chore(deps-dev): bump hono from 4.12.18 to 4.12.23

[dependabot]

Bumps hono from 4.12.18 to 4.12.23.

Release notes

Sourced from hono's releases.

v4.12.23

What's Changed

• fix(serve-static): normalize all backslashes in file paths, not just the first in honojs/hono#4962
• feat(context): export the Context class publicly by @​BlankParticle in honojs/hono#4543
• docs(contribution): add AI Usage Policy by @​yusukebe in honojs/hono#4970
• feat(compress): add contentTypeFilter option and COMPRESSIBLE_CONTENT_TYPE_REGEX re-export by @​na-trium-144 in honojs/hono#4961
• fix(utils/ipaddr): do not compress a single 0 group to :: by @​yusukebe in honojs/hono#4971

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

What's Changed

• chore: update vitest to v4 and cleanups by @​BlankParticle in honojs/hono#4952
• fix(mime): specify charset parameter per MIME type instead of mechanical detection by @​renatograsso10 in honojs/hono#4912
• fix(compress): respect Accept-Encoding when encoding option is set by @​LeSingh1 in honojs/hono#4951
• fix(deno): echo negotiated WebSocket subprotocol in upgrade response by @​ATOM00blue in honojs/hono#4955
• feat: add msgpack as a compressible content type by @​na-trium-144 in honojs/hono#4957

New Contributors

• @​renatograsso10 made their first contribution in honojs/hono#4912
• @​LeSingh1 made their first contribution in honojs/hono#4951
• @​ATOM00blue made their first contribution in honojs/hono#4955
• @​na-trium-144 made their first contribution in honojs/hono#4957

Full Changelog: honojs/hono@v4.12.21...v4.12.22

v4.12.21

Security fixes

This release includes fixes for the following security issues:

app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: app.mount(). Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: hono/ip-restriction. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: hono/cookie. Fixes missing validation of sameSite and priority options against injection characters (;, \r, \n), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

JWT middleware accepts any Authorization scheme, not only Bearer

Affects: hono/jwt, hono/jwk. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

---

Users who use app.mount(), hono/ip-restriction, hono/cookie, or hono/jwt/hono/jwk are encouraged to upgrade to this version.

... (truncated)

Commits

• 83bfb3b 4.12.23
• bcd290a fix(utils/ipaddr): do not compress a single 0 group to :: (#4971)
• c968177 feat(compress): add contentTypeFilter option and `COMPRESSIBLE_CONTENT_TYPE_R...
• 0265a54 docs(contribution): add AI Usage Policy (#4970)
• c84c5d2 feat(context): export the Context class publicly (#4543)
• 82dad62 fix(serve-static): normalize all backslashes in file paths, not just the firs...
• 2f01b77 4.12.22
• 6bc0dff feat: add msgpack as a compressible content type (#4957)
• 7e0555d fix(deno): echo negotiated WebSocket subprotocol in upgrade response (#4955)
• f0ed246 fix(compress): respect Accept-Encoding when encoding option is set (#4951)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Test results for "MCP"

7230 passed, 1103 skipped

---

Merge workflow run.

[github-actions]

Test results for "tests 1"

4 flaky

⚠️ [chromium-library] › library/video.spec.ts:275 › screencast › should capture navigation `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/video.spec.ts:682 › screencast › should capture full viewport on hidpi `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-emulate-media.spec.ts:144 › should keep reduced motion and color emulation after reload `@firefox-ubuntu-22.04-node20`

39541 passed, 771 skipped

---

Merge workflow run.

[github-actions]

Test results for "tests others"

4 failed
❌ [electron-page] › page/page-screenshot.spec.ts:321 › page screenshot › should work for webgl @electron-ubuntu-latest
❌ [electron-page] › page/workers.spec.ts:190 › should attribute network activity for worker inside iframe to the iframe @electron-ubuntu-latest
❌ [electron-page] › page/workers.spec.ts:190 › should attribute network activity for worker inside iframe to the iframe @electron-macos-latest
❌ [electron-page] › page/workers.spec.ts:190 › should attribute network activity for worker inside iframe to the iframe @electron-windows-latest

3 flaky

⚠️ [electron-page] › page/page-route.spec.ts:74 › should not support ? in glob pattern `@electron-ubuntu-latest`
⚠️ [electron-page] › page/page-route.spec.ts:74 › should not support ? in glob pattern `@electron-macos-latest`
⚠️ [electron-page] › page/page-route.spec.ts:74 › should not support ? in glob pattern `@electron-windows-latest`

19976 passed, 662 skipped

---

Merge workflow run.

[github-actions]

Test results for "tests 2"

