Skip to content

chore(deps-dev): bump hono from 4.10.7 to 4.12.25#1589

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.12.25
Open

chore(deps-dev): bump hono from 4.10.7 to 4.12.25#1589
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.12.25

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 20, 2026

Copy link
Copy Markdown
Contributor

Bumps hono from 4.10.7 to 4.12.25.

Release notes

Sourced from hono's releases.

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

What's Changed

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

What's Changed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.10.7 to 4.12.25.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.10.7...v4.12.25)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.25
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 20, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 20, 2026

Copy link
Copy Markdown

Deploying orpc with  Cloudflare Pages  Cloudflare Pages

Latest commit: 6a64ded
Status: ✅  Deploy successful!
Preview URL: https://b9ec6152.orpc-4zt.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-hono-zt6c.orpc-4zt.pages.dev

View logs

@dosubot dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Jun 20, 2026
@pkg-pr-new

pkg-pr-new Bot commented Jun 20, 2026

Copy link
Copy Markdown
More templates

@orpc/ai-sdk

npm i https://pkg.pr.new/@orpc/ai-sdk@1589

@orpc/arktype

npm i https://pkg.pr.new/@orpc/arktype@1589

@orpc/client

npm i https://pkg.pr.new/@orpc/client@1589

@orpc/contract

npm i https://pkg.pr.new/@orpc/contract@1589

@orpc/experimental-durable-iterator

npm i https://pkg.pr.new/@orpc/experimental-durable-iterator@1589

@orpc/hey-api

npm i https://pkg.pr.new/@orpc/hey-api@1589

@orpc/interop

npm i https://pkg.pr.new/@orpc/interop@1589

@orpc/json-schema

npm i https://pkg.pr.new/@orpc/json-schema@1589

@orpc/nest

npm i https://pkg.pr.new/@orpc/nest@1589

@orpc/openapi

npm i https://pkg.pr.new/@orpc/openapi@1589

@orpc/openapi-client

npm i https://pkg.pr.new/@orpc/openapi-client@1589

@orpc/otel

npm i https://pkg.pr.new/@orpc/otel@1589

@orpc/experimental-pino

npm i https://pkg.pr.new/@orpc/experimental-pino@1589

@orpc/experimental-publisher

npm i https://pkg.pr.new/@orpc/experimental-publisher@1589

@orpc/experimental-publisher-durable-object

npm i https://pkg.pr.new/@orpc/experimental-publisher-durable-object@1589

@orpc/experimental-ratelimit

npm i https://pkg.pr.new/@orpc/experimental-ratelimit@1589

@orpc/react

npm i https://pkg.pr.new/@orpc/react@1589

@orpc/react-query

npm i https://pkg.pr.new/@orpc/react-query@1589

@orpc/experimental-react-swr

npm i https://pkg.pr.new/@orpc/experimental-react-swr@1589

@orpc/server

npm i https://pkg.pr.new/@orpc/server@1589

@orpc/shared

npm i https://pkg.pr.new/@orpc/shared@1589

@orpc/solid-query

npm i https://pkg.pr.new/@orpc/solid-query@1589

@orpc/standard-server

npm i https://pkg.pr.new/@orpc/standard-server@1589

@orpc/standard-server-aws-lambda

npm i https://pkg.pr.new/@orpc/standard-server-aws-lambda@1589

@orpc/standard-server-fastify

npm i https://pkg.pr.new/@orpc/standard-server-fastify@1589

@orpc/standard-server-fetch

npm i https://pkg.pr.new/@orpc/standard-server-fetch@1589

@orpc/standard-server-node

npm i https://pkg.pr.new/@orpc/standard-server-node@1589

@orpc/standard-server-peer

npm i https://pkg.pr.new/@orpc/standard-server-peer@1589

@orpc/svelte-query

npm i https://pkg.pr.new/@orpc/svelte-query@1589

@orpc/tanstack-query

npm i https://pkg.pr.new/@orpc/tanstack-query@1589

@orpc/trpc

npm i https://pkg.pr.new/@orpc/trpc@1589

@orpc/valibot

npm i https://pkg.pr.new/@orpc/valibot@1589

@orpc/vue-colada

npm i https://pkg.pr.new/@orpc/vue-colada@1589

@orpc/vue-query

npm i https://pkg.pr.new/@orpc/vue-query@1589

@orpc/zod

npm i https://pkg.pr.new/@orpc/zod@1589

commit: ac03202

@codecov

codecov Bot commented Jun 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants