Bump hono from 4.7.10 to 4.11.10

[dependabot]

Bumps hono from 4.7.10 to 4.11.10.

Release notes

Sourced from hono's releases.

v4.11.10

What's Changed

• fix: fixed to be more properly timing safe (Merge commit from fork 91def7ca)

Full Changelog: honojs/hono@v4.11.9...v4.11.10

v4.11.9

What's Changed

• fix(url): ignore fragment identifiers in getPath() by @​sano-suguru in honojs/hono#4627
• fix: determine if rendered or not by node.vC[0] instead of referring to node.pP by @​usualoma in honojs/hono#4663

Full Changelog: honojs/hono@v4.11.8...v4.11.9

v4.11.8

What's Changed

• fix(jsx): preserve context when using await before html helper by @​kaigritun in honojs/hono#4662
• fix(bearer-auth): make auth-scheme case-insensitive by @​bytaesu in honojs/hono#4659

New Contributors

• @​kaigritun made their first contribution in honojs/hono#4662

Full Changelog: honojs/hono@v4.11.7...v4.11.8

v4.11.7

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components

IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

... (truncated)

Commits

• a40d210 4.11.10
• 91def7c Merge commit from fork
• 8b17935 test(types): add regression tests for #4388 (routes before .use() with explic...
• 4a03f4f doc(jwt): mark options.secret as required in JSDoc (#4718)
• 7300551 chore(ci): bump typescript-go to the latest (#4716)
• 4b29780 chore: update Zod import examples to use namespace imports (#4715)
• 69ad885 4.11.9
• 3d536ff fix: determine if rendered or not by node.vC[0] instead of referring to `no...
• 0c1d4c7 fix(url): ignore fragment identifiers in getPath() (#4627)
• 5ca5c3e 4.11.8
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying chickadee-web with    Cloudflare Pages

Latest commit:	b015151
Status:	🚫  Build failed.

View logs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​iconify/​tailwind4@​1.0.6 ⏵ 1.2.1	+10		+3	+7
	@​iconify-json/​carbon@​1.2.8 ⏵ 1.2.18	+1		+1
	ua-parser-js@​2.0.3 ⏵ 2.0.9	+1
	vite@​6.3.5 ⏵ 6.4.1	+5	+4	+1	+1
	daisyui@​5.0.37 ⏵ 5.5.19	+1		+14
	honox@​0.1.40 ⏵ 0.1.54	+5		+1	+2
	tailwindcss@​4.1.7 ⏵ 4.2.0	+1
	turbo@​2.5.3 ⏵ 2.8.10	+1		-1	+1
	tailwind-merge@​3.3.0 ⏵ 3.5.0	+1		+1	+2
	chart.js@​4.4.9 ⏵ 4.5.1	+1		+1
	spacetime@​7.10.0 ⏵ 7.12.0			+1	+5
	@​tailwindcss/​typography@​0.5.16 ⏵ 0.5.19	+1		+1
	@​tailwindcss/​vite@​4.1.7 ⏵ 4.2.0	+1		+16	+1
	@​hono/​vite-build@​1.6.2 ⏵ 1.9.3	+5			+11
	zod@​3.25.23 ⏵ 3.25.76	+1		+25
	wrangler@​4.16.1 ⏵ 4.67.0		+16	+1	+1
	hono@​4.7.10 ⏵ 4.11.10		+32	-1	+1
	@​cloudflare/​workers-types@​4.20250523.0 ⏵ 4.20260227.0			+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm miniflare is 98.0% likely obfuscated Confidence: 0.98 Location: Package overview From: pnpm-lock.yaml → npm/wrangler@4.67.0 → npm/miniflare@4.20260219.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/miniflare@4.20260219.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm workerd is 98.0% likely obfuscated Confidence: 0.98 Location: Package overview From: pnpm-lock.yaml → npm/wrangler@4.67.0 → npm/workerd@1.20260219.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/workerd@1.20260219.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report