You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/06/19 23:38:11 UTC
[PR] chore(deps): bump hono from 4.12.15 to 4.12.26 in /frontend [texera]
dependabot[bot] opened a new pull request, #5805:
URL: https://github.com/apache/texera/pull/5805
Bumps [hono](https://github.com/honojs/hono) from 4.12.15 to 4.12.26.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p>
<blockquote>
<h2>v4.12.26</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5013">honojs/hono#5013</a></li>
<li>ci: publish to npm from CI with OIDC trusted publishing by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5028">honojs/hono#5028</a></li>
<li>chore: remove unused devcontainer and gitpod configs by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5029">honojs/hono#5029</a></li>
<li>chore: replace arg and glob with Bun native APIs in build script by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5030">honojs/hono#5030</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26">https://github.com/honojs/hono/compare/v4.12.25...v4.12.26</a></p>
<h2>v4.12.25</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>CORS Middleware reflects any Origin with credentials when <code>origin</code> defaults to the wildcard</h3>
<p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting the request <code>Origin</code> and sending <code>Access-Control-Allow-Credentials: true</code> when <code>credentials: true</code> is set without an explicit <code>origin</code>, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p>
<h3>Body Limit Middleware can be bypassed on AWS Lambda by understating <code>Content-Length</code></h3>
<p>Affects: <code>hono/body-limit</code> on AWS Lambda (<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the request being built with the client-declared <code>Content-Length</code> while the body is delivered fully buffered, where a client could declare a small <code>Content-Length</code> with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2</p>
<h3>Path traversal in <code>serve-static</code> on Windows via encoded backslash (<code>%5C</code>)</h3>
<p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (<code>%5C</code>) decoded to <code>\</code> was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44</p>
<h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers into one value, dropping cookies on ALB single-header and Lattice</h3>
<p>Affects: <code>hono/aws-lambda</code>. Fixes multiple <code>Set-Cookie</code> response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p>
<h3>Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest</h3>
<p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as <code>X-Forwarded-For</code> reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p</p>
<h2>v4.12.24</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contribution): simplifyAI Usage Policy by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li>
<li>chore: remove <code>@types/glob</code> by <a href="https://github.com/rtritto"><code>@rtritto</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li>
<li>fix(bearer-auth): mention verifyToken in missing-options error message by <a href="https://github.com/tan7vir"><code>@tan7vir</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li>
<li>refactor(language): Test/improve tests on languages middleware by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li>
<li>fix(utils/ipaddr): expand "::" to eight zero groups by <a href="https://github.com/youcefzemmar"><code>@youcefzemmar</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li>
<li>fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by <a href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@Mohammad-Faiz-Cloud-Engineer</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li>
<li>refactor(timing): Test/add test for middleware timing by <a href="https://github.com/iNeoO"><code>@iNeoO</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li>
<li>fix(utils/ipaddr): render the unspecified address binary as "::" by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p>
<h2>v4.12.23</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/honojs/hono/commit/27b7992f821bc10c2f62ad0ad86bd94eea251862"><code>27b7992</code></a> 4.12.26</li>
<li><a href="https://github.com/honojs/hono/commit/d29982cc40c3babb417db625ab0671d982398646"><code>d29982c</code></a> chore: replace arg and glob with Bun native APIs in build script</li>
<li><a href="https://github.com/honojs/hono/commit/16215d5f509099b81b00d60a2777bc6b5ac06827"><code>16215d5</code></a> chore: remove unused devcontainer and gitpod configs (<a href="https://redirect.github.com/honojs/hono/issues/5029">#5029</a>)</li>
<li><a href="https://github.com/honojs/hono/commit/c574cf16403b42a17917506bcba1916d32d3094f"><code>c574cf1</code></a> ci: publish to npm from CI with OIDC trusted publishing (<a href="https://redirect.github.com/honojs/hono/issues/5028">#5028</a>)</li>
<li><a href="https://github.com/honojs/hono/commit/e50df01453e71b071c3e6136b161b160b9fdf916"><code>e50df01</code></a> fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding (<a href="https://redirect.github.com/honojs/hono/issues/5">#5</a>...</li>
<li><a href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a> 4.12.25</li>
<li><a href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a> Merge commit from fork</li>
<li><a href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a> Merge commit from fork</li>
<li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.15...v4.12.26">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for hono since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/texera/network/alerts).
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): bump hono from 4.12.15 to 4.12.26 in /frontend [texera]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #5805:
URL: https://github.com/apache/texera/pull/5805#issuecomment-4755615349
## [Codecov](https://app.codecov.io/gh/apache/texera/pull/5805?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 53.39%. Comparing base ([`c2129d4`](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`f1618b6`](https://app.codecov.io/gh/apache/texera/commit/f1618b6137f343df3ca05d80f6fb46d6f5563a54?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:white_check_mark: All tests successful. No failed tests found.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #5805 +/- ##
=========================================
Coverage 53.39% 53.39%
Complexity 2692 2692
=========================================
Files 1099 1099
Lines 42541 42541
Branches 4577 4577
=========================================
Hits 22716 22716
Misses 18493 18493
Partials 1332 1332
```
| [Flag](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | | *Carryforward flag |
|---|---|---|---|
| [access-control-service](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `70.44% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [agent-service](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `34.36% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [amber](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `54.02% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [computing-unit-managing-service](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `1.65% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [config-service](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `56.71% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [file-service](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `57.06% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [frontend](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `48.02% <ø> (ø)` | | |
| [pyamber](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.13% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [python](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.80% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [workflow-compiling-service](https://app.codecov.io/gh/apache/texera/pull/5805/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `58.69% <ø> (ø)` | | Carriedforward from [c2129d4](https://app.codecov.io/gh/apache/texera/commit/c2129d4b7c3e75b2c36de22148e3eaebd0f52833?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
*This pull request uses carry forward flags. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/texera/pull/5805?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): bump hono from 4.12.15 to 4.12.26 in /frontend [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan merged PR #5805:
URL: https://github.com/apache/texera/pull/5805
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org