chore(deps): bump hono from 4.12.5 to 4.12.14 (combines #40260, #40258)

Merged
GG
6mo ago
+8-8

Summary

Combines the two Dependabot PRs that bump hono from 4.12.5 (pinned in #40172) to 4.12.14:

  • #40258 — bumps hono in /packages/http-router
  • #40260 — bumps hono in /apps/meteor

Both are needed together because hono is consumed by both packages. Merging individually would leave one package on the older pinned version.

Context

In #40172 hono was pinned to exactly 4.12.5 after we observed CI failures (ABAC, iframe auth) while rolling up several patch-level bumps simultaneously. Subsequent investigation pointed at cron (moment-timezone → luxon) and @noble/ed25519 as primary culprits — those were reverted. It's possible hono 4.12.14 now works fine in isolation; this PR tests that hypothesis.

Hono changelog highlights (v4.12.6 → v4.12.14)

  • v4.12.6: ReDoS fix in accept parser
  • v4.12.9: parseBody removed from bodyCache; CORS reflects origin on credentials+wildcard
  • v4.12.12: Security fixes for setCookie/getCookie name validation, static middleware path normalization, SSG path traversal, IPv4-mapped IPv6 IP restriction
  • v4.12.14: JSX attribute validation; AWS Lambda header handling

Test plan

  • CI passes all suites (unit, API CE/EE, API Livechat CE/EE, UI CE/EE, Federation Matrix)
  • If CI fails, the failing tests confirm hono as the root cause — not cron / noble-ed25519

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated the hono HTTP routing framework from version 4.12.5 to 4.12.14 across multiple packages in the application stack.

Task: ARCH-2111