| Filename | Latest commit message | Latest commit date |
|---|---|---|
6bea404652Bumps the npm_and_yarn group with 1 update in the /integration-test/src/jvmTest/typescript directory: [hono](https://github.com/honojs/hono). Updates `hono` from 4.11.4 to 4.11.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.11.7</h2> <h1>Security Release</h1> <p>This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.</p> <h2>Components</h2> <h3>IP Restriction Middleware</h3> <p>Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.</p> <h3>Cache Middleware</h3> <p>Fixed an issue where responses marked with <code>Cache-Control: private</code> or <code>no-store</code> could be cached, potentially leading to information disclosure on some runtimes.</p> <h3>Serve Static Middleware (Cloudflare Workers adapter)</h3> <p>Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.</p> <h3>hono/jsx <code>ErrorBoundary</code></h3> <p>Fixed a reflected Cross-Site Scripting (XSS) issue in the <code>ErrorBoundary</code> component that could occur when untrusted strings were rendered without proper escaping.</p> <h2>Recommendation</h2> <p>Users are encouraged to upgrade to this release, especially if they:</p> <ul> <li>Use IP Restriction Middleware</li> <li>Use Cache Middleware on Deno, Bun, or Node.js</li> <li>Use Serve Static Middleware with user-controlled paths on Cloudflare Workers</li> <li>Render untrusted data inside <code>ErrorBoundary</code> components</li> </ul> <h2>Security Advisories & CVEs</h2> <ul> <li> <p><strong>IP Restriction Middleware – IPv4 address validation bypass</strong></p> <ul> <li>Advisory: <a href="https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh">https://github.com/honojs/hono/security/advisories/GHSA-r354-f388-2fhh</a></li> <li>CVE: CVE-2026-24398</li> </ul> </li> <li> <p><strong>Cache Middleware ignores <code>Cache-Control: private</code></strong></p> <ul> <li>Advisory: <a href="https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4">https://github.com/honojs/hono/security/advisories/GHSA-6wqw-2p9w-4vw4</a></li> <li>CVE: CVE-2026-24472</li> </ul> </li> <li> <p><strong>Serve Static Middleware (Cloudflare Workers adapter) – Arbitrary key read</strong></p> <ul> <li>Advisory: <a href="https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p">https://github.com/honojs/hono/security/advisories/GHSA-w332-q679-j88p</a></li> <li>CVE: CVE-2026-24473</li> </ul> </li> <li> <p><strong>hono/jsx <code>ErrorBoundary</code> – Cross-Site Scripting (XSS)</strong></p> <ul> <li>Advisory: <a href="https://github.com/honojs/hono/security/advisories/GHSA-9r54-q6cx-xmh5">https://github.com/honojs/hono/security/advisories/GHSA-9r54-q6cx-xmh5</a></li> <li>CVE: Pending</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
| .. | ||
| src | ||
| build.gradle.kts | ||