fix(deps): update dependency hono to v4.2.7 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
hono (source)	4.2.5 -> 4.2.7

GitHub Vulnerability Alerts

CVE-2024-32869

Summary

When using serveStatic with deno, it is possible to directory traverse where main.ts is located.

My environment is configured as per this tutorial
https://hono.dev/getting-started/deno

PoC

$ tree
.
├── deno.json
├── deno.lock
├── main.ts
├── README.md
└── static
    └── a.txt

source

import { Hono } from 'https://deno.land/x/[email protected]/mod.ts'
import { serveStatic } from 'https://deno.land/x/[email protected]/middleware.ts'

const app = new Hono()
app.use('/static/*', serveStatic({ root: './' }))

Deno.serve(app.fetch)

request

curl localhost:8000/static/%2e%2e/main.ts

response is content of main.ts

Impact

Unexpected files are retrieved.

---

Release Notes

honojs/hono (hono)

v4.2.7

Compare Source

This release fixes "Restricted Directory Traversal in serveStatic with deno".

Full Changelog: honojs/hono@v4.2.6...v4.2.7

v4.2.6

Compare Source

What's Changed

• refactor(adapter/aws): Optimize multiple call of same conditions with polymorphism by @​exoego in https://github.com/honojs/hono/pull/2521
• fix(sse): close sse stream on end by @​domeccleston in https://github.com/honojs/hono/pull/2529
• fix(client): Don't show $ws when not used WebSockets by @​nakasyou in https://github.com/honojs/hono/pull/2532
• refactor(ssg): update utils.ts by @​eltociear in https://github.com/honojs/hono/pull/2519

New Contributors

• @​domeccleston made their first contribution in https://github.com/honojs/hono/pull/2529
• @​eltociear made their first contribution in https://github.com/honojs/hono/pull/2519

Full Changelog: honojs/hono@v4.2.5...v4.2.6

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.