30 failed
❌ [installation tests] › playwright-electron-should-work.spec.ts:21 › electron should work @package-installations-ubuntu-latest-node26
❌ [installation tests] › playwright-electron-should-work.spec.ts:31 › electron should work with special characters in path @package-installations-ubuntu-latest-node26
❌ [installation tests] › playwright-electron-should-work.spec.ts:44 › should work when wrapped inside @playwright/test and trace is enabled @package-installations-ubuntu-latest-node26
❌ [chromium-library] › library/heap.spec.ts:169 › should collect frames @tracing-chromium
❌ [chromium-page] › page/workers.spec.ts:190 › should attribute network activity for worker inside iframe to the iframe @tracing-chromium
❌ [chromium-library] › library/heap.spec.ts:203 › cycle handles @chromium-macos-15-large
❌ [chromium-page] › page/page-event-request.spec.ts:280 › resource should have type image @chromium-macos-15-xlarge❌ [installation tests] › playwright-electron-should-work.spec.ts:21 › electron should work @package-installations-ubuntu-latest-node24❌ [installation tests] › playwright-electron-should-work.spec.ts:31 › electron should work with special characters in path @package-installations-ubuntu-latest-node24❌ [installation tests] › playwright-electron-should-work.spec.ts:44 › should work when wrapped inside @playwright/test and trace is enabled @package-installations-ubuntu-latest-node24❌ [firefox-library] › library/heap.spec.ts:203 › cycle handles @tracing-firefox❌ [firefox-library] › library/defaultbrowsercontext-2.spec.ts:113 › should restore state from userDataDir @firefox-macos-15-large❌ [firefox-library] › library/defaultbrowsercontext-2.spec.ts:140 › should create userDataDir if it does not exist @firefox-macos-15-large❌ [firefox-library] › library/inspector/cli-codegen-javascript.spec.ts:84 › should save the codegen output to a file if specified @firefox-macos-15-large❌ [firefox-library] › library/proxy.spec.ts:237 › should exclude patterns @firefox-macos-15-large❌ [webkit-page] › page/page-leaks.spec.ts:136 › expect should not leak @tracing-webkit❌ [webkit-library] › library/har-websocket.spec.ts:80 › should include websocket handshake headers and status @webkit-windows-latest❌ [webkit-library] › library/har-websocket.spec.ts:118 › should include websocket messages @webkit-windows-latest❌ [webkit-library] › library/har-websocket.spec.ts:157 › should include larger websocket messages @webkit-windows-latest❌ [webkit-library] › library/har-websocket.spec.ts:196 › should include gigantic websocket messages @webkit-windows-latest❌ [webkit-library] › library/har-websocket.spec.ts:235 › should include binary websocket messages @webkit-windows-latest❌ [webkit-library] › library/har-websocket.spec.ts:338 › should record websocket handshake failure @webkit-windows-latest❌ [android-page] › page/page-autowaiting-basic.spec.ts:94 › should work with noWaitAfter: true❌ [android-page] › page/page-autowaiting-basic.spec.ts:100 › should work with dblclick without noWaitAfter when navigation is stalled❌ [android-page] › page/page-dialog.spec.ts:67 › should be able to close context with open alert❌ [android-page] › page/page-goto.spec.ts:373 › should fail when exceeding maximum navigation timeout❌ [android-page] › page/page-goto.spec.ts:441 › should prioritize default navigation timeout over default timeout❌ [android-page] › page/page-request-continue.spec.ts:125 › should not allow changing protocol when overriding url❌ [android-page] › page/page-set-content.spec.ts:153 › should handle timeout properly 2❌ [android-page] › page/workers.spec.ts:190 › should attribute network activity for worker inside iframe to the iframe

25 flaky

⚠️ [chromium-page] › page/page-click.spec.ts:1030 › should click in a transformed iframe `@msedge-dev-windows-latest`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-windows-latest`
⚠️ [chromium-library] › library/heap.spec.ts:106 › should not leak dispatchers after closing page `@chromium-macos-15-large`
⚠️ [chromium-page] › page/page-screenshot.spec.ts:648 › page screenshot animations › should stop animations that happen right before screenshot `@chromium-macos-15-large`
⚠️ [chromium-page] › page/page-screenshot.spec.ts:866 › page screenshot animations › should wait for fonts to load `@chromium-macos-15-large`
⚠️ [chromium-page] › page/page-set-input-files.spec.ts:146 › should upload large file `@chromium-macos-15-large`
⚠️ [chromium-page] › page/page-wait-for-selector-2.spec.ts:342 › should succeed if element handle was detached while waiting for hidden `@chromium-macos-15-large`
⚠️ [chromium-page] › page/page-wait-for-selector-2.spec.ts:351 › should succeed if element handle was detached while waiting for detached `@chromium-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-3.spec.ts:224 › cli codegen › should generate frame locators (4) `@tracing-firefox`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:43 › should poll on interval `@tracing-firefox`
⚠️ [firefox-library] › library/defaultbrowsercontext-2.spec.ts:147 › should have default URL when launching browser `@firefox-macos-15-large`
⚠️ [firefox-library] › library/defaultbrowsercontext-2.spec.ts:245 › user agent is up to date `@firefox-macos-15-large`
⚠️ [firefox-library] › library/defaultbrowsercontext-2.spec.ts:267 › exposes browser `@firefox-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-csharp.spec.ts:43 › should print the correct context options for custom settings `@firefox-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-csharp.spec.ts:202 › should not print context options method override in nunit if no options were passed `@firefox-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-csharp.spec.ts:208 › should print context options method override in nunit if options were passed `@firefox-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-java.spec.ts:24 › should print the correct imports and context options `@firefox-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-java.spec.ts:125 › should print a valid basic program in junit `@firefox-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-javascript.spec.ts:24 › should print the correct imports and context options `@firefox-macos-15-large`
⚠️ [firefox-library] › library/inspector/cli-codegen-pytest.spec.ts:49 › should save the codegen output to a file if specified `@firefox-macos-15-large`
⚠️ [firefox-library] › library/proxy.spec.ts:318 › should use socks proxy in second page `@firefox-macos-15-large`
⚠️ [webkit-library] › library/proxy.spec.ts:93 › should proxy local network requests › by default › loopback address `@tracing-webkit`
⚠️ [webkit-library] › library/inspector/cli-codegen-csharp.spec.ts:28 › should print the correct imports and context options `@webkit-windows-latest`
⚠️ [webkit-library] › library/tracing.spec.ts:432 › should produce screencast frames scale `@webkit-macos-15-large`
⚠️ [android-page] › page/page-route.spec.ts:317 › should not throw if request was cancelled by the page

88727 passed, 4103 skipped, 1 did not run

---

Merge workflow run.