Skip to content

chore(deps): bump hono from 4.11.6 to 4.12.7#316

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.12.7
Closed

chore(deps): bump hono from 4.11.6 to 4.12.7#316
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.12.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 11, 2026

Copy link
Copy Markdown

Bumps hono from 4.11.6 to 4.12.7.

Release notes

Sourced from hono's releases.

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.


Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 11, 2026
@dependabot dependabot Bot changed the title build(deps): bump hono from 4.11.6 to 4.12.7 chore(deps): bump hono from 4.11.6 to 4.12.7 Mar 27, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/hono-4.12.7 branch from 0d493fd to 6a4ede9 Compare March 27, 2026 11:11
Bumps [hono](https://github.com/honojs/hono) from 4.11.6 to 4.12.7.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.6...v4.12.7)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/hono-4.12.7 branch from 6a4ede9 to 023c411 Compare March 28, 2026 18:59
@dependabot @github

dependabot Bot commented on behalf of github Apr 8, 2026

Copy link
Copy Markdown
Author

Superseded by #347.

@dependabot dependabot Bot closed this Apr 8, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/hono-4.12.7 branch April 8, 2026 03:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants