chore(deps): bump hono from 4.11.4 to 4.11.7

[dependabot]

Bumps hono from 4.11.4 to 4.11.7.

Release notes

Sourced from hono's releases.

v4.11.7

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components

IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

• Use IP Restriction Middleware
• Use Cache Middleware on Deno, Bun, or Node.js
• Use Serve Static Middleware with user-controlled paths on Cloudflare Workers
• Render untrusted data inside ErrorBoundary components

Security Advisories & CVEs

• IP Restriction Middleware – IPv4 address validation bypass

  • Advisory: GHSA-r354-f388-2fhh
  • CVE: CVE-2026-24398

• Cache Middleware ignores Cache-Control: private

  • Advisory: GHSA-6wqw-2p9w-4vw4
  • CVE: CVE-2026-24472

• Serve Static Middleware (Cloudflare Workers adapter) – Arbitrary key read

  • Advisory: GHSA-w332-q679-j88p
  • CVE: CVE-2026-24473

• hono/jsx ErrorBoundary – Cross-Site Scripting (XSS)

  • Advisory: GHSA-9r54-q6cx-xmh5
  • CVE: Pending

... (truncated)

Commits

• f7d272a 4.11.7
• 2cf6004 Merge commit from fork
• cf9a78d Merge commit from fork
• edbf6ee Merge commit from fork
• 12c5117 Merge commit from fork
• 7343487 4.11.6
• b6e5a97 feat(bun): export getBunServer (#4626)
• 2a9cd95 fix(sse): handle \r and \r\n line endings in writeSSE (#4644)
• 8078bbf docs: align CODE_OF_CONDUCT.md wording with Contributor Covenant (#4630)
• a5be555 refactor: use unique symbol for more accurate typing. (#4651)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
spotlightjs	Ready	Preview, Comment	Jan 27, 2026 7:32pm

[github-actions]

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

New Features ✨

• (ui) Collapsible insights section by Shubhdeep12 in #1263
• Added new codecov action by MathurAditya724 in #1255

Bug Fixes 🐛

• (cli) Show options in command-specific help output by BYK in #1260
• (deps) Address Dependabot security alerts by BYK in #1261
• (ui) Update TelemetryView layout for better responsiveness by Shubhdeep12 in #1262
• Updated the codecov action to point to getsentry by MathurAditya724 in #1259

Internal Changes 🔧

Deps

• Bump hono from 4.11.4 to 4.11.7 by dependabot[bot] in #1267

• Bump hono from 4.10.3 to 4.11.4 by dependabot in #1254

Other

• (ci) Fix workflow warnings for cache action and codecov by BYK in #1251
• (release) Fix Docker Latest Target by BYK in #1252
• Use pull_request_target for changelog preview by BYK in #1256

Other

• Update documentation link in README.md by sergical in #1253

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

Codecov Results 📊

✅ Patch coverage is 100.00%. Project has 1348 uncovered lines.
✅ Project coverage is 76.31%. Comparing base (base) to head (head).

Files with missing lines (31)

File	Patch %	Lines
event.ts	52.61%	⚠️ 263 Missing
mcp.ts	65.91%	⚠️ 151 Missing
messageBuffer.ts	67.57%	⚠️ 120 Missing
docker-compose.ts	77.33%	⚠️ 85 Missing
utils.ts	31.71%	⚠️ 84 Missing
extras.ts	28.13%	⚠️ 69 Missing
debugLogging.ts	29.47%	⚠️ 67 Missing
utils.ts	75.28%	⚠️ 66 Missing
index.ts	24.59%	⚠️ 46 Missing
cors.ts	91.08%	⚠️ 39 Missing and 1 partials
logs.ts	28.85%	⚠️ 37 Missing
traces.ts	93.10%	⚠️ 33 Missing and 1 partials
userAgent.ts	52.63%	⚠️ 27 Missing
index.ts	80.47%	⚠️ 25 Missing
utils.ts	66.67%	⚠️ 23 Missing
errors.ts	75.53%	⚠️ 23 Missing
JsonViewer.tsx	71.62%	⚠️ 21 Missing
traces.ts	75.86%	⚠️ 21 Missing
processEnvelope.ts	86.67%	⚠️ 18 Missing
eventContainer.ts	78.05%	⚠️ 18 Missing
open.ts	42.86%	⚠️ 16 Missing
CodeViewer.tsx	54.55%	⚠️ 15 Missing
contentType.ts	66.67%	⚠️ 15 Missing
Attachment.tsx	90.00%	⚠️ 12 Missing and 1 partials
helpers.ts	70.27%	⚠️ 11 Missing
streaming.ts	76.09%	⚠️ 11 Missing
ShikiProvider.tsx	54.17%	⚠️ 11 Missing
AnsiText.tsx	91.00%	⚠️ 9 Missing
logger.ts	65.22%	⚠️ 8 Missing
logger.ts	87.50%	⚠️ 4 Missing and 1 partials
profileChunkProcessor.ts	100.00%	⚠️ 1 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    76.31%    76.31%        —%
==========================================
  Files           47        47         —
  Lines         5690      5690         —
  Branches       614       611        -3
==========================================
+ Hits          4342      4342         —
- Misses        1348      1348         —
- Partials         5         5         —

---

Generated by Codecov Action