dependabot[bot] opened a new pull request, #11917: URL: https://github.com/apache/nifi/pull/11917
Bumps [hono](https://github.com/honojs/hono) from 4.13.12 to 4.13.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases";>hono's releases</a>.</em></p> <blockquote> <h2>v4.13.18</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3><code>validator()</code> skips validation for requests whose <code>Content-Type</code> parameters are formatted differently</h3> <p>Affects: <code>validator('json')</code> and <code>validator('form')</code> in <code>hono/validator</code>. A <code>Content-Type</code> with whitespace before <code>;</code>, a trailing <code>;</code>, or an unusual parameter name was not recognized, so the validator saw an empty object while the handler could read all fields. This completes the fix for GHSA-4h7h-rv7c-7m2v. The validator now decides by the media type alone, as <code>c.req.parseBody()</code> does. GHSA-92p4-j3wq-jmqx</p> <h3><code>bodyLimit()</code> keeps every transfer chunk of a request body in memory</h3> <p>Affects: <code>bodyLimit()</code> in <code>hono/body-limit</code>. A body sent in very small transfer chunks was retained as one object per chunk, so a request within the configured limit could exhaust memory. The body is now buffered in one array bounded by <code>maxSize</code>. GHSA-39q9-qp46-w8xg</p> <h3><code>mount()</code> and <code>app.mount()</code> forward a wrong path when a custom <code>getPath</code> adds a prefix</h3> <p>Affects: <code>mount()</code> in <code>hono/mount</code> and <code>app.mount()</code> on 4.13.16 and 4.13.17. With a <code>getPath</code> that prepends a prefix such as the host name, one segment too many was removed from the forwarded path, so middleware scoped inside the mount prefix could be skipped. The prefix is removed from the routed path again. Paths that would change meaning when forwarded now get 400, and an optional regular expression parameter in a mount path throws. GHSA-h25j-2p75-qj33</p> <h3><code>serveStatic()</code> serves a path that was decoded twice when <code>allowPercentInPath</code> is enabled</h3> <p>Affects: <code>serveStatic()</code> in <code>hono/serve-static</code> and the runtime adapters, only with <code>allowPercentInPath: true</code>. A malformed percent escape in the request path was decoded a second time, so a path that middleware registered on the encoded form did not see could still reach a static file. The file path must now be the same as the routed path, and otherwise the response is 404. GHSA-74fm-fwc7-3fwp</p> <hr /> <p>Users who rely on <code>validator()</code>, <code>bodyLimit()</code>, <code>mount()</code> with a custom <code>getPath</code>, or <code>serveStatic()</code> with <code>allowPercentInPath</code> are strongly encouraged to upgrade to this version.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.13.17...v4.13.18";>https://github.com/honojs/hono/compare/v4.13.17...v4.13.18</a></p> <h2>v4.13.17</h2> <h2>What's Changed</h2> <ul> <li>fix(cookie): match the <code>__Secure-</code> and <code>__Host-</code> prefixes case-insensitively in <a href="https://redirect.github.com/honojs/hono/pull/5608";>honojs/hono#5608</a></li> <li>fix(utils/url): do not match a query key across separators in <a href="https://redirect.github.com/honojs/hono/pull/5607";>honojs/hono#5607</a></li> <li>fix(etag,pretty-json): cancel the discarded response body in <a href="https://redirect.github.com/honojs/hono/pull/5606";>honojs/hono#5606</a></li> <li>fix(client): detect the JSON media type with whitespace before a parameter in <a href="https://redirect.github.com/honojs/hono/pull/5609";>honojs/hono#5609</a></li> <li>fix(timing): honor a precision of 0 in <code>setMetric</code> in <a href="https://redirect.github.com/honojs/hono/pull/5363";>honojs/hono#5363</a></li> <li>fix(utils/mime,ssg): match media types case-insensitively in <a href="https://redirect.github.com/honojs/hono/pull/5449";>honojs/hono#5449</a></li> <li>fix(timing): escape double quotes and backslashes in Server-Timing descriptions in <a href="https://redirect.github.com/honojs/hono/pull/5478";>honojs/hono#5478</a></li> <li>fix(etag): preserve commas within quoted entity tags in <a href="https://redirect.github.com/honojs/hono/pull/5353";>honojs/hono#5353</a></li> <li>fix(accepts): preserve exact media type quality over subtype wildcards in <a href="https://redirect.github.com/honojs/hono/pull/5427";>honojs/hono#5427</a></li> <li>fix(cookie): match the <code>__Secure-</code> and <code>__Host-</code> prefixes case-insensitively in <code>CookieConstraint</code> in <a href="https://redirect.github.com/honojs/hono/pull/5611";>honojs/hono#5611</a></li> <li>fix(jsx): add the CSP nonce to all scripts generated by <code>ErrorBoundary</code> in <a href="https://redirect.github.com/honojs/hono/pull/5430";>honojs/hono#5430</a></li> <li>fix(ssg): do not reuse created directories across <code>toSSG</code> runs in <a href="https://redirect.github.com/honojs/hono/pull/5381";>honojs/hono#5381</a></li> <li>fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in <a href="https://redirect.github.com/honojs/hono/pull/5483";>honojs/hono#5483</a></li> <li>fix(jsx): escape element and object attribute values in <a href="https://redirect.github.com/honojs/hono/pull/5512";>honojs/hono#5512</a></li> <li>fix(jsx): do not render ref objects as attributes in <a href="https://redirect.github.com/honojs/hono/pull/5615";>honojs/hono#5615</a></li> <li>fix(factory): keep independent return types for nine handlers in <a href="https://redirect.github.com/honojs/hono/pull/5618";>honojs/hono#5618</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.13.16...v4.13.17";>https://github.com/honojs/hono/compare/v4.13.16...v4.13.17</a></p> <h2>v4.13.16</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/f6fbaf0299c48eea9e656e03e2ffe7ac755e8823";><code>f6fbaf0</code></a> 4.13.18</li> <li><a href="https://github.com/honojs/hono/commit/0809e48947c43ae20542bc14c0f750b6c6585b4d";><code>0809e48</code></a> test(serve-static) fix test (<a href="https://redirect.github.com/honojs/hono/issues/5623";>#5623</a>)</li> <li><a href="https://github.com/honojs/hono/commit/c7ff08f13b9c6cc8de72f65d0a65e4b3beb1c5dd";><code>c7ff08f</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/b982c0292eefe44e1c898acc3952ec5bb80a30f4";><code>b982c02</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/9aeb45b40a9b600399e977eabc076d82df43cc92";><code>9aeb45b</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/b0af6bb93c0337357f6a3d8b95fde2d416c43fd3";><code>b0af6bb</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/61f7c59e50244ab4d2dd83c151928cf7ea448510";><code>61f7c59</code></a> 4.13.17</li> <li><a href="https://github.com/honojs/hono/commit/1534ffa3e9c576dc3b13d8d514c85c6e2e28c1a4";><code>1534ffa</code></a> fix(factory): keep independent return types for nine handlers (<a href="https://redirect.github.com/honojs/hono/issues/5618";>#5618</a>)</li> <li><a href="https://github.com/honojs/hono/commit/eb754bd5ef22c63f1634a4c374a86be086f85710";><code>eb754bd</code></a> fix(jsx): do not render ref objects as attributes (<a href="https://redirect.github.com/honojs/hono/issues/5615";>#5615</a>)</li> <li><a href="https://github.com/honojs/hono/commit/6cbe361b7ad2947fd672f23ed689eef81c2f0615";><code>6cbe361</code></a> fix(jsx): escape element and object attribute values (<a href="https://redirect.github.com/honojs/hono/issues/5512";>#5512</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.13.12...v4.13.18";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/nifi/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
