chore(deps): bump hono from 4.12.23 to 4.12.26

[dependabot]

Bumps hono from 4.12.23 to 4.12.26.

Release notes

Sourced from hono's releases.

v4.12.26

What's Changed

• fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @​yusukebe in honojs/hono#5013
• ci: publish to npm from CI with OIDC trusted publishing by @​yusukebe in honojs/hono#5028
• chore: remove unused devcontainer and gitpod configs by @​yusukebe in honojs/hono#5029
• chore: replace arg and glob with Bun native APIs in build script by @​yusukebe in honojs/hono#5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

• docs(contribution): simplifyAI Usage Policy by @​yusukebe in honojs/hono#4972
• chore: remove @​types/glob by @​rtritto in honojs/hono#4978
• fix(bearer-auth): mention verifyToken in missing-options error message by @​tan7vir in honojs/hono#4987
• refactor(language): Test/improve tests on languages middleware by @​iNeoO in honojs/hono#4980
• fix(utils/ipaddr): expand "::" to eight zero groups by @​youcefzemmar in honojs/hono#4973
• fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @​Mohammad-Faiz-Cloud-Engineer in honojs/hono#4982
• refactor(timing): Test/add test for middleware timing by @​iNeoO in honojs/hono#4991
• fix(utils/ipaddr): render the unspecified address binary as "::" by @​sarathfrancis90 in honojs/hono#4998

Full Changelog: honojs/hono@v4.12.23...v4.12.24

Commits

• 27b7992 4.12.26
• d29982c chore: replace arg and glob with Bun native APIs in build script
• 16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
• c574cf1 ci: publish to npm from CI with OIDC trusted publishing (#5028)
• e50df01 fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (#5...
• fce483e 4.12.25
• 751ba41 Merge commit from fork
• f0b094d Merge commit from fork
• fa5f9bf Merge commit from fork
• 3892a6c Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
modelhub	Ready	Preview, Comment	Jun 22, 2026 8:50am

[greptile-apps]

Greptile Summary

This PR bumps hono from 4.12.23 to 4.12.26 via Dependabot, picking up the security-focused 4.12.25 patch and a follow-up 4.12.26 fix. The lockfile cascades several peer dependency updates as well.

• Security fixes included in v4.12.25: CORS wildcard-origin credential reflection (GHSA-88fw-hqm2-52qc), body-limit bypass on AWS Lambda (GHSA-rv63-4mwf-qqc2), serve-static path traversal on Windows via encoded backslash (GHSA-wwfh-h76j-fc44), merged Set-Cookie headers on ALB/Lattice (GHSA-j6c9-x7qj-28xf), and dropped repeated Lambda@Edge request headers (GHSA-wgpf-jwqj-8h8p).
• Lockfile-only cascading updates: @simplewebauthn/server 13.3.0→13.3.1, @peculiar/asn1-* 2.7.0→2.8.0, nanoid 5.1.11→5.1.15, pg-connection-string/pg-protocol, semver, and a new eventsource-parser@3.1.0 slot.

Confidence Score: 5/5

Safe to merge — this is a straightforward security patch upgrade with no API changes.

The diff is a clean Dependabot-generated version bump with a correctly regenerated lockfile. The intermediate release (4.12.25) patched five security advisories; picking up those fixes is strictly beneficial. No application code was changed, and all cascading peer dependency updates in the lockfile are consistent with what pnpm resolves automatically.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Single version bump of hono from ^4.12.23 to ^4.12.26; change is correct and expected.
pnpm-lock.yaml	Lockfile regenerated to resolve hono@4.12.26 and cascade peer dependency updates; all changes are consistent with the package.json bump.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[hono 4.12.23] -->|bump| B[hono 4.12.24 - Bug fixes]
    B -->|bump| C[hono 4.12.25 - Security Fixes]
    C -->|bump| D[hono 4.12.26 - Lambda-Edge fix]

    C --> E[CORS wildcard credential reflection fix]
    C --> F[Body-limit bypass on AWS Lambda fix]
    C --> G[serve-static path traversal on Windows fix]
    C --> H[Set-Cookie merge on ALB and Lattice fix]
    C --> I[Lambda-Edge repeated header drop fix]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[hono 4.12.23] -->|bump| B[hono 4.12.24 - Bug fixes]
    B -->|bump| C[hono 4.12.25 - Security Fixes]
    C -->|bump| D[hono 4.12.26 - Lambda-Edge fix]

    C --> E[CORS wildcard credential reflection fix]
    C --> F[Body-limit bypass on AWS Lambda fix]
    C --> G[serve-static path traversal on Windows fix]
    C --> H[Set-Cookie merge on ALB and Lattice fix]
    C --> I[Lambda-Edge repeated header drop fix]

Loading

_{Reviews (1): Last reviewed commit: "chore(deps): bump hono from 4.12.23 to 4..." | Re-trigger Greptile}