Bump hono from 4.8.5 to 4.12.4 in /packages/routes by dependabot[bot] · Pull Request #215 · kingstinct/zemble

dependabot · 2026-03-04T20:05:02Z

Bumps hono from 4.8.5 to 4.12.4.

Release notes

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

Middleware Bypass in Serve Static

Affects: Serve Static middleware. Fixes inconsistent URL decoding that could allow protected static resources to be accessed without triggering route-based middleware. GHSA-q5qw-h33p-qvwr

Users who uses Strreaming Helper, Cookie utility, and Serve Static are strongly encouraged to upgrade to this version.

Other changes

fix(client): preserve route schema in ApplyGlobalResponse by @agumy in honojs/hono#4777

fix(utils/url): specify the return type of tryDecodeURI by @yusukebe in honojs/hono#4779

New Contributors

@agumy made their first contribution in honojs/hono#4777

Full Changelog: honojs/hono@v4.12.3...v4.12.4

v4.12.3

What's Changed

fix(validator): prevent type diff bug in form data parsing by @EdamAme-x in honojs/hono#4753

fix(jwt): use Math.floor instead of bitwise OR for safe timestamp by @EdamAme-x in honojs/hono#4754

fix(jwt): fix JwtVariables for ContextVariableMap by @yusukebe in honojs/hono#4764

fix(types): remove DOM type dependencies from ClientResponse and request method by @YevheniiKotyrlo in honojs/hono#4768

fix(types): correct middleware types by @hmnd in honojs/hono#4774

fix(jwt): prevent memory leak by avoiding mutation of options object by @EdamAme-x in honojs/hono#4759

New Contributors

@YevheniiKotyrlo made their first contribution in honojs/hono#4768

@hmnd made their first contribution in honojs/hono#4774

Full Changelog: honojs/hono@v4.12.2...v4.12.3

v4.12.2

Security fix

Fixed incorrect handling of X-Forwarded-For in the AWS Lambda adapter behind ALB that could allow IP-based access control bypass. The detail: GHSA-xh87-mx6m-69f3

... (truncated)

Commits

19d20d2 4.12.4
44ae0c8 Merge commit from fork
f4123ed Merge commit from fork
80a9837 fix(utils/url): specify the return type of tryDecodeURI (#4779)
6a0607a Merge commit from fork
0768232 fix(client): preserve route schema in ApplyGlobalResponse (#4777)
790c57b 4.12.3
bda46ac fix(jwt): prevent memory leak by avoiding mutation of options object (#4759)
0f505f4 fix(types): correct middleware types (#4774)
eb9c112 fix(types): remove DOM type dependencies from ClientResponse and request meth...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [hono](https://github.com/honojs/hono) from 4.8.5 to 4.12.4. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.5...v4.12.4) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-03-04T20:05:13Z

⚠️ No Changeset found

Latest commit: 36cfa94

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-03-04T20:06:06Z

Open in StackBlitz

@zemble/auth

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/auth@215

@zemble/auth-anonymous

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/auth-anonymous@215

@zemble/auth-api-token

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/auth-api-token@215

@zemble/auth-apple

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/auth-apple@215

@zemble/auth-expo

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/auth-expo@215

@zemble/auth-otp

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/auth-otp@215

@zemble/bull

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/bull@215

@zemble/bun

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/bun@215

@zemble/core

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/core@215

create-zemble-app

npm i https://pkg.pr.new/kingstinct/zemble/create-zemble-app@215

create-zemble-plugin

npm i https://pkg.pr.new/kingstinct/zemble/create-zemble-plugin@215

@zemble/dataloaders

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/dataloaders@215

@zemble/dayjs

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/dayjs@215

@zemble/debug

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/debug@215

@zemble/email-resend

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/email-resend@215

@zemble/email-sendgrid

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/email-sendgrid@215

@zemble/fastify

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/fastify@215

@zemble/firebase-auth

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/firebase-auth@215

@zemble/graphql

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/graphql@215

@zemble/graphql-objectid-scalar

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/graphql-objectid-scalar@215

@zemble/kv

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/kv@215

@zemble/migrations

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/migrations@215

@zemble/mongodb

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/mongodb@215

@zemble/node

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/node@215

@zemble/primitives

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/primitives@215

@zemble/push-apple

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/push-apple@215

@zemble/push-expo

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/push-expo@215

@zemble/react

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react@215

@zemble/react-auth

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react-auth@215

@zemble/react-keyboard

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react-keyboard@215

@zemble/react-network

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react-network@215

@zemble/react-portal

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react-portal@215

@zemble/react-snackbar

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react-snackbar@215

@zemble/react-urql

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react-urql@215

@zemble/react-use-app-state

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/react-use-app-state@215

@zemble/routes

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/routes@215

@zemble/sms-46elks

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/sms-46elks@215

@zemble/sms-twilio

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/sms-twilio@215

@zemble/supabase

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/supabase@215

@zemble/timeoutify

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/timeoutify@215

@zemble/universal-datetime-scalar

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/universal-datetime-scalar@215

@zemble/utils

npm i https://pkg.pr.new/kingstinct/zemble/@zemble/utils@215

commit: 36cfa94

dependabot · 2026-04-08T02:24:33Z

Superseded by #228.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 4, 2026

dependabot bot mentioned this pull request Mar 4, 2026

Bump hono from 4.8.5 to 4.11.7 in /packages/routes #205

Closed

dependabot bot closed this Apr 8, 2026

dependabot bot deleted the dependabot/npm_and_yarn/packages/routes/hono-4.12.4 branch April 8, 2026 02:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump hono from 4.8.5 to 4.12.4 in /packages/routes#215

Bump hono from 4.8.5 to 4.12.4 in /packages/routes#215
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/packages/routes/hono-4.12.4

dependabot bot commented on behalf of github Mar 4, 2026

Uh oh!

changeset-bot bot commented Mar 4, 2026

Uh oh!

pkg-pr-new bot commented Mar 4, 2026

Uh oh!

dependabot bot commented on behalf of github Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 4, 2026

v4.12.4

Security fixes

SSE Control Field Injection

Cookie Attribute Injection in setCookie()

Middleware Bypass in Serve Static

Other changes

New Contributors

v4.12.3

What's Changed

New Contributors

v4.12.2

Security fix

Uh oh!

changeset-bot bot commented Mar 4, 2026

⚠️ No Changeset found

Uh oh!

pkg-pr-new bot commented Mar 4, 2026

Uh oh!

dependabot bot commented on behalf of github Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Cookie Attribute Injection in `setCookie()`