fix: update hono security floor

[ndycode]

Summary

• raise the direct and override Hono floor to 4.12.18
• refresh package-lock so Dependabot's five open package-lock alerts resolve after merge

Verification

• npm install
• npm audit --audit-level=high
• npm run audit:ci
• npm run typecheck
• npm run lint
• npm run build
• npm test
• npm run clean:repo:check

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

bumps hono from 4.12.14 to 4.12.18 (direct dep + override) and refreshes package-lock.json to close dependabot alerts. snyk confirms 4.12.18 is the current latest non-vulnerable version with no known cves.

• package.json: hono pinned to 4.12.18 in both dependencies and overrides; overrides entry keeps indirect consumers on the same floor, which is correct.
• package-lock.json: resolved url and sha512 integrity hash updated; package version bumped 2.1.7 → 2.1.8; no unexpected transitive dependency changes in the diff.

Confidence Score: 5/5

safe to merge — isolated dep bump touching only hono, no logic changes, no token or filesystem paths affected

the change is a single-package version pin from 4.12.14 to 4.12.18 in both the direct dependency and the override; the lockfile integrity hash matches the published npm artifact, snyk shows no known vulnerabilities in 4.12.18, and the override pattern correctly floors all transitive consumers to the same version

no files require special attention

Important Files Changed

Filename	Overview
package.json	bumps hono direct dependency and override from 4.12.14 to 4.12.18; no other dep changes, override remains consistent
package-lock.json	lockfile refreshed: hono resolved to 4.12.18 with updated integrity hash; package version bumped 2.1.7→2.1.8; no unexpected transitive dep changes visible in diff

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[dependabot alerts\nhono < 4.12.18] --> B[bump package.json\ndependencies: hono 4.12.18\noverrides: hono 4.12.18]
    B --> C[npm install\nrefreshes package-lock.json\nintegrity hash updated]
    C --> D{npm audit\n--audit-level=high}
    D -- clean --> E[alerts resolved\nsafe to merge]
    D -- findings --> F[investigate & fix]

Loading

_{Reviews (1): Last reviewed commit: "fix: update hono security floor" | Re-trigger Greptile}

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 56f281e4-3110-4282-aa48-9d91a886d729

📥 Commits

Reviewing files that changed from the base of the PR and between fb09e40 and fd18888.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Greptile Review

🔇 Additional comments (1)

package.json (1)

167-172: ⚡ Quick win

lockfile is properly updated; no action needed.

the package-lock.json verification shows hono resolves to 4.12.18 with no older transitive entries. the concern about unresolved dependabot alerts is invalid—the lockfile refresh objective is already met by the changes in this pr.

			> Likely an incorrect or invalid review comment.

---

📝 Walkthrough

Severity: MAJOR — This is a security-focused dependency update raising the Hono framework floor from 4.12.14 to 4.12.18 to address Dependabot's unresolved security alerts. The minimal scope of changes (version bumps only in package.json and package-lock.json with explicit overrides configured) significantly reduces regression risk compared to feature releases.

Security Impact: The PR directly remediates multiple open security vulnerabilities flagged by Dependabot. Verification includes npm audit:ci (combining audit:prod and audit:dev:allowlist checks), confirming high-severity security validation is mandatory for acceptance.

Test Coverage & Regression Risk: Comprehensive regression detection is in place through the full CI verification suite: unit tests via Vitest (npm test), TypeScript type checking (npm run typecheck), ESLint validation (npm run lint), production build verification (npm run build), and repository hygiene checks (npm run clean:repo:check). No architectural changes are introduced—this is a pure dependency version increment with enforced consistency via package overrides.

Key Review Focus: Verify that Hono 4.12.18 patch release introduces no breaking changes relative to 4.12.14, and confirm that npm audit --audit-level=high passes post-merge to ensure all flagged vulnerabilities are fully resolved.

Walkthrough

hono dependency updated from 4.12.14 to 4.12.18 in both dependencies and overrides fields in package.json.

Changes

Dependency Update

Layer / File(s)	Summary
Version Bump package.json:164-172	hono version pinned to 4.12.18 across both dependencies and overrides fields.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Notes

the version bump is mechanical and consistent across both dependency and override fields. however, you'll want to verify offline whether this patch includes any breaking changes to hono's api—particularly around middleware handling or request/response shapes if this code uses hono's core routing. no regression tests are added here, so if there are integration tests for hono routes anywhere in the codebase, they should already cover this bump. no obvious windows or concurrency edge cases from a dependency version alone.

Suggested labels

bug

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	title follows conventional commits format with fix: type and lowercase imperative summary under 72 chars.
Description check	✅ Passed	description provides clear summary and verification steps, though deviates from template structure and omits several documentation and risk assessment sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/hono-security-alerts

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/hono-security-alerts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}