Bump hono from 4.12.26 to 4.12.28

[dependabot]

Bumps hono from 4.12.26 to 4.12.28.

Release notes

Sourced from hono's releases.

v4.12.28

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in honojs/hono#5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in honojs/hono#5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in honojs/hono#5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in honojs/hono#5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in honojs/hono#5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @​greymoth-jp in honojs/hono#5059
• chore: bump devDependencies by @​yusukebe in honojs/hono#5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @​VihaanAgarwal in honojs/hono#5033
• docs(context-storage): fix JSDoc by @​yusukebe in honojs/hono#5086

New Contributors

• @​EduardF1 made their first contribution in honojs/hono#5047
• @​greymoth-jp made their first contribution in honojs/hono#5059
• @​VihaanAgarwal made their first contribution in honojs/hono#5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

Commits

• 626b185 4.12.28
• d6b1d32 docs(context-storage): fix JSDoc (#5086)
• 45b081b fix(aws-lambda): detect V2 events by request context, not rawPath alone (#5033)
• a05813c chore: bump devDependencies (#5085)
• 872997d fix(bun): report the requested subprotocol on WSContext.protocol (#5059)
• 82b321b fix: avoid circular dependency between body.ts and request.ts (#5071)
• b20d422 fix(utils/body,validator): normalize Content-Type media type for case-insensi...
• 9728702 chore: don't publish *.tsbuildinfo (#5066)
• ed8795e docs(MIGRATION): fix req.raw.headers reference (property, not method) (#5047)
• 03a9416 fix(serve-static): treat empty string content as found (#5062)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)