[Snyk] Upgrade hono from 4.1.3 to 4.6.10

[cnrkuo]

Snyk has created this PR to upgrade hono from 4.1.3 to 4.6.10.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 67 versions ahead of your current version.

• The recommended version was released on a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') SNYK-JS-HONO-6672874	586	Proof of Concept
	Cross-site Request Forgery (CSRF) SNYK-JS-HONO-8220272	586	Proof of Concept
	Cross-Site Request Forgery (CSRF) SNYK-JS-HONO-7814167	586	Proof of Concept

Release notes

Package name: hono

• 4.6.10 - 2024-11-13
  

  What's Changed

  • chore: format no-response.yml by @ yusukebe in #3622
  • ci(deno): merge deno runtime coverage by @ usualoma in #3632
  • chore: bump devDependencies by @ EdamAme-x in #3633
  • fix(jsr): fix missing exports by @ EdamAme-x in #3636
  • refactor(hono-base): use object abbreviation notation by @ EdamAme-x in #3640
  • chore(build): validate if exporting is correct in package.json and jsr.json by @ EdamAme-x in #3638
  • fix(serveStatic): add guard to prevent reading empty folders by @ oussamasf in #3639
  • docs(service-worker): fix module docs for service worker adapter by @ rwv in #3645
  • refactor(hono-base): remove unneeded processes and variables by @ EdamAme-x in #3649
  • perf(trie-router): optimize and remove unnecessary processes by @ EdamAme-x in #3647
  • refactor(router): use # for private props to reduce the minified bundle size by @ EdamAme-x in #3660
  • fix(middleware/combine): prevent c.req.routeIndex from being changed by @ usualoma in #3663

  New Contributors

  • @ oussamasf made their first contribution in #3639
  • @ rwv made their first contribution in #3645

  Full Changelog: v4.6.9...v4.6.10

• 4.6.9 - 2024-11-04
  

  What's Changed

  • refactor: fix typos by @ mattn in #3583
  • fix(req): correct c.req.param decodes invalid percent strings by @ yusukebe in #3573
  • fix(jsx/dom): fix memo for DOM renderer by @ usualoma in #3568
  • fix(jsx/dom): fix dom rendering bugs for fragment. by @ usualoma in #3569
  • perf(compose): check if it is a instance only once by @ EdamAme-x in #3585
  • perf(router): use .concat instead of spread syntax by @ EdamAme-x in #3584
  • fix(types): remove any and fix types of adapter/deno by @ EdamAme-x in #3291
  • refactor(timing/utils-body): a few minor edits by @ sharma-shray in #3557
  • fix(hono-base): remove .matchRoute and reduce bundle size by @ EdamAme-x in #3595
  • perf(utils/url): improve performance of url utility by @ EdamAme-x in #3593
  • perf(context): improve performance of context (setHeaders) by @ EdamAme-x in #3592
  • refactor(helper/html): Prefer Array.isArray over instanceof Array by @ exoego in #3601
  • refactor: compare with undefined directly by @ exoego in #3602
  • refactor: remove useless spread by @ exoego in #3600
  • refactor(context): use simple for-of syntax by @ usualoma in #3598
  • feat(context): allow URL object on c.redirect() by @ cometkim in #3609
  • ci: Use latest version of Bun and Deno for CI by @ fel1x-developer in #3554
  • chore(ISSUE_TEMPLATE): encourage them to add a version if possible by @ EdamAme-x in #3599
  • perf(middleware/logger): optimize color status by @ exoego in #3603
  • refactor(utils/mime): make object and type commonality by @ EdamAme-x in #3606
  • chore: automatically close issues marked as “not bug” over time by @ EdamAme-x in #3611
  • perf(utils): use | 0 instead of Math.floor by @ EdamAme-x in #3605
  • perf(helper/cookie): fast-path for name specified by @ exoego in #3608
  • refactor: use # for private methods to reduce the minified file size by @ yusukebe in #3596
  • fix(helper/websocket): allow custom events to be passed to generics by @ EdamAme-x in #3616
  • fix(middleware/etag): generate etag hash value from all chunks by @ usualoma in #3604
  • fix(utils/crypto): fix types of crypto utility by @ EdamAme-x in #3614

  New Contributors

  • @ mattn made their first contribution in #3583
  • @ sharma-shray made their first contribution in #3557
  • @ fel1x-developer made their first contribution in #3554

  Full Changelog: v4.6.8...v4.6.9

• 4.6.8 - 2024-10-29
  

  What's Changed

  • fix(bun/ws): fix invalid types by @ nakasyou in #3562
  • fix(utils/cookie): partitioned typo in CookieOptions by @ imcotton in #3566
  • fix(websocket): Fix typo in WSContextInit type by @ Ariel-Moroshko in #3575
  • fix(websocket): prevent sending entire buffer when streaming Uint8Array chunks by @ Ariel-Moroshko in #3570
  • fix(bun/ws): supoort --hot by @ nakasyou in #3576
  • feat(header): suggest name of header and combine in one file by @ EdamAme-x in #3577
  • fix(devcontainer): remove unknown flag on docker-compose by @ EdamAme-x in #3582
  • fix(types): replace Hono with HonoBase to get better consistency of types by @ m-shaka in #3580

  New Contributors

  • @ Ariel-Moroshko made their first contribution in #3575

  Full Changelog: v4.6.7...v4.6.8

• 4.6.7 - 2024-10-26
  

  What's Changed

  • fix(vercel): remove requestContext by @ yusukebe in #3549
  • feat(jwt): Support custom secret keys for signing JWTs by @ kaandok in #3546
  • feat(ws): Make WebSocket adapter more changeable by @ nakasyou in #3531
  • perf(router): improve performance of router by @ EdamAme-x in #3526

  New Contributors

  • @ kaandok made their first contribution in #3546

  Full Changelog: v4.6.6...v4.6.7

• 4.6.6 - 2024-10-22
  

  What's Changed

  • docs(powered-by): add JSDoc by @ yusukebe in #3520
  • chore: podman support for devcontainer by @ marcomuser in #3529
  • refactor(secure-headers): refine secureHeadersNonce init by @ imcotton in #3535
  • fix(serve-static): silence NotFound warning on Deno by @ pablo-abc in #3542
  • fix(client): return query params in $url by @ alex-grover in #3541

  New Contributors

  • @ marcomuser made their first contribution in #3529
  • @ imcotton made their first contribution in #3535
  • @ pablo-abc made their first contribution in #3542
  • @ alex-grover made their first contribution in #3541

  Full Changelog: v4.6.5...v4.6.6

• 4.6.5 - 2024-10-15
  

  Security fix for CSRF Protection Middleware

  This release includes a security fix for CSRF Protection Middleware. If you are using CSRF Protection Middleware, please upgrade this hono package immediately.

  Before this release, a request without a Content-Type header can bypass the protection. This fix does not allow it. See: GHSA-2234-fmw7-43wr

  What's Changed

  • perf(types): replace intersection with union to get better perf by @ m-shaka in #3443
  • ci: use Deno v2 by @ yusukebe in #3506
  • ci: use Deno v2 for a test running for deno by @ nakasyou in #3509
  • fix(types): rm ExcludeEmptyObject to fix massively increased type instantiations by @ m-shaka in #3507
  • fix(cors): avoid setting Access-Control-Allow-Origin if there is no matching origin by @ uki00a in #3510
  • feat(powered-by): optional server name by @ PatrickJS in #3492
  • fix(factory): revert PR #3498 by @ yusukebe in #3515
  • fix(build): remove private fields by @ nakasyou in #3514

  New Contributors

  • @ uki00a made their first contribution in #3510
  • @ PatrickJS made their first contribution in #3492

  Full Changelog: v4.6.4...v4.6.5

• 4.6.4 - 2024-10-11
  

  What's Changed

  • chore: upgrade dependencies by @ yusukebe in #3446
  • chore: remove crypto-js from dev dependencies by @ yusukebe in #3447
  • chore(test): suppress no-unused-vars "'x' is assigned a value but only used as type" by @ exoego in #3451
  • chore(test): include bun coverage by @ exoego in #3457
  • test(deno): remove duplicated app.get by @ exoego in #3469
  • fix(types): add key to IntrinsicAttributes by @ codehz in #3474
  • fix(factory): relax Bindings and Variables for createMiddleware by @ yusukebe in #3498
  • fix(service-worker): bind fetch to globalThis by @ sapphi-red in #3500
  • refactor(jsx): add override to toStringToBuffer in classes extending JSXNode by @ yusukebe in #3505

  New Contributors

  • @ sapphi-red made their first contribution in #3500

  Full Changelog: v4.6.3...v4.6.4

• 4.6.3 - 2024-09-24
  

  This release has many new features, but each feature is small, so we've released it as a patch release.

  What's Changed

  • chore: rename runtime_tests to runtime-tests by @ yusukebe in #3419
  • ci: Type check perf by @ m-shaka in #3406
  • refactor(jsx/streaming): Clarified the type of renderToReadableStream. by @ usualoma in #3434
  • perf(types): use homomorphic mapped type to reduce conditional branches by @ m-shaka in #3440
  • ci: prettify type check result and rm a comment by

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.