Skip to content

chore(deps): bump hono from 4.12.26 to 4.12.28 in /agent#1

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/agent/hono-4.12.28
Closed

chore(deps): bump hono from 4.12.26 to 4.12.28 in /agent#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/agent/hono-4.12.28

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 7, 2026

Copy link
Copy Markdown

Bumps hono from 4.12.26 to 4.12.28.

Release notes

Sourced from hono's releases.

v4.12.28

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc


Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

Commits
  • 626b185 4.12.28
  • d6b1d32 docs(context-storage): fix JSDoc (#5086)
  • 45b081b fix(aws-lambda): detect V2 events by request context, not rawPath alone (#5033)
  • a05813c chore: bump devDependencies (#5085)
  • 872997d fix(bun): report the requested subprotocol on WSContext.protocol (#5059)
  • 82b321b fix: avoid circular dependency between body.ts and request.ts (#5071)
  • b20d422 fix(utils/body,validator): normalize Content-Type media type for case-insensi...
  • 9728702 chore: don't publish *.tsbuildinfo (#5066)
  • ed8795e docs(MIGRATION): fix req.raw.headers reference (property, not method) (#5047)
  • 03a9416 fix(serve-static): treat empty string content as found (#5062)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [hono](https://github.com/honojs/hono) from 4.12.26 to 4.12.28.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.26...v4.12.28)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 7, 2026
@vercel

vercel Bot commented Jul 7, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
earlynotwrong Ready Ready Preview, Comment Jul 7, 2026 11:23pm

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​hono@​4.12.26 ⏵ 4.12.2899 +110097 +196 +2100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Author

Superseded by #22.

@dependabot dependabot Bot closed this Jul 14, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/agent/hono-4.12.28 branch July 14, 2026 09:45
thisyearnofear pushed a commit that referenced this pull request Jul 16, 2026
Seven improvements to surface all chains, capabilities, and connect
the conviction side to the trading side:

#1 Multi-chain anchor status panel (src/components/recent-anchors.tsx)
   - Replaced flat history list with a 3-column panel: Casper, Mantle, Aleo
   - Each chain gets equal visual weight with its own colored border/bg
   - Shows latest anchor status, tx hash, and explorer link per chain
   - Fetches from both /conviction (anchorResults) and /casper/anchors
   - Rolling history list below, grouped by chain with color-coded labels

#2 Aleo added to dashboard narrative
   - Aleo now appears as the third column in the anchor panel
   - Role label: "Privacy-preserving thesis proof"
   - No longer buried in /analyzer's Strategist tab only

#3 Chain legend
   - One-line legend under the 3-column panel:
     "Casper = public registry · Mantle = EVM mirror · Aleo = privacy proof"
   - Tells a judge why there are three chains, not just that there are three

#4 Conviction-to-trade flow (src/app/agent/page.tsx)
   - Held positions now show the conviction score that motivated entry
   - "scored 72" annotation in signal color, with rationale on hover
   - Conviction Ledger card title shows "positions ← signals" hint
   - The connection between scoring and trading is now visible

#5 Shared conviction-core framework surfaced
   - Row 0 orientation text now mentions conviction-core:
     "The same conviction-core framework that scores the agent's trades
      also powers the wallet analyzer"
   - Links to /analyzer to connect the two sides of the product

#6 MCP/CAP story reframed (ReputationApiCard)
   - Renamed from "Agent Reputation API" to "Agent-to-Agent Reputation"
   - Badge now shows "MCP · x402 · CROO CAP" (all three protocols)
   - Description rewritten to lead with the unique capability:
     "Other AI agents query this agent's verifiable track record over
      Model Context Protocol, paying per call through x402 micropayments
      on Casper. The agent also advertises reputation services on the
      CROO network, settled in USDC on Base — agent-to-agent commerce,
      no human in the loop."

#7 Cycle timeline strip
   - Horizontal strip in Row 0 showing the 6 pipeline steps with checkmarks:
     "Cycle 127: ✓ data → ✓ score → ✓ manage → ✓ execute → ✓ anchor → ✓ narrate"
   - Shows "next in Xm" countdown to the next cycle
   - Proves the agent is a complete autonomous loop, not just a trader

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
thisyearnofear pushed a commit that referenced this pull request Jul 16, 2026
#1 "Early, Not Wrong" conviction proven callout
   - When a position was held through ≥10% drawdown and is now
     profitable, a prominent highlighted box appears at the top of
     the Conviction Ledger showing the full arc:
     "FET · scored 72 → entered cycle 124 → dipped −15.2% →
      held 3 cycles → now +38.4%"
   - Border-2 patience-colored with glow shadow
   - Includes the verdict reason (why the agent held)
   - Only shows the best example (slice 1) to avoid clutter
   - This is the product thesis made visible in one data point

#2 Improved empty state for anchor history
   - When no anchors exist yet, shows an anchor icon + explanatory
     text: "The agent anchors conviction records to Casper, Mantle,
     and Aleo at the end of each ~4h cycle."
   - Consistent with the dashboard's other empty states
     (icon + heading + context)

#3 Mobile responsive pass
   - Anchor panel: sm:grid-cols-3 → md:grid-cols-3 (stacks on phones)
   - Held position metadata row: added flex-wrap so the
     "$24 entry · 3 cycles held · −15.0% worst dip · scored 72"
     line wraps gracefully on narrow viewports
   - Conviction proven callout already uses flex-wrap
   - Cycle timeline strip already uses flex-wrap
   - Home page grids already responsive (1→2→4)

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants