chore(deps): bump hono from 4.12.9 to 4.12.34

[dependabot]

Bumps hono from 4.12.9 to 4.12.34.

Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

---

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in honojs/hono#5164
• chore: bump @hono/node-server in honojs/hono#5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in honojs/hono#5166
• chore: remove undici in favor of global fetch in honojs/hono#5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

• ci: enable reports for type & bundle size check in honojs/hono#5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
• fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
• fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
• fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130

... (truncated)

Commits

• 734755a 4.12.34
• 9839ff3 chore: update bun.lock (#5182)
• 0c45036 Merge commit from fork
• 720b566 Merge commit from fork
• f70e2c3 Merge commit from fork
• 93fc250 Merge commit from fork
• 51db313 4.12.33
• aed1463 chore: remove undici in favor of global fetch (#5168)
• 224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
• df653ce chore: bump @hono/node-server (#5167)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

---

This change is 

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[greptile-apps]

Required label not found on this PR.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e91691d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
🔚	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hono@​4.13.3

View full report

[dependabot]

Superseded by #115.