dependabot[bot] opened a new pull request, #50: URL: https://github.com/apache/comdev/pull/50
Bumps [hono](https://github.com/honojs/hono) from 4.13.1 to 4.13.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases";>hono's releases</a>.</em></p> <blockquote> <h2>v4.13.12</h2> <h2>What's Changed</h2> <ul> <li>fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in <a href="https://redirect.github.com/honojs/hono/pull/5485";>honojs/hono#5485</a></li> <li>test(build): type-check the bundled declarations from a consumer project in <a href="https://redirect.github.com/honojs/hono/pull/5486";>honojs/hono#5486</a></li> <li>fix(etag): correctly match mixed-case header name in retainedHeader option in <a href="https://redirect.github.com/honojs/hono/pull/5475";>honojs/hono#5475</a></li> <li>fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in <a href="https://redirect.github.com/honojs/hono/pull/5487";>honojs/hono#5487</a></li> <li>fix(combine): return a Response from a short-circuiting middleware in some() in <a href="https://redirect.github.com/honojs/hono/pull/5391";>honojs/hono#5391</a></li> <li>chore(deps): upgrade vite-plus to 1.0.0 in <a href="https://redirect.github.com/honojs/hono/pull/5464";>honojs/hono#5464</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.13.11...v4.13.12";>https://github.com/honojs/hono/compare/v4.13.11...v4.13.12</a></p> <h2>v4.13.11</h2> <h2>Security fixes</h2> <h3><code>serveStatic</code> decodes the request path a second time, leading to bypass of middleware on static paths</h3> <p>Affects: <code>hono/serve-static</code> and the adapters built on it (<code>hono/bun</code>, <code>hono/deno</code>, <code>hono/cloudflare-workers</code>, <code>@hono/bun</code>, <code>@hono/deno</code>, <code>@hono/cloudflare-workers</code>). Fixes <code>serveStatic</code> decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7</p> <p><code>serveStatic</code> now rejects request paths that still contain <code>%</code> after decoding. To serve files whose names contain a literal <code>%</code>, set <code>allowPercentInPath: true</code>.</p> <p>The same fix ships in <code>@hono/node-server</code> v2.1.3.</p> <h2>v4.13.10</h2> <h2>Adapters are now separate packages</h2> <p>The runtime adapters are now published as their own packages: <code>@hono/bun</code>, <code>@hono/deno</code>, <code>@hono/cloudflare-workers</code>, <code>@hono/aws-lambda</code>, <code>@hono/lambda-edge</code>, <code>@hono/netlify</code>, <code>@hono/vercel</code>, and <code>@hono/service-worker</code>. <code>@hono/deno</code> is also on JSR.</p> <p><code>hono/<adapter></code> still works in v4 but is deprecated and will be removed in v5. Migrating is an import change:</p> <pre lang="diff"><code>- import { serveStatic } from 'hono/bun' + import { serveStatic } from '@hono/bun' </code></pre> <p>hono/cloudflare-pages is deprecated without a replacement package; Cloudflare recommends Workers with static assets.</p> <h2>What's Changed</h2> <ul> <li>chore: migrate the package manager from bun to pnpm in <a href="https://redirect.github.com/honojs/hono/pull/5433";>honojs/hono#5433</a></li> <li>chore(package.json): invoke package scripts through pnpm instead of bun in <a href="https://redirect.github.com/honojs/hono/pull/5434";>honojs/hono#5434</a></li> <li>chore: replace prettier with oxfmt in <a href="https://redirect.github.com/honojs/hono/pull/5435";>honojs/hono#5435</a></li> <li>chore(deps): upgrade vitest to 5.0.1 in <a href="https://redirect.github.com/honojs/hono/pull/5437";>honojs/hono#5437</a></li> <li>chore: let oxfmt sort imports instead of eslint in <a href="https://redirect.github.com/honojs/hono/pull/5442";>honojs/hono#5442</a></li> <li>chore: replace eslint with oxlint in <a href="https://redirect.github.com/honojs/hono/pull/5443";>honojs/hono#5443</a></li> <li>chore: introduce Vite+ in <a href="https://redirect.github.com/honojs/hono/pull/5444";>honojs/hono#5444</a></li> <li>fix(types): allow returning a Blob as a response body in <a href="https://redirect.github.com/honojs/hono/pull/5446";>honojs/hono#5446</a></li> <li>chore: convert build scripts into plugins in <a href="https://redirect.github.com/honojs/hono/pull/5448";>honojs/hono#5448</a></li> <li>chore: stop editorconfig-checker from checking Markdown indent size in <a href="https://redirect.github.com/honojs/hono/pull/5455";>honojs/hono#5455</a></li> <li>ci: remove empty step left in <code>cr.yml</code> by the pnpm migration in <a href="https://redirect.github.com/honojs/hono/pull/5456";>honojs/hono#5456</a></li> <li>chore(deps): upgrade vite-plus to <code>1.0.0-rc.1</code> in <a href="https://redirect.github.com/honojs/hono/pull/5459";>honojs/hono#5459</a></li> <li>feat(adapters): add <code>@​hono/bun</code> as a workspace package in <a href="https://redirect.github.com/honojs/hono/pull/5447";>honojs/hono#5447</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/6abd35b0a5f35f67b6417627d5b0a6c2d266ac04";><code>6abd35b</code></a> 4.13.12</li> <li><a href="https://github.com/honojs/hono/commit/95eb860473d26bd303a2a29716e61a77c8c5e5f5";><code>95eb860</code></a> chore(deps): upgrade vite-plus to 1.0.0 (<a href="https://redirect.github.com/honojs/hono/issues/5464";>#5464</a>)</li> <li><a href="https://github.com/honojs/hono/commit/afb2068c1c53a530528ac5f237e245793dd03c07";><code>afb2068</code></a> fix(combine): return a Response from a short-circuiting middleware in some() ...</li> <li><a href="https://github.com/honojs/hono/commit/e5bb2062a3ddd645e3a16d1300bd76d6c9af33a5";><code>e5bb206</code></a> fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (<a href="https://redirect.github.com/honojs/hono/issues/5487";>#5487</a>)</li> <li><a href="https://github.com/honojs/hono/commit/c3053ccf14f1c4c70a0c2888eed6121b9f6c8f95";><code>c3053cc</code></a> fix(etag): correctly match mixed-case header name in retainedHeader option (#...</li> <li><a href="https://github.com/honojs/hono/commit/c437d7569219a21e45fa81797749e8f34fe19dcc";><code>c437d75</code></a> test(build): type-check the bundled declarations from a consumer project (<a href="https://redirect.github.com/honojs/hono/issues/5486";>#5486</a>)</li> <li><a href="https://github.com/honojs/hono/commit/be1f7498fed269544a3c544db0a5a727048462a8";><code>be1f749</code></a> fix(build): keep internal types private in bundled d.ts and avoid a self-refe...</li> <li><a href="https://github.com/honojs/hono/commit/37ce06904e732d4bc11c9075adf362c76049a594";><code>37ce069</code></a> 4.13.11</li> <li><a href="https://github.com/honojs/hono/commit/1e1207cabfcd154146bf6ac9fd6a0b646f7fc484";><code>1e1207c</code></a> test(serve-static): fix the test (<a href="https://redirect.github.com/honojs/hono/issues/5479";>#5479</a>)</li> <li><a href="https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc";><code>8b05c77</code></a> Merge commit from fork</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.13.1...v4.13.12";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/comdev/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
