Skip to content

chore(templates/angular): bump hono from 4.12.8 to 4.12.19 in /templates/angular#325

Closed
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/npm_and_yarn/templates/angular/hono-4.12.19
Closed

chore(templates/angular): bump hono from 4.12.8 to 4.12.19 in /templates/angular#325
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/npm_and_yarn/templates/angular/hono-4.12.19

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 16, 2026

Copy link
Copy Markdown
Contributor

Bumps hono from 4.12.8 to 4.12.19.

Release notes

Sourced from hono's releases.

v4.12.19

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.18...v4.12.19

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36


Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

... (truncated)

Commits
  • 7e62bcd 4.12.19
  • e2f252a fix(stream): upgrade @hono/node-server to v2 and fix abort handling (#4940)
  • 54f2f0c feat(request): add bytes() (#4921)
  • e59db59 feat(cache): key cache entries by configured vary headers (#4915)
  • 48a7ccb feat(bearer-auth): make bearerAuth generic for typed context in verifyToken (...
  • ff7522f fix(cookie): return the first cookie when there are multiple cookies with the...
  • 26f8c33 fix(serveStatic): make options parameter optional in all adapters (#4934)
  • 16c4e38 ci: pin GitHub Actions to SHAs (#4932)
  • f10dee8 4.12.18
  • a5bd9eb Merge commit from fork
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

khaneliman and others added 4 commits May 16, 2026 00:09
…1 directory with 12 updates

Bumps the angular-dependencies group with 12 updates in the /templates/angular directory:

| Package | From | To |
| --- | --- | --- |
| [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) | `21.2.9` | `21.2.13` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.9` | `21.2.13` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.9` | `21.2.13` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.9` | `21.2.13` |
| [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.9` | `21.2.13` |
| [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.9` | `21.2.13` |
| [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `21.2.9` | `21.2.13` |
| [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.9` | `21.2.13` |
| [zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js) | `0.16.1` | `0.16.2` |
| [@angular-devkit/build-angular](https://github.com/angular/angular-cli) | `21.2.7` | `21.2.11` |
| [@angular/cli](https://github.com/angular/angular-cli) | `21.2.7` | `21.2.11` |
| [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.9` | `21.2.13` |



Updates `@angular/animations` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/animations)

Updates `@angular/common` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/common)

Updates `@angular/compiler` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/compiler)

Updates `@angular/core` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/core)

Updates `@angular/forms` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/forms)

Updates `@angular/platform-browser` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/platform-browser)

Updates `@angular/platform-browser-dynamic` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/platform-browser-dynamic)

Updates `@angular/router` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/router)

Updates `zone.js` from 0.16.1 to 0.16.2
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/packages/zone.js/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/zone.js-0.16.2/packages/zone.js)

Updates `@angular-devkit/build-angular` from 21.2.7 to 21.2.11
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@v21.2.7...v21.2.11)

Updates `@angular/cli` from 21.2.7 to 21.2.11
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@v21.2.7...v21.2.11)

Updates `@angular/compiler-cli` from 21.2.9 to 21.2.13
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.2.13/packages/compiler-cli)

---
updated-dependencies:
- dependency-name: "@angular-devkit/build-angular"
  dependency-version: 21.2.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/animations"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/cli"
  dependency-version: 21.2.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/common"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/compiler"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/compiler-cli"
  dependency-version: 21.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/core"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/forms"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/platform-browser"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/platform-browser-dynamic"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: "@angular/router"
  dependency-version: 21.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
- dependency-name: zone.js
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: angular-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.8 to 4.12.19.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.8...v4.12.19)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.19
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 16, 2026
@dependabot dependabot Bot requested a review from khaneliman as a code owner May 16, 2026 18:02
@khaneliman khaneliman force-pushed the main branch 20 times, most recently from c9c777c to b2ed4f6 Compare May 23, 2026 14:14
@khaneliman khaneliman force-pushed the main branch 2 times, most recently from 8590578 to 11998fe Compare May 24, 2026 15:41
@khaneliman khaneliman force-pushed the main branch 29 times, most recently from 17ac81a to b870b3a Compare June 11, 2026 13:37
@dependabot @github

dependabot Bot commented on behalf of github Jun 14, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant