text (#4126) (398234c)
• render nested image alt formatting as plain text (#4131) (15f59bb)
• stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

• ~16% faster parsing by skipping em/strong masking for runs without *, _ or ~ (#4142) (f0fd3e0)

Commits

• 5beecae chore(release): 18.1.2 [skip ci]
• c1e6ca1 chore(deps): update deps (#4168)
• 3a01ac4 chore: test:redos -> test:recheck (#4167)
• 15f59bb fix: render nested image alt formatting as plain text (#4131)
• 2d3899b fix: expand a tab after the block quote marker to the next tab stop (#4110)
• e09c40d fix: allow a tab or end of input after a type 6 html block tag name (#4128)
• 398234c fix: keep lazy setext underlines in list items as text (#4126)
• 6b63189 fix: keep a line starting with # but no space in the list item (#4127)
• 5d8e234 fix: apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145)
• 3a11ad1 fix(cli): await config functions before parsing (#4138)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions