Bump hono from 4.12.12 to 4.12.18

[dependabot]

Bumps hono from 4.12.12 to 4.12.18.

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

---

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

• fix(jsx): normalize SVG attributes on the root element by @​kfly8 in honojs/hono#4893
• fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @​yuintei in honojs/hono#4899
• fix(cors): make origin optional in CORSOptions by @​truffle-dev in honojs/hono#4905
• fix(types): propagate middleware response types to app.on overloads by @​T4ko0522 in honojs/hono#4906

New Contributors

• @​kfly8 made their first contribution in honojs/hono#4893
• @​truffle-dev made their first contribution in honojs/hono#4905

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

v4.12.15

What's Changed

• fix(jwt): support single-line PEM keys by @​hiendv in honojs/hono#4889

... (truncated)

Commits

• f10dee8 4.12.18
• a5bd9eb Merge commit from fork
• 58d3d3a Merge commit from fork
• 568c2ec Merge commit from fork
• ff2b3d3 4.12.17
• 52aaaf9 fix(types): propagate middleware response types to app.on overloads (#4906)
• 76d5589 fix(cors): make origin optional in CORSOptions (#4905)
• 8f027e5 fix(ssg): add atom+xml and rss+xml to defaultExtensionMap (#4899)
• bfba97c fix(jsx): normalize SVG attributes on the <svg> root element (#4893)
• 90d4182 4.12.16
• Additional commits viewable in compare view

[netlify]

✅ Deploy Preview for servicestart ready!

Name	Link
🔨 Latest commit	a6647d9
🔍 Latest deploy log	https://app.netlify.com/projects/servicestart/deploys/6a09d9d1ef77070008a21c34
😎 Deploy Preview	https://deploy-preview-237--servicestart.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

Greptile Summary

This PR bumps hono from 4.12.12 to 4.12.18, pulling in five security fixes across two intermediate patch releases. The pnpm-lock.yaml also reflects collateral upgrades to next, @azure/msal-*, @types/node, and semver driven by pnpm's resolution of the updated dependency graph.

• Cache middleware cross-user leakage (GHSA-p77w-8qqv-26rm): Responses cached for one authenticated user could be served to others when Vary: Authorization or Vary: Cookie was present.
• JWT exp/nbf/iat bypass (GHSA-hm8q-7f3q-5f36): Falsy, non-finite, or non-numeric NumericDate claim values silently bypassed time-based JWT verification.
• JSX/CSS injection & body-limit bypass (GHSA-qp7p-654g-cw7p, GHSA-69xw-7hcm-h432, GHSA-9vqf-7f2p-gf9v): CSS injection via style object values, HTML injection via unvalidated JSX tag names, and oversized chunked requests bypassing bodyLimit() were all fixed.

Confidence Score: 5/5

Safe to merge — pure dependency version update with no application code changes.

Only package.json and pnpm-lock.yaml are changed. The upgrade patches five known security vulnerabilities and the collateral lockfile updates (next, @azure/msal-*, semver) are minor patch bumps with no breaking changes expected.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Bumps hono specifier from ^4.12.12 to ^4.12.18, incorporating 5 security fixes across two patch releases.
pnpm-lock.yaml	Lockfile updated to resolve hono@4.12.18; also bumps next (16.2.4→16.2.6), @azure/msal-* packages, @types/node, and semver, and removes the unused uuid@8.3.2 transitive dependency.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[hono 4.12.12] -->|Dependabot bump| B[hono 4.12.18]
    B --> C[v4.12.16 - Security fixes]
    B --> D[v4.12.17 - Bug fixes]
    B --> E[v4.12.18 - Security fixes]
    C --> C1[GHSA-69xw-7hcm-h432 JSX tag name HTML injection]
    C --> C2[GHSA-9vqf-7f2p-gf9v bodyLimit bypass for chunked requests]
    D --> D1[SVG attribute normalization / CORS origin optional / Type fixes]
    E --> E1[GHSA-p77w-8qqv-26rm Cache cross-user leakage]
    E --> E2[GHSA-qp7p-654g-cw7p CSS injection via JSX style values]
    E --> E3[GHSA-hm8q-7f3q-5f36 JWT NumericDate claim bypass]

Loading

_{Reviews (1): Last reviewed commit: "Bump hono from 4.12.12 to 4.12.18" | Re-trigger Greptile}

[dependabot]

Superseded by #240.