chore(deps): bump hono from 4.12.26 to 4.12.27 by dependabot[bot] · Pull Request #4930 · module-federation/core

dependabot · 2026-07-24T05:40:15Z

Bumps hono from 4.12.26 to 4.12.27.

Release notes

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

Commits

97c6fe1 4.12.27
aa92177 Merge commit from fork
cd3f6f7 Merge commit from fork
d4853a8 fix(jsx): make merged context-isolation tests pass tsc type check (#5037)
6735fea fix(jsx): cast awaitedFallback through unknown to fix Deno type check (#5036)
fab3b13 Merge commit from fork
9f0dadf ci: use npm Staged publishing (#5035)
See full diff in compare view

changeset-bot · 2026-07-24T05:40:19Z

⚠️ No Changeset found

Latest commit: 0968eff

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b892b30dcb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-24T05:43:30Z

    "@hono/zod-validator": "0.7.4",
    "dotenv": "16.4.5",
-    "hono": "4.12.26",
+    "hono": "4.12.27",


Add a changeset for the Hono bump

This updates the published @module-federation/treeshake-server dependency graph, but the commit does not add or update any .changeset/*.md entry for the package; I checked the existing changesets and they only cover unrelated packages. Without a package-specific patch changeset, the release metadata can omit this security update even if the fixed group later bumps versions, so please add a changeset covering the Hono upgrade.

AGENTS.md reference: AGENTS.md:L221-L227

Useful? React with 👍 / 👎.

pkg-pr-new · 2026-07-24T05:43:46Z

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@0968eff

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@0968eff

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@0968eff

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@0968eff

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@0968eff

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@0968eff

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@0968eff

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@0968eff

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@0968eff

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@0968eff

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@0968eff

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@0968eff

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@0968eff

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@0968eff

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@0968eff

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@0968eff

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@0968eff

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@0968eff

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@0968eff

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@0968eff

@module-federation/playground

pnpm add https://pkg.pr.new/@module-federation/playground@0968eff

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@0968eff

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@0968eff

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@0968eff

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@0968eff

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@0968eff

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@0968eff

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@0968eff

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@0968eff

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@0968eff

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@0968eff

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@0968eff

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@0968eff

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@0968eff

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@0968eff

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@0968eff

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@0968eff

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@0968eff

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@0968eff

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@0968eff

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@0968eff

commit: 0968eff

github-actions · 2026-07-24T05:44:53Z

Bundle Size Report

8 package(s) changed, 34 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
`@module-federation/runtime-core`	294.1 kB	+8 B (+0.0%)	570 B	no change
`@module-federation/runtime-tools`	7.7 kB	-65 B (-0.8%)	142 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
`@module-federation/cli`	2.3 kB	-3 B (-0.1%)	2.4 kB	-31 B (-1.3%)
`@module-federation/core`	1.0 kB	-2 B (-0.2%)	1.0 kB	-31 B (-2.9%)
`@module-federation/devtools`	30.3 kB	-1 B (-0.0%)	30.3 kB	-23 B (-0.1%)
`@module-federation/enhanced`	2.7 kB	+19 B (+0.7%)	2.8 kB	-42 B (-1.5%)
`@module-federation/metro-plugin-rnc-cli`	416 B	-1 B (-0.2%)	435 B	-24 B (-5.2%)
`@module-federation/node`	9.2 kB	-1 B (-0.0%)	9.2 kB	-28 B (-0.3%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	21.5 kB	-18 B (-0.1%)	23.1 kB	-15 B (-0.1%)	+1.7 kB	+3 B

Total dist (raw): 35.80 MB (-57 B (-0.0%))
Total ESM gzip: 104.9 kB (no change)
Total web bundle (gzip): 233.5 kB (+11 B (+0.0%))
Total node bundle (gzip): 236.1 kB (-179 B (-0.1%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.

Bumps [hono](https://github.com/honojs/hono) from 4.12.26 to 4.12.27. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.26...v4.12.27) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.27 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026

chatgpt-codex-connector Bot reviewed Jul 24, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/hono-4.12.27 branch from b892b30 to 0968eff Compare July 28, 2026 04:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): bump hono from 4.12.26 to 4.12.27 - #4930

chore(deps): bump hono from 4.12.26 to 4.12.27#4930
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/hono-4.12.27

dependabot Bot commented on behalf of github Jul 24, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 24, 2026

Uh oh!

pkg-pr-new Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.12.27

Security fixes

hono/jsx does not isolate context per request

Server-Side XSS via JSX escaping bypass in cx()

API Gateway v1 adapter can drop a repeated request header value

Uh oh!

changeset-bot Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Size Report

Package dist + ESM entry

Bundle targets

Consumer scenarios

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 24, 2026 •

edited

Loading

changeset-bot Bot commented Jul 24, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading