fix(security): bump hono 4.12.12 → 4.12.14 (ENG-14665)

[andriy-sudo]

Vulnerability Fixes

Package	Old	New	Advisory	CVSS	Status
hono	4.12.12	4.12.14	GHSA-458j-xx4x-4375	5.4	✅ Fixed

Tickets

• ENG-14665 (GHSA-458j-xx4x-4375, MEDIUM) — hono JSX attribute injection: improper handling of JSX attribute names allows malformed keys to corrupt generated HTML output (XSS risk)

Change

Bumped "hono": "^4.12.12" → "^4.12.14" in overrides and regenerated package-lock.json.

Changelog impact summary

Package	Old	New	Classification	Key changes
hono	4.12.12	4.12.14	Patch/security	JSX attribute name sanitization fix; no API changes

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2beae15f-e7dd-4adc-bb88-66125cd9b49c

📥 Commits

Reviewing files that changed from the base of the PR and between 928d951 and 468a517.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

This pull request updates the hono dependency version in the overrides section of package.json from ^4.12.12 to ^4.12.14. This is a patch version increment within the same minor version range.

Possibly related PRs

• fix(security): bump hono and @hono/node-server (ENG-14187 ENG-14188 ENG-14189 ENG-14193 ENG-14201 ENG-14202) #47: Modified the same hono dependency in package.json overrides, bumping to an earlier version that this PR now builds upon.

Suggested reviewers

• colriot

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: a security-focused bump of the hono dependency with a reference to the tracking ticket.
Description check	✅ Passed	The description is directly related to the changeset, providing clear context about the vulnerability, version bump, and impact classification.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andriy/eng-14665-fix-hono-cve

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}