chore(deps): bump hono from 4.12.23 to 4.12.34

[dependabot]

Bumps hono from 4.12.23 to 4.12.34.

Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in honojs/hono#5164
• chore: bump @hono/node-server in honojs/hono#5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in honojs/hono#5166
• chore: remove undici in favor of global fetch in honojs/hono#5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

• ci: enable reports for type & bundle size check in honojs/hono#5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
• fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
• fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
• fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130

... (truncated)

Commits

• 734755a 4.12.34
• 9839ff3 chore: update bun.lock (#5182)
• 0c45036 Merge commit from fork
• 720b566 Merge commit from fork
• f70e2c3 Merge commit from fork
• 93fc250 Merge commit from fork
• 51db313 4.12.33
• aed1463 chore: remove undici in favor of global fetch (#5168)
• 224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
• df653ce chore: bump @hono/node-server (#5167)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.