From 7e00fec2639f1657d885d6e3b60de173ce0c2865 Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 13:39:45 +0000
Subject: [PATCH] chore: upgrade hono to ^4.12.31 to address CVE-2026-59896

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1581/sourcebot-devsourcebot-cve-2026-59896-honojsx-does-not-ca4f#agent-session-b7ff6586)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 1 +
 yarn.lock    | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0402dab6..26b5f9c60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Upgraded `tar` to `^7.5.20`. [#1474](https://github.com/sourcebot-dev/sourcebot/pull/1474)
+- Upgraded `hono` to `^4.12.31`. [#1489](https://github.com/sourcebot-dev/sourcebot/pull/1489)
 
 ### Changed
 - Reduced Sentry span sampling to 10% outside development. [#1475](https://github.com/sourcebot-dev/sourcebot/pull/1475)
diff --git a/yarn.lock b/yarn.lock
index 051755b31..fdab81224 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -15964,9 +15964,9 @@ __metadata:
   linkType: hard
 
 "hono@npm:^4.11.4":
-  version: 4.12.25
-  resolution: "hono@npm:4.12.25"
-  checksum: 10c0/9216d647fe2f39b17855b0e74913688b837e3fa9519d367c7beeec399265b36608a820928cc33ab926eee58fe2daf7e33296235b52e56dbfac0fbcd51a5e818e
+  version: 4.12.31
+  resolution: "hono@npm:4.12.31"
+  checksum: 10c0/f80be65cd657cc353b3e478d55424a373d11801b2a1ffc96d94def813c6d852e76bea4437f5df252b15caca98742040d26950bc9c865d8720b89a00a9eac5249
   languageName: node
   linkType: hard