chore(deps): bump hono from 4.12.7 to 4.12.14 in /server

[dependabot]

Bumps hono from 4.12.7 to 4.12.14.

Release notes

Sourced from hono's releases.

v4.12.14

Security fixes

This release includes fixes for the following security issues:

Improper handling of JSX attribute names in hono/jsx SSR

Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375

Other changes

• fix(aws-lambda): handle invalid header names in request processing (#4883) fa2c74fe

v4.12.13

What's Changed

• fix(types): infer response type from last handler in app.on 9-/10-handler overloads by @​T4ko0522 in honojs/hono#4865
• feat(trailing-slash): add skip option by @​yusukebe in honojs/hono#4862
• feat(cache): add onCacheNotAvailable option by @​yusukebe in honojs/hono#4876

New Contributors

• @​T4ko0522 made their first contribution in honojs/hono#4865

Full Changelog: honojs/hono@v4.12.12...v4.12.13

v4.12.12

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4

---

... (truncated)

Commits

• cf2d2b7 4.12.14
• 66daa2e Merge commit from fork
• fa2c74f fix(aws-lambda): handle invalid header names in request processing (#4883)
• 3779927 4.12.13
• faa6c46 feat(cache): add onCacheNotAvailable option (#4876)
• f23e97b feat(trailing-slash): add skip option (#4862)
• 1aa32fb fix(types): infer response type from last handler in app.on 9- and 10-handler...
• c37ba26 4.12.12
• cc067c8 Merge commit from fork
• a586cd7 Merge commit from fork
• Additional commits viewable in compare view

[greptile-apps]

PR author is not in the allowed authors list.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
autumn-vite	Ready	Preview, Comment	Apr 20, 2026 3:01pm
checkout	Ready	Preview, Comment	Apr 20, 2026 3:01pm
landing-page	Error		Apr 20, 2026 3:01pm

[entelligence-ai-pr-reviews]

---

Confidence Score: 5/5 - Safe to Merge

Safe to merge — this is a routine dependency bump for the hono framework from version 4.12.7 to 4.12.14 in the /server directory, covering a series of patch releases that typically include bug fixes and minor improvements. No logic changes, configuration modifications, or application code are touched by this PR. The automated review found zero issues across all changed files, and the version range (patch-level increments within 4.12.x) presents minimal regression risk.

Key Findings:

• The bump spans patch versions 4.12.7 → 4.12.14 within the same minor version line, meaning no breaking API changes are expected per semantic versioning conventions.
• No application code, route handlers, middleware configurations, or environment-specific settings are modified — the change is isolated entirely to the dependency manifest.
• Zero review comments were generated, and no pre-existing unresolved concerns exist for this PR.
• Patch-level hono updates in this range are generally low-risk and commonly address bug fixes or security patches, making the upgrade positively motivated.

Files requiring special attention

• server/package.json

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

[entelligence-ai-pr-reviews]

---

Confidence Score: 5/5 - Safe to Merge

Safe to merge — this is a straightforward patch-level dependency bump of hono from 4.7.7 to 4.12.14 in server/package.json, covering only bug fixes and minor improvements within the same minor version line. No logic, API surface, or behavioral changes are introduced by this PR, and the automated review found zero issues across the single changed file. Patch-level updates of well-maintained libraries like Hono carry minimal risk, and the scope is entirely confined to the dependency manifest.

Key Findings:

• The change is limited to a single version string update in server/package.json for hono, a patch-level bump (4.12.7 → 4.12.14) which by semver convention contains only backwards-compatible bug fixes.
• No application code, configuration logic, or runtime behavior is modified — the risk surface is confined entirely to upstream library changes, which are patch-level and therefore low-risk.
• Automated heuristic analysis flagged zero critical, significant, or medium issues, and no pre-existing unresolved review comments exist for this PR.
• Hono is an actively maintained, widely used web framework; patch releases in this range are routine maintenance with no known breaking changes documented.

Files requiring special attention

• server/package.json

[entelligence-ai-pr-reviews]

EntelligenceAI PR Summary

Upgrades the hono package in the server to the latest patch version 4.12.14.

• Updated hono from 4.12.7 → 4.12.14 in server/package.json
• Patch-level bump encompassing bug fixes and minor improvements across intermediate releases

---

Confidence Score: 5/5 - Safe to Merge

Safe to merge — this is a straightforward patch-level dependency bump of hono from 4.12.7 to 4.12.14 in server/package.json, with no logic, API surface, or configuration changes introduced by this PR. Patch versions in semantic versioning convention are reserved for backwards-compatible bug fixes, and no review comments or heuristic issues were identified. The upgrade is a routine maintenance task that brings in accumulated fixes from seven intermediate patch releases without introducing any new risk vectors.

Key Findings:

• The change is limited to a single version string update in server/package.json, making the diff minimal and the blast radius essentially zero.
• Hono follows semantic versioning, so a 4.12.x patch bump carries no breaking API changes by convention, and no changelog entries from these releases are flagged as security-related or behavior-altering in a meaningful way.
• No review comments, heuristic warnings, or unresolved pre-existing issues were identified across the reviewed files.
• Dependency hygiene patches like this reduce exposure to known bugs in the framework layer and are low-risk, high-value maintenance work.

Files requiring special attention

• server/package.json

[dependabot]

Superseded by #1486.