build(deps): bump hono from 4.12.7 to 4.12.14 by dependabot[bot] · Pull Request #3077 · inkeep/agents

dependabot · 2026-04-08T18:49:59Z

Bumps hono from 4.12.7 to 4.12.14.

Release notes

v4.12.14

Security fixes

This release includes fixes for the following security issues:

Improper handling of JSX attribute names in hono/jsx SSR

Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375

Other changes

fix(aws-lambda): handle invalid header names in request processing (#4883) fa2c74fe

v4.12.13

What's Changed

fix(types): infer response type from last handler in app.on 9-/10-handler overloads by @T4ko0522 in honojs/hono#4865

feat(trailing-slash): add skip option by @yusukebe in honojs/hono#4862

feat(cache): add onCacheNotAvailable option by @yusukebe in honojs/hono#4876

New Contributors

@T4ko0522 made their first contribution in honojs/hono#4865

Full Changelog: honojs/hono@v4.12.12...v4.12.13

v4.12.12

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4

... (truncated)

Commits

cf2d2b7 4.12.14
66daa2e Merge commit from fork
fa2c74f fix(aws-lambda): handle invalid header names in request processing (#4883)
3779927 4.12.13
faa6c46 feat(cache): add onCacheNotAvailable option (#4876)
f23e97b feat(trailing-slash): add skip option (#4862)
1aa32fb fix(types): infer response type from last handler in app.on 9- and 10-handler...
c37ba26 4.12.12
cc067c8 Merge commit from fork
a586cd7 Merge commit from fork
Additional commits viewable in compare view

vercel · 2026-04-08T18:50:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agents-api	Ready	Preview, Comment	Apr 14, 2026 6:19pm
agents-docs	Ready	Preview, Comment	Apr 14, 2026 6:19pm
agents-manage-ui	Ready	Preview, Comment	Apr 14, 2026 6:19pm

socket-security · 2026-04-08T18:51:59Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@inkeep/agents-manage-ui` is 98.0% likely obfuscated Confidence: 0.98 Location: Package overview From: create-agents-template/package.json → `npm/@inkeep/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@inkeep/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

changeset-bot · 2026-04-09T02:37:13Z

⚠️ No Changeset found

Latest commit: 5f59e79

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2026-04-14T18:13:38Z

A matching internal PR is ready in inkeep/agents-private#95 for canonical review and merge.

Original author attribution is preserved as @dependabot[bot]
The internal PR is the authoritative merge surface
The public repo will pick up the merged change through the normal mirror sync

This comment will be updated as the bridge state changes.

dependabot · 2026-04-16T06:12:08Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Bumps [hono](https://github.com/honojs/hono) from 4.12.7 to 4.12.14. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.7...v4.12.14) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.12 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

socket-security · 2026-04-25T02:01:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@opentelemetry/sdk-trace-node@2.1.0
@opentelemetry/context-async-hooks@2.1.0
@inkeep/agents-api@0.59.4
@inkeep/agents-cli@0.59.4
@langfuse/tracing@4.0.1
@inkeep/agents-manage-ui@0.41.1 ⏵ 0.59.4
@types/node@22.18.4
tsx@4.20.5
langfuse@3.38.5
@inkeep/agents-sdk@0.59.4
@hono/vite-dev-server@0.20.1 ⏵ 0.23.0	⁺¹	⁺¹	^-3
typescript@5.9.2
@hono/zod-openapi@1.2.0 ⏵ 1.2.3			⁺¹
@opentelemetry/core@2.3.0 ⏵ 2.1.0		⁺¹	^-1
dotenv@16.6.1

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 8, 2026

vercel Bot deployed to Preview – agents-docs April 8, 2026 18:53 View deployment

vercel Bot deployed to Preview – agents-manage-ui April 8, 2026 18:53 View deployment

vercel Bot deployed to Preview – agents-api April 8, 2026 18:54 View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/hono-4.12.12 branch from dcedfd3 to fd2fea1 Compare April 9, 2026 02:37

vercel Bot deployed to Preview – agents-manage-ui April 9, 2026 02:39 View deployment

vercel Bot deployed to Preview – agents-docs April 9, 2026 02:39 View deployment

vercel Bot deployed to Preview – agents-api April 9, 2026 02:41 View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/hono-4.12.12 branch from fd2fea1 to b471d7c Compare April 14, 2026 18:15

vercel Bot deployed to Preview – agents-manage-ui April 14, 2026 18:18 View deployment

vercel Bot deployed to Preview – agents-docs April 14, 2026 18:19 View deployment

vercel Bot deployed to Preview – agents-api April 14, 2026 18:19 View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/hono-4.12.12 branch 3 times, most recently from c285f5e to ae5f276 Compare April 22, 2026 23:16

dependabot Bot changed the title ~~chore(deps): bump hono from 4.12.7 to 4.12.12~~ build(deps): bump hono from 4.12.7 to 4.12.14 Apr 25, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/hono-4.12.12 branch from ae5f276 to 5f59e79 Compare April 25, 2026 02:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump hono from 4.12.7 to 4.12.14#3077

build(deps): bump hono from 4.12.7 to 4.12.14#3077
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/hono-4.12.12

dependabot Bot commented on behalf of github Apr 8, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Apr 8, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 14, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 16, 2026

Uh oh!

socket-security Bot commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.12.14

Security fixes

Improper handling of JSX attribute names in hono/jsx SSR

Other changes

v4.12.13

What's Changed

New Contributors

v4.12.12

Security fixes

Middleware bypass via repeated slashes in serveStatic

Path traversal in toSSG() allows writing files outside the output directory

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Missing validation of cookie name on write path in setCookie()

Non-breaking space prefix bypass in cookie name handling in getCookie()

Uh oh!

vercel Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

github-actions Bot commented Apr 14, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 16, 2026

Uh oh!

socket-security Bot commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 8, 2026 •

edited

Loading

vercel Bot commented Apr 8, 2026 •

edited

Loading

socket-security Bot commented Apr 8, 2026 •

edited

Loading

changeset-bot Bot commented Apr 9, 2026 •

edited

Loading