Skip to content

chore(deps): bump hono from 4.12.21 to 4.12.25#623

Merged
corinagum merged 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.12.25
Jun 16, 2026
Merged

chore(deps): bump hono from 4.12.21 to 4.12.25#623
corinagum merged 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.12.25

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown
Contributor

Bumps hono from 4.12.21 to 4.12.25.

Release notes

Sourced from hono's releases.

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

What's Changed

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

What's Changed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.12.21 to 4.12.25.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.21...v4.12.25)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.25
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 16, 2026
Copilot AI review requested due to automatic review settings June 16, 2026 20:09

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@corinagum
corinagum added this pull request to the merge queue Jun 16, 2026
Merged via the queue into main with commit a38ca72 Jun 16, 2026
5 checks passed
@corinagum
corinagum deleted the dependabot/npm_and_yarn/hono-4.12.25 branch June 16, 2026 22:07
@lilyydu lilyydu mentioned this pull request Jul 16, 2026
lilyydu added a commit that referenced this pull request Jul 16, 2026
## Release v2.0.14

Prepares the stable **2.0.14** release by merging `main` into `release`
and setting `version.json` to the stable version (removing the
`-preview.{height}` suffix).

- Previous release: `2.0.13` (published 2026-06-15)
- Only functional diff vs `main` is `version.json`:
`2.0.14-preview.{height}` → `2.0.14`

## What's in this release

### 🚀 Features
* Flatten client method chains to reduce call hops by @lilyydu in
#634
* Support resetting response streams and streaming error handling by
@lilyydu in #635
* Add `extendedMarkdown` text format value by @singhk97 in
#615

### 🐛 Fixes
* Set `replyToId` for all streaming activities by @lilyydu in
#646
* Use `artifactName` for pipelineArtifact inputs in publish pipeline by
@corinagum in #625

### ♻️ Refactors
* Move `apps` from file-based mixins to real classes by @heyitsaamir in
#633
* Split up Outbound and Inbound Activities by @heyitsaamir in
#639
* Remove `ExperimentalTeamsQuotedReplies` markers by @corinagum in
#621

### 🧪 Tests
* Add integration tests for Teams TypeScript SDK by @corinagum in
#622

### 📚 Docs & Examples
* Migrate examples to the flattened conversation API by @lilyydu in
#637
* Note npm CFS proxy for Microsoft-managed devices by @corinagum in
#638
* Update integration test runbook link to ADO wiki by @corinagum in
#624

### 🔧 Chores & Dependencies
* Bump version to 2.0.14-preview and fix pipeline release job by
@corinagum in #620
* Bump hono from 4.12.21 to 4.12.25 by @dependabot in
#623
* Bump react-router from 7.15.0 to 7.15.1 by @dependabot in
#619
* Bump vite from 6.4.2 to 6.4.3 by @dependabot in
#617

**Full Changelog**:
v2.0.13...prep-release/2.0.14

### After merge
1. Trigger the [release
pipeline](https://dev.azure.com/DomoreexpGithub/Github_Pipelines/_build?definitionId=52&_a=summary)
on `release` with **Public** publish type
2. Bump `main` → `2.0.15-preview.{height}`
3. Create the `v2.0.14` git tag + GitHub Release

Co-authored-by: Copilot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants