chore(deps): bump hono from 4.9.8 to 4.10.3 #5286

dependabot · 2025-10-24T19:34:24Z

Bumps hono from 4.9.8 to 4.10.3.

Release notes

v4.10.3

Securiy Fix

A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.

What's Changed

fix(aws-lambda): serve microsoft office files as binary in lambda handler by @matthiasfeist in honojs/hono#4469

fix(request-id): validation accepts = by @ryuapp in honojs/hono#4478

refactor(jwt): reduce the size of the code generated by minification by @usualoma in honojs/hono#4480

New Contributors

@matthiasfeist made their first contribution in honojs/hono#4469

Full Changelog: honojs/hono@v4.10.2...v4.10.3

v4.10.2

Security hardening improvement

If you are using JWT middleware, please read the following and consider applying the configuration.

Improper Authorization in Hono (JWT Audience Validation)

Hono’s JWT authentication middleware did not validate the aud (Audience) claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential cross-service access (token mix-up).

The issue is addressed by adding a new verification.aud configuration option to allow RFC 7519–compliant audience validation. This change is classified as a security hardening improvement, but the lack of validation can still be considered a vulnerability in deployments that rely on default JWT verification.

Recommended secure configuration

You can enable RFC 7519–compliant audience validation using the new verification.aud option:
import { Hono } from 'hono'
import { jwt } from 'hono/jwt'
const app = new Hono()
app.use(
'/api/*',
jwt({
secret: 'my-secret',
verification: {
// Require this API to only accept tokens with aud = 'service-a'
aud: 'service-a',
},
})
)
What's Changed

tests: Fix test case of handlers without a path by @IAmSSH in honojs/hono#4472

... (truncated)

Commits

fcefd50 4.10.3
95ae4d3 refactor(jwt): reduce the size of the code generated by minification (#4480)
d9b8b4b Merge commit from fork
5216117 fix(request-id): validation accepts = (#4478)
253ec28 fix(aws-lambda): serve microsoft office files as binary in lambda handler (#4...
0c6455d 4.10.2
45ba3bf Merge commit from fork
4cbad8b tests: Fix test case of handlers without a path (#4472)
db764c2 4.10.1
8774bf9 fix(types): cannot .use non-return mw from createMiddleware (#4465)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

dependabot · 2025-10-24T19:34:25Z

Labels

The following labels could not be found: chore: update @walletconnect/, viemand@wagmi/ dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

changeset-bot · 2025-10-24T19:34:28Z

⚠️ No Changeset found

Latest commit: 1a0b33a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-10-24T19:34:29Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
appkit-basic-html	Ready	Preview	Comment	Nov 5, 2025 3:00pm
appkit-demo	Ready	Preview	Comment	Nov 5, 2025 3:00pm
appkit-gallery	Ready	Preview		Nov 5, 2025 3:00pm
appkit-laboratory	Ready	Preview		Nov 5, 2025 3:00pm

10 Skipped Deployments

Project	Deployment	Updated (UTC)
appkit-basic-example	Ignored	Nov 5, 2025 3:00pm
appkit-basic-sign-client-example	Ignored	Nov 5, 2025 3:00pm
appkit-basic-up-example	Ignored	Nov 5, 2025 3:00pm
appkit-ethers5-bera	Ignored	Nov 5, 2025 3:00pm
appkit-nansen-demo	Ignored	Nov 5, 2025 3:00pm
appkit-vue-solana	Ignored	Nov 5, 2025 3:00pm
appkit-wagmi-cdn-example	Ignored	Nov 5, 2025 3:00pm
ethereum-provider-wagmi-example	Ignored	Nov 5, 2025 3:00pm
next-wagmi-solana-bitcoin-example	Ignored	Nov 5, 2025 3:00pm
vue-wagmi-example	Ignored	Nov 5, 2025 3:00pm

github-actions · 2025-10-24T19:36:19Z

Visual Regression Test Results ❌ Failed

✨ No visual changes detected

Chromatic Build: undefined
Storybook Preview: undefined

github-actions · 2025-10-24T19:41:29Z

📦 Bundle Size Check

✅ All bundles are within size limits

📊 View detailed bundle sizes

> @reown/[email protected] size /home/runner/work/appkit/appkit

> size-limit

@reown/appkit - Main Entry
Size limit:   80 kB
Size:         70.59 kB with all dependencies, minified and gzipped
Loading time: 1.4 s    on slow 3G
Running time: 325 ms   on Snapdragon 410
Total time:   1.8 s
@reown/appkit/react
Size limit:   230 kB
Size:         227.37 kB with all dependencies, minified and gzipped
Loading time: 4.5 s     on slow 3G
Running time: 498 ms    on Snapdragon 410
Total time:   5 s
@reown/appkit/vue
Size limit:   80 kB
Size:         70.59 kB with all dependencies, minified and gzipped
Loading time: 1.4 s    on slow 3G
Running time: 254 ms   on Snapdragon 410
Total time:   1.7 s
@reown/appkit-scaffold-ui
Size limit:   220 kB
Size:         207.37 kB with all dependencies, minified and gzipped
Loading time: 4.1 s     on slow 3G
Running time: 452 ms    on Snapdragon 410
Total time:   4.6 s
@reown/appkit-ui
Size limit:   500 kB
Size:         13.15 kB with all dependencies, minified and gzipped
Loading time: 257 ms   on slow 3G
Running time: 47 ms    on Snapdragon 410
Total time:   304 ms

github-actions · 2025-10-24T19:42:37Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	79.88%	37998 / 47564
🔵	Statements	79.88%	37998 / 47564
🔵	Functions	77.94%	4103 / 5264
🔵	Branches	86.48%	9206 / 10645

File Coverage

No changed files found.

Generated in workflow #16206 for commit 1a0b33a by the Vitest Coverage Report Action

Bumps [hono](https://github.com/honojs/hono) from 4.9.8 to 4.10.3. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.9.8...v4.10.3) --- updated-dependencies: - dependency-name: hono dependency-version: 4.10.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

vercel · 2025-11-05T14:44:08Z

Deployment failed with the following error:

Too many requests - try again in 3 minutes (more than 120, code: "api-deployments-flood-pro").

Learn More: https://vercel.com/docs/limits#rate-limits

enesozturk · 2025-11-05T15:13:50Z

With the new Dependabot settings this will be merged along with all other deps.

dependabot · 2025-11-05T15:13:53Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot bot mentioned this pull request Oct 24, 2025

chore(deps): bump hono from 4.9.8 to 4.10.2 #5276

Closed

vercel bot deployed to Preview – appkit-basic-html October 24, 2025 19:37 View deployment

vercel bot deployed to Preview – appkit-gallery October 24, 2025 19:37 View deployment

vercel bot deployed to Preview – appkit-demo October 24, 2025 19:38 View deployment

vercel bot deployed to Preview – appkit-laboratory October 24, 2025 19:38 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/hono-4.10.3 branch from 1040114 to 1c16080 Compare November 3, 2025 11:29

vercel bot deployed to Preview – appkit-basic-html November 3, 2025 11:40 View deployment

vercel bot deployed to Preview – appkit-demo November 3, 2025 11:40 View deployment

vercel bot deployed to Preview – appkit-gallery November 3, 2025 11:41 View deployment

vercel bot deployed to Preview – appkit-laboratory November 3, 2025 11:43 View deployment

dependabot bot force-pushed the dependabot/npm_and_yarn/hono-4.10.3 branch from 1c16080 to 1a0b33a Compare November 5, 2025 14:44

vercel bot deployed to Preview – appkit-basic-html November 5, 2025 14:57 View deployment

vercel bot deployed to Preview – appkit-laboratory November 5, 2025 14:59 View deployment

vercel bot deployed to Preview – appkit-demo November 5, 2025 15:00 View deployment

enesozturk closed this Nov 5, 2025

github-actions bot locked and limited conversation to collaborators Nov 5, 2025

dependabot bot deleted the dependabot/npm_and_yarn/hono-4.10.3 branch November 5, 2025 15:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump hono from 4.9.8 to 4.10.3 #5286

chore(deps): bump hono from 4.9.8 to 4.10.3 #5286

Uh oh!

dependabot bot commented on behalf of github Oct 24, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Oct 24, 2025

Uh oh!

changeset-bot bot commented Oct 24, 2025 •

edited

Loading

Uh oh!

vercel bot commented Oct 24, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 24, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 24, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 24, 2025 •

edited

Loading

Uh oh!

vercel bot commented Nov 5, 2025

Uh oh!

enesozturk commented Nov 5, 2025

Uh oh!

dependabot bot commented on behalf of github Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deps): bump hono from 4.9.8 to 4.10.3 #5286

chore(deps): bump hono from 4.9.8 to 4.10.3 #5286

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.10.3

Securiy Fix

What's Changed

New Contributors

v4.10.2

Security hardening improvement

Improper Authorization in Hono (JWT Audience Validation)

Recommended secure configuration

What's Changed

Uh oh!

dependabot bot commented on behalf of github Oct 24, 2025

Labels

Uh oh!

changeset-bot bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Visual Regression Test Results ❌ Failed

Uh oh!

github-actions bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Bundle Size Check

Uh oh!

github-actions bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

vercel bot commented Nov 5, 2025

Uh oh!

enesozturk commented Nov 5, 2025

Uh oh!

dependabot bot commented on behalf of github Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Oct 24, 2025 •

edited

Loading

changeset-bot bot commented Oct 24, 2025 •

edited

Loading

vercel bot commented Oct 24, 2025 •

edited

Loading

github-actions bot commented Oct 24, 2025 •

edited

Loading

github-actions bot commented Oct 24, 2025 •

edited

Loading

github-actions bot commented Oct 24, 2025 •

edited

Loading