Skip to content

chore(deps): bump hono from 4.11.6 to 4.12.7#316

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/hono-4.12.7
Closed

chore(deps): bump hono from 4.11.6 to 4.12.7#316
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/hono-4.12.7

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 11, 2026

Bumps hono from 4.11.6 to 4.12.7.

Release notes

Sourced from hono's releases.

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.


Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

... (truncated)

Commits

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 11, 2026
@dependabot dependabot bot changed the title build(deps): bump hono from 4.11.6 to 4.12.7 chore(deps): bump hono from 4.11.6 to 4.12.7 Mar 27, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/hono-4.12.7 branch from 0d493fd to 6a4ede9 Compare March 27, 2026 11:11
Bumps [hono](https://github.com/honojs/hono) from 4.11.6 to 4.12.7.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.6...v4.12.7)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/hono-4.12.7 branch from 6a4ede9 to 023c411 Compare March 28, 2026 18:59
@dependabot @github
Copy link
Copy Markdown
Author

dependabot bot commented on behalf of github Apr 8, 2026

Superseded by #347.

@dependabot dependabot bot closed this Apr 8, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/hono-4.12.7 branch April 8, 2026 03:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants