Build(deps): Bump hono from 4.12.25 to 4.12.28 in /examples/node-gate-publisher in the npm-production group across 1 directory

[dependabot]

Bumps the npm-production group with 1 update in the /examples/node-gate-publisher directory: hono.

Updates hono from 4.12.25 to 4.12.28

Release notes

Sourced from hono's releases.

v4.12.28

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in honojs/hono#5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in honojs/hono#5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in honojs/hono#5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in honojs/hono#5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in honojs/hono#5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @​greymoth-jp in honojs/hono#5059
• chore: bump devDependencies by @​yusukebe in honojs/hono#5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @​VihaanAgarwal in honojs/hono#5033
• docs(context-storage): fix JSDoc by @​yusukebe in honojs/hono#5086

New Contributors

• @​EduardF1 made their first contribution in honojs/hono#5047
• @​greymoth-jp made their first contribution in honojs/hono#5059
• @​VihaanAgarwal made their first contribution in honojs/hono#5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

---

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

What's Changed

• fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @​yusukebe in honojs/hono#5013
• ci: publish to npm from CI with OIDC trusted publishing by @​yusukebe in honojs/hono#5028
• chore: remove unused devcontainer and gitpod configs by @​yusukebe in honojs/hono#5029
• chore: replace arg and glob with Bun native APIs in build script by @​yusukebe in honojs/hono#5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

Commits

• 626b185 4.12.28
• d6b1d32 docs(context-storage): fix JSDoc (#5086)
• 45b081b fix(aws-lambda): detect V2 events by request context, not rawPath alone (#5033)
• a05813c chore: bump devDependencies (#5085)
• 872997d fix(bun): report the requested subprotocol on WSContext.protocol (#5059)
• 82b321b fix: avoid circular dependency between body.ts and request.ts (#5071)
• b20d422 fix(utils/body,validator): normalize Content-Type media type for case-insensi...
• 9728702 chore: don't publish *.tsbuildinfo (#5066)
• ed8795e docs(MIGRATION): fix req.raw.headers reference (property, not method) (#5047)
• 03a9416 fix(serve-static): treat empty string content as found (#5062)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.