From c62e1068f94f4d0b48d68827b6674f672d8dbfd0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 00:55:00 +0000
Subject: [PATCH 1/2] build(deps): bump hono

Bumps the all-security-updates group with 1 update in the / directory: [hono](https://github.com/honojs/hono).


Updates `hono` from 4.13.1 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.13.1...v4.13.7)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: indirect
  dependency-group: all-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f2a7bdb..708aa96 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8846,9 +8846,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.1",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.1.tgz",
-      "integrity": "sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==",
+      "version": "4.13.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
+      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

From 884109aa46aef0baa33bd478114c988f296a2257 Mon Sep 17 00:00:00 2001
From: Arnab Nandy <arnab_nandy7@yahoo.com>
Date: Sat, 12 Sep 2026 17:38:59 +0530
Subject: [PATCH 2/2] ci: regenerate lockfile with npm during dependabot
 consolidation

---
 .github/workflows/dependabot-single-pr.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-single-pr.yml b/.github/workflows/dependabot-single-pr.yml
index 67a5b6b..b48c1e7 100644
--- a/.github/workflows/dependabot-single-pr.yml
+++ b/.github/workflows/dependabot-single-pr.yml
@@ -65,8 +65,13 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git fetch origin \
             "refs/heads/${SOURCE_BRANCH}:refs/remotes/origin/dependabot-update"
-          git merge --no-ff origin/dependabot-update \
+          git merge --no-ff -X ours origin/dependabot-update \
             -m "build(deps): incorporate Dependabot update #${SOURCE_PR}"
+          npm install --package-lock-only
+          if ! git diff --quiet package-lock.json; then
+            git add package-lock.json
+            git commit --amend --no-edit
+          fi
 
       - name: Verify the combined dependency tree
         if: steps.target.outputs.found == 'true'