Skip to content

Chore(deps): bump hono from 4.12.16 to 4.12.18#2261

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/hono-4.12.18
Open

Chore(deps): bump hono from 4.12.16 to 4.12.18#2261
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/hono-4.12.18

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 13, 2026

Bumps hono from 4.12.16 to 4.12.18.

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36


Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.16...v4.12.17

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

This change is Reviewable

tjcouch-sil and others added 2 commits May 12, 2026 18:31
…ilwind 4, new components) (#2207)

* Upgraded to React 19, Tailwind 4, new shadcn, build themes.data.json from index.css, cleaned up index.css, fonts.css, clarified data provider errors, added scripts to prepare for changing shadcn preset

* Apply shadcn preset via `npx shadcn apply --preset b6rt8cvlC` to re-add shadcn components from latest version as a new baseline

* chore: propagate shadcn preset CSS and package changes to extensions

* chore: re-apply project customizations to upgraded shadcn components

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Adjust platform to upgraded shadcn

chore: rebuild platform-bible-react dist and themes after shadcn upgrade

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: add SKIPPED-CUSTOMIZATIONS.md for shadcn upgrade review

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fixed rtl:tw: to tw:rtl:, fixed a few bugs with the shadcn components, fixed theme color stories not showing all the colors

Cleaned up radix imports, added spacing theme variable, fixed radius css variable usage

Moved new theme preset to
Paratext theme, fixed borders wrongly applying, misc cleanup

docs: add design spec for legacy HSL color var backwards compat

docs: add per-pass and total timing to legacy color var compat spec

docs: add React 19 backwards compatibility design spec

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add transformLegacyColorVars helper for backwards-compat hsl→var transform

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: apply legacy hsl color var transform to WebView styles and content on load

Attempt to make React 19 and Tailwind 4 backwards-compatible with old extensions

Clean up, fix core storybook

Reverted skipLibCheck to false, applied lots of fixes accordingly

Fixed yalc messing up package-lock.json

fix: address review findings from /review-paratext

- Re-export public types `SelectTriggerProps` and `DropdownMenu*Props`
  (9 type aliases) that were dropped by the upstream shadcn baseline
- Fix `handleDataProviderSubscriptionError` log regression: discriminate
  three contexts ('retrieve-after-update' | 'retrieve-immediate' | 'callback')
  with a switch + exhaustiveness check; restores per-path log messages
- Remove unused `sheet.tsx` + the just-scaffolded story (YAGNI; arrived
  as a side effect of the shadcn preset apply, not exposed in index.ts)
- Remove stale AI-generated `CUSTOMIZATIONS.md`; update upgrade-shadcn
  workflow to require regeneration via `/shadcn-customizations` if missing
- Add 48 tests for `apply-shadcn-preset.ts` helpers + 6 fixture-based
  end-to-end pipeline tests; fix latent regex bug in `processLayerBase`
  (`\s+$` → `\s*$`) that produced `}}` instead of `}\n}` in the common case
- Add 6 tests for new `platform-dock-layout-storage.util.ts` exports
  (`findFirstWebViewDefinitionByType`, `loadLayout`)
- Fix pre-existing typo'd Tailwind classes in `tabs-vertical.tsx`
  (`tw:flex-fit`, `tw:mlk-items-center`, bare `overflow-clip`)
- Rename `util.test.ts` → `utils.test.ts` to match implementation filename
- Remove unused `yjs` and `scheduler` devDependencies; refresh lockfile
- Add storybook variants for badge ghost/link/blueIndicator/mutedIndicator
- Rebuild platform-bible-react dist artifacts

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat: add /add-shadcn-component command and supporting script

- Extract shared shadcn file-transform helpers into shadcn-transform-utils.ts
  (used by both apply-shadcn-preset.ts and the new add-shadcn-component.ts)
- Add scripts/add-shadcn-component.ts: adds a single shadcn component,
  applies standard file transforms, runs format and lint-fix, and
  auto-commits the baseline (matches apply-shadcn-preset.ts pattern).
  Takes <component> <preset> as args.
- Add npm 'add-shadcn-component' script
- Fix get-latest-preset
- Add fast path to cn() compat shim: when the resolved class string
  contains no `tw-` prefix (the dominant all-TW4 case), skip the
  per-token normalize/restore round-trip and call
  extendTailwindMerge({ prefix: 'tw' }) directly. Brings the all-TW4
  case from ~8x slower than baseline to within ~1.5x; TW3-containing
  strings still take the full slow path so dedup remains correct.

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.16 to 4.12.18.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.16...v4.12.18)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant