Skip to content

fix(deps): update hono from 4.11.5 to 4.11.7#248

Merged
polaz merged 1 commit intomainfrom
fix/#247-hono-security-update
Jan 31, 2026
Merged

fix(deps): update hono from 4.11.5 to 4.11.7#248
polaz merged 1 commit intomainfrom
fix/#247-hono-security-update

Conversation

@polaz
Copy link
Copy Markdown
Member

@polaz polaz commented Jan 31, 2026

Summary

  • Update hono resolution pin from 4.11.5 to 4.11.7 to fix 4 medium-severity CVEs
  • Dependabot could not auto-update due to exact version pin in resolutions

CVEs Fixed

CVE Severity Summary
CVE-2026-24771 Medium XSS through ErrorBoundary component
CVE-2026-24473 Medium Arbitrary key read in serve-static middleware
CVE-2026-24472 Medium Cache middleware ignores Cache-Control: private
CVE-2026-24398 Medium IPv4 validation bypass in IP Restriction Middleware

Test plan

  • yarn build passes
  • 133 test suites, 4200 tests pass
  • CI checks pass

Fixes #247

- Fix 4 medium-severity CVEs: CVE-2026-24771 (XSS), CVE-2026-24473
  (arbitrary key read), CVE-2026-24472 (cache deception),
  CVE-2026-24398 (IP spoofing)
- Update resolutions pin that blocked Dependabot auto-update

Fixes #247
Copilot AI review requested due to automatic review settings January 31, 2026 09:59
@github-actions
Copy link
Copy Markdown

Test Coverage Report

Overall Coverage: 95.56%

Metric Percentage
Statements 95.01%
Branches 85.72%
Functions 94.63%
Lines 95.56%

View detailed coverage report

@codecov
Copy link
Copy Markdown

codecov bot commented Jan 31, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the hono package from version 4.11.5 to 4.11.7 in response to 4 medium-severity CVEs. The update is applied via the resolutions field in package.json since hono is a transitive dependency that was previously pinned.

Changes:

  • Update hono resolution from 4.11.5 to 4.11.7 in package.json
  • Regenerate yarn.lock with updated version and checksum

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Updates hono resolution pin from 4.11.5 to 4.11.7
yarn.lock Updates hono lockfile entry with new version and checksum

@polaz polaz merged commit 71cc831 into main Jan 31, 2026
29 checks passed
@polaz polaz deleted the fix/#247-hono-security-update branch January 31, 2026 10:20
sw-release-bot bot pushed a commit that referenced this pull request Feb 2, 2026
## [6.51.0](v6.50.0...v6.51.0) (2026-02-02)

### Features

* **docs:** consent banner + vue-privacy 1.2.2 with gtag fix ([#255](#255)) ([75eb54b](75eb54b))

### Bug Fixes

* **ci:** prevent transitive skip propagation in release pipeline ([#266](#266)) ([f809a7a](f809a7a)), closes [#264](#264) [#265](#265) [#265](#265)
* **ci:** replace heredoc with quoted strings in thread-gate job ([#246](#246)) ([9470b50](9470b50)), closes [#243](#243) [#245](#245)
* **ci:** unblock release pipeline on push to main ([#264](#264)) ([59b8cbe](59b8cbe)), closes [#263](#263)
* **deps:** update hono from 4.11.5 to 4.11.7 ([#248](#248)) ([71cc831](71cc831)), closes [#247](#247)
* **docs:** resolve SEO issues in VitePress documentation ([#249](#249)) ([#250](#250)) ([3e05717](3e05717))
* **docs:** use canonical URL for TOOLS reference in README ([#252](#252)) ([5ac56cc](5ac56cc)), closes [#251](#251)
* **pipelines:** serialize array query params as key[] for GitLab Rails API ([#262](#262)) ([955a3c1](955a3c1)), closes [#261](#261)
@sw-release-bot
Copy link
Copy Markdown

sw-release-bot bot commented Feb 2, 2026

🎉 This PR is included in version 6.51.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security(deps): update hono to 4.11.7 to fix 4 CVEs

2 participants