This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch
gh-readonly-queue/main/pr-5805-d8135bad1c342c7899190b91de036c96cb230272
in repository https://gitbox.apache.org/repos/asf/texera.git
commit c83c8b6a0799f30cedf2e60f57002c55c39c8085
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
AuthorDate: Sat Jun 20 00:19:45 2026 +0000
chore(deps): bump hono from 4.12.15 to 4.12.26 in /frontend (#5805)
Bumps [hono](https://github.com/honojs/hono) from 4.12.15 to 4.12.26.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases";>hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.26</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(lambda-edge): satisfy Deno lib types for Content-Length body
encoding by <a
href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5013";>honojs/hono#5013</a></li>
<li>ci: publish to npm from CI with OIDC trusted publishing by <a
href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5028";>honojs/hono#5028</a></li>
<li>chore: remove unused devcontainer and gitpod configs by <a
href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5029";>honojs/hono#5029</a></li>
<li>chore: replace arg and glob with Bun native APIs in build script by
<a href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/5030";>honojs/hono#5030</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.26";>https://github.com/honojs/hono/compare/v4.12.25...v4.12.26</a></p>
<h2>v4.12.25</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>CORS Middleware reflects any Origin with credentials when
<code>origin</code> defaults to the wildcard</h3>
<p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting
the request <code>Origin</code> and sending
<code>Access-Control-Allow-Credentials: true</code> when
<code>credentials: true</code> is set without an explicit
<code>origin</code>, where any site a logged-in user visited could make
credentialed cross-origin requests and read responses from
cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p>
<h3>Body Limit Middleware can be bypassed on AWS Lambda by understating
<code>Content-Length</code></h3>
<p>Affects: <code>hono/body-limit</code> on AWS Lambda
(<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the
request being built with the client-declared <code>Content-Length</code>
while the body is delivered fully buffered, where a client could declare
a small <code>Content-Length</code> with a much larger body and slip
past the configured size limit. GHSA-rv63-4mwf-qqc2</p>
<h3>Path traversal in <code>serve-static</code> on Windows via encoded
backslash (<code>%5C</code>)</h3>
<p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno
adapters). Fixes the path guard allowing a lone backslash, where an
encoded backslash (<code>%5C</code>) decoded to <code>\</code> was
treated as a separator by the Windows path resolver, letting a single
URL segment escape into a middleware-guarded subtree.
GHSA-wwfh-h76j-fc44</p>
<h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers
into one value, dropping cookies on ALB single-header and Lattice</h3>
<p>Affects: <code>hono/aws-lambda</code>. Fixes multiple
<code>Set-Cookie</code> response headers being joined into one
comma-separated value for ALB single-header responses and VPC Lattice
v2, where the value could not be split back into individual cookies and
clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p>
<h3>Lambda@Edge adapter keeps only the last value of a repeated request
header, dropping the rest</h3>
<p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request
headers being written with overwrite instead of append, where only the
last value of a header such as <code>X-Forwarded-For</code> reached the
application and the remaining values were silently dropped.
GHSA-wgpf-jwqj-8h8p</p>
<h2>v4.12.24</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contribution): simplifyAI Usage Policy by <a
href="https://github.com/yusukebe";><code>@yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4972";>honojs/hono#4972</a></li>
<li>chore: remove <code>@types/glob</code> by <a
href="https://github.com/rtritto";><code>@rtritto</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4978";>honojs/hono#4978</a></li>
<li>fix(bearer-auth): mention verifyToken in missing-options error
message by <a
href="https://github.com/tan7vir";><code>@tan7vir</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4987";>honojs/hono#4987</a></li>
<li>refactor(language): Test/improve tests on languages middleware by <a
href="https://github.com/iNeoO";><code>@iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4980";>honojs/hono#4980</a></li>
<li>fix(utils/ipaddr): expand "::" to eight zero groups by <a
href="https://github.com/youcefzemmar";><code>@youcefzemmar</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4973";>honojs/hono#4973</a></li>
<li>fix: clean up config files trailing comma, stale excludes,
typesVersions gaps, jsr paths by <a
href="https://github.com/Mohammad-Faiz-Cloud-Engineer";><code>@Mohammad-Faiz-Cloud-Engineer</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4982";>honojs/hono#4982</a></li>
<li>refactor(timing): Test/add test for middleware timing by <a
href="https://github.com/iNeoO";><code>@iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4991";>honojs/hono#4991</a></li>
<li>fix(utils/ipaddr): render the unspecified address binary as
"::" by <a
href="https://github.com/sarathfrancis90";><code>@sarathfrancis90</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4998";>honojs/hono#4998</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24";>https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p>
<h2>v4.12.23</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/27b7992f821bc10c2f62ad0ad86bd94eea251862";><code>27b7992</code></a>
4.12.26</li>
<li><a
href="https://github.com/honojs/hono/commit/d29982cc40c3babb417db625ab0671d982398646";><code>d29982c</code></a>
chore: replace arg and glob with Bun native APIs in build script</li>
<li><a
href="https://github.com/honojs/hono/commit/16215d5f509099b81b00d60a2777bc6b5ac06827";><code>16215d5</code></a>
chore: remove unused devcontainer and gitpod configs (<a
href="https://redirect.github.com/honojs/hono/issues/5029";>#5029</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/c574cf16403b42a17917506bcba1916d32d3094f";><code>c574cf1</code></a>
ci: publish to npm from CI with OIDC trusted publishing (<a
href="https://redirect.github.com/honojs/hono/issues/5028";>#5028</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/e50df01453e71b071c3e6136b161b160b9fdf916";><code>e50df01</code></a>
fix(lambda-edge): satisfy Deno lib types for Content-Length body
encoding (<a
href="https://redirect.github.com/honojs/hono/issues/5";>#5</a>...</li>
<li><a
href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50";><code>fce483e</code></a>
4.12.25</li>
<li><a
href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6";><code>751ba41</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e";><code>f0b094d</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b";><code>fa5f9bf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d";><code>3892a6c</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.15...v4.12.26";>compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new
releaser for hono since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/apache/texera/network/alerts).
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot]
<49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyuan Lin <[email protected]>
---
frontend/yarn.lock | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index 99ff95b06f..256f448eb5 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -10833,9 +10833,9 @@ __metadata:
linkType: hard
"hono@npm:^4.11.4":
- version: 4.12.15
- resolution: "hono@npm:4.12.15"
- checksum:
10c0/83f5778525bd4b706ddf1877c5f3cec0c8a3a0edf0944f8dfb041179c23a854166b8566f6e9be95894199a22e3b3aba139582d4ba24776e707c453d293bda24d
+ version: 4.12.26
+ resolution: "hono@npm:4.12.26"
+ checksum:
10c0/c7c4d1e1b093e6a3ca1920b45b8c93359d68a5666670acef486f9d3e4952aeaaab05b643e45455f4930b0bd0c1af9354278010fcd461aa8c0e71d17388864d1a
languageName: node
linkType: hard
