v4.13.5

## Security fixes

This release includes fixes for the following security issues:

### Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a `?` after a `#` was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

### Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Affects: `toSSG()` for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in `ssgParams` values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

### Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Affects: `parseBody()` when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use `parseBody({ dot: true })` are strongly encouraged to upgrade to this version.