chore(deps): bump hono from 4.12.23 to 4.12.33

[dependabot]

Bumps hono from 4.12.23 to 4.12.33.

Release notes

Sourced from hono's releases.

v4.12.33

What's Changed

• fix(cookie): relax name validation when parsing Cookie header in honojs/hono#5164
• chore: bump @hono/node-server in honojs/hono#5167
• fix(jsx): handle useSyncExternalStore subscription and snapshot changes in honojs/hono#5166
• chore: remove undici in favor of global fetch in honojs/hono#5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

v4.12.32

What's Changed

• ci: enable reports for type & bundle size check in honojs/hono#5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
• fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
• fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
• fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130
• fix(utils/body): reuse cached formData in parseBody() by @​yusukebe in honojs/hono#5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @​yusukebe in honojs/hono#5133
• fix(sse): emit retry feild when retry is 0 by @​yusukebe in honojs/hono#5135
• test(validator): fix misspelled identifier in transform type test by @​yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

• chore(benchmark/routers): bump deps in honojs/hono#5107
• chore(benchmark): remove not used benchmarks in honojs/hono#5108
• chore: update to ts6 in prep for ts7 in honojs/hono#5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025
• fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020
• fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096
• fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in honojs/hono#5092
• chore: fix no-op tsc in test script by @​yusukebe in honojs/hono#5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in honojs/hono#5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in honojs/hono#5081

... (truncated)

Commits

• 51db313 4.12.33
• aed1463 chore: remove undici in favor of global fetch (#5168)
• 224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
• df653ce chore: bump @hono/node-server (#5167)
• 09cf01c fix(cookie): relax name validation when parsing Cookie header (#5164)
• 26d8e42 4.12.32
• 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
• c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
• a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
• 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e03dd9d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Risk: low. Approved — Cursor Bugbot was not present on this PR, and the change is a narrow hono patch bump (4.12.23 → 4.12.31) limited to package-lock.json. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[yakimoto]

Verified locally. CI can't run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes, confirmed live this morning on adk and dispatch-edge) — so this stands in for the checks until it clears.

npm ci (NODE_ENV=development)  → OK
npm run build                  → ESM ⚡️ Build success
npm run type-check             → tsc --noEmit, clean

Advisory delta, dev scope included, against main @ a199245:

	total	high	mod	low
main	7	3	2	2
this PR	6	2	2	2

hono drops out of the audit entirely. This is the biggest single win of the open set: 8 of the repo's 14 Dependabot alerts are hono (4 × < 4.12.25 medium, 3 × < 4.12.27 medium, 1 × < 4.12.25 high), and 4.12.31 clears all eight at once.

Caveat for anyone re-checking these numbers: npm audit here inherits omit=dev from NODE_ENV=production and silently reports 5 instead of 7, hiding the dev-scope entries. Set NODE_ENV=development explicitly.

No objection from me — ready the moment CI is available. Note that merges are on hold until branch protection is verified back, not merely reported mergeable: during this outage PRs went MERGEABLE because protection vanished, which reads exactly like CI recovering.

[greptile-apps]

PR author is in the excluded authors list.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[dependabot]

Superseded by #82.