chore(deps): update dependency hono@<4.6.5 to >=4.10.3 [security]

[homarr-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hono@<4.6.5 (source)	>=4.10.2 -> >=4.10.3

GitHub Vulnerability Alerts

GHSA-q7jf-gf43-6x6p

Summary

A flaw in the CORS middleware allowed request Vary headers to be reflected into the response, enabling attacker-controlled Vