chore(deps): bump hono from 4.12.21 to 4.12.25 in /apps/backend in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /apps/backend directory: hono.

Updates hono from 4.12.21 to 4.12.25

Release notes

Sourced from hono's releases.

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

• docs(contribution): simplifyAI Usage Policy by @​yusukebe in honojs/hono#4972
• chore: remove @​types/glob by @​rtritto in honojs/hono#4978
• fix(bearer-auth): mention verifyToken in missing-options error message by @​tan7vir in honojs/hono#4987
• refactor(language): Test/improve tests on languages middleware by @​iNeoO in honojs/hono#4980
• fix(utils/ipaddr): expand "::" to eight zero groups by @​youcefzemmar in honojs/hono#4973
• fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @​Mohammad-Faiz-Cloud-Engineer in honojs/hono#4982
• refactor(timing): Test/add test for middleware timing by @​iNeoO in honojs/hono#4991
• fix(utils/ipaddr): render the unspecified address binary as "::" by @​sarathfrancis90 in honojs/hono#4998

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

What's Changed

• fix(serve-static): normalize all backslashes in file paths, not just the first in honojs/hono#4962
• feat(context): export the Context class publicly by @​BlankParticle in honojs/hono#4543
• docs(contribution): add AI Usage Policy by @​yusukebe in honojs/hono#4970
• feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @​na-trium-144 in honojs/hono#4961
• fix(utils/ipaddr): do not compress a single 0 group to :: by @​yusukebe in honojs/hono#4971

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

What's Changed

... (truncated)

Commits

• fce483e 4.12.25
• 751ba41 Merge commit from fork
• f0b094d Merge commit from fork
• fa5f9bf Merge commit from fork
• 3892a6c Merge commit from fork
• 74c2cf8 test(aws-lambda): update integration tests (#5012)
• 7ae7cba Merge commit from fork
• 1b13848 chore(ci): bump codecov-action to v7.0.0 (#5011)
• 5fdde5a 4.12.24
• c78932d fix(utils/ipaddr): render the unspecified address binary as "::" (#4998)
• Additional commits viewable in compare view

Greptile Summary

This PR bumps hono from 4.12.21 to 4.12.25 in apps/backend, picking up five security patches released in v4.12.25. The backend does not appear to use the affected middleware (CORS with wildcard credentials, body-limit on AWS Lambda, serve-static on Windows, or Lambda adapters), so no application-level changes are needed.

• Security fixes included: CORS wildcard-origin credential reflection (GHSA-88fw-hqm2-52qc), body-limit bypass on AWS Lambda (GHSA-rv63-4mwf-qqc2), path traversal via %5C on Windows (GHSA-wwfh-h76j-fc44), Set-Cookie merge on ALB (GHSA-j6c9-x7qj-28xf), and header overwrite on Lambda@Edge (GHSA-wgpf-jwqj-8h8p).
• Lockfile gap: bun.lock was not updated by Dependabot (Bun lockfiles are not yet supported by Dependabot), so the patched version won't actually be installed until bun install is run and the updated lockfile is committed.

Confidence Score: 4/5

Safe to merge, but the security patches won't take effect until bun.lock is regenerated and committed separately.

The package.json change is correct and the target version carries important security fixes. However, bun.lock was not updated — it still resolves hono@4.12.21 — so the patched binary won't be installed from the lockfile until a follow-up bun install commit is made. This gap between declared and locked version is a real, present state in the repo that needs manual resolution.

bun.lock at the repo root needs to be regenerated with bun install and committed to complete this upgrade.

Important Files Changed

Filename	Overview
apps/backend/package.json	Bumps hono from 4.12.21 to 4.12.25 (5 security fixes); bun.lock not updated, so the new version won't be installed until the lockfile is regenerated and committed.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Dep as Dependabot
    participant PJ as package.json
    participant BL as bun.lock
    participant CI as CI / bun install

    Dep->>PJ: bumps hono 4.12.21 → 4.12.25
    Dep-->>BL: ❌ not updated (Bun lockfile unsupported)
    CI->>BL: "reads pinned hono@4.12.21"
    Note over CI,BL: Security patches not applied<br/>until bun install + lockfile commit

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Dep as Dependabot
    participant PJ as package.json
    participant BL as bun.lock
    participant CI as CI / bun install

    Dep->>PJ: bumps hono 4.12.21 → 4.12.25
    Dep-->>BL: ❌ not updated (Bun lockfile unsupported)
    CI->>BL: "reads pinned hono@4.12.21"
    Note over CI,BL: Security patches not applied<br/>until bun install + lockfile commit

Loading

_{Reviews (2): Last reviewed commit: "chore(deps): bump hono" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[greptile-apps]

Lockfile not updated — security patches not yet effective

The root bun.lock still pins hono to 4.12.21 (line 36 and 676) while package.json now declares 4.12.25. Because Dependabot does not update Bun lockfiles, the security fixes bundled in this release will not be installed until someone runs bun install locally, verifies the lockfile diff, and commits the updated bun.lock. Any CI step that runs bun install --frozen-lockfile will also fail with the current state of the repository.