[Snyk] Security upgrade hono from 4.12.9 to 4.12.25

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• examples/server/package.json

⚠️ Warning

Failed to update the pnpm-lock.yaml, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Directory Traversal SNYK-JS-HONO-17356405

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

---

This change is 

[snyk-io]

This is a series of patch updates that primarily include security fixes and bug fixes. While there are no breaking API changes, a security fix in version 4.12.25 alters the behavior of the CORS middleware, which requires verification.

Key Changes:

• CORS Middleware Behavior Change (v4.12.25): A security vulnerability (GHSA-88fw-hqm2-52qc) was fixed where the middleware would reflect the request's Origin header with Access-Control-Allow-Credentials: true when the origin was configured as a wildcard (*). This insecure behavior has been corrected. [3]
• Other Security Fixes: The updates also address a Body Limit bypass on AWS Lambda and a path traversal issue in serve-static on Windows. [3]
• Bug Fixes & Features: The releases between 4.12.9 and 4.12.25 include various other non-breaking changes, such as making the options parameter optional in serveStatic and adding a request.bytes() method. [3]

Recommendation:
Verify your CORS middleware configuration. If you are using credentials: true, ensure you are using an explicit origin list and not a wildcard, as the previous insecure behavior is no longer supported. The risk is rated medium because applications unintentionally relying on this flawed behavior may break.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[changeset-bot]

⚠️ No Changeset found

Latest commit: af23fb3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This PR is a Snyk-generated security upgrade that pins hono to version 4.12.25 to fix a Directory Traversal vulnerability (SNYK-JS-HONO-17356405). The upgrade addresses the security advisory as indicated in the PR description.

Note: The PR description indicates that pnpm-lock.yaml was not automatically updated and requires manual intervention. Consider running pnpm install to update the lock file before merging.

Files Reviewed (1 file)

• examples/server/package.json (1 changed line)

---

_{Reviewed by laguna-m.1-20260312:free · Input: 273.9K · Output: 10.3K · Cached: 1.3M}

_{Review guidance: REVIEW.md from base branch main}