[Snyk] Upgrade hono from 4.12.27 to 4.12.28

[zsmithnyc]

Snyk has created this PR to upgrade hono from 4.12.27 to 4.12.28.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.

• The recommended version was released 22 days ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: hono

• 4.12.28 - 2026-07-06
  

  What's Changed

  • fix(serve-static): treat empty string content as found by @ yusukebe in #5062
  • docs(MIGRATION): fix req.raw.headers reference (property, not method) by @ EduardF1 in #5047
  • chore: don't publish *.tsbuildinfo by @ yusukebe in #5066
  • fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @ yusukebe in #5067
  • fix: avoid circular dependency between body.ts and request.ts by @ usualoma in #5071
  • fix(bun): report the requested subprotocol on WSContext.protocol by @ greymoth-jp in #5059
  • chore: bump devDependencies by @ yusukebe in #5085
  • fix(aws-lambda): detect V2 events by request context, not rawPath alone by @ VihaanAgarwal in #5033
  • docs(context-storage): fix JSDoc by @ yusukebe in #5086

  New Contributors

  • @ EduardF1 made their first contribution in #5047
  • @ greymoth-jp made their first contribution in #5059
  • @ VihaanAgarwal made their first contribution in #5033

  Full Changelog: v4.12.27...v4.12.28

• 4.12.27 - 2026-06-23
  

  Security fixes

  This release includes fixes for the following security issues:

  hono/jsx does not isolate context per request

  Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

  Server-Side XSS via JSX escaping bypass in cx()

  Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

  API Gateway v1 adapter can drop a repeated request header value

  Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

  ---

  Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

from hono GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[zsmithnyc]

This is a patch version upgrade from 4.12.27 to 4.12.28.

Patch releases in the Hono project are typically for bug fixes and minor, non-breaking changes. No specific release notes or documented breaking changes were found for version 4.12.28. The prior version, 4.12.27, contained several security fixes, and this upgrade moves to the subsequent patch.

Given the nature of a patch release, no breaking changes are expected.

Source: Package documentation

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

🧪 Test Summary

Job	Status
E2E (fast, fake provider)	⏭️ skipped
Unit Tests (component)	⏭️ skipped

View workflow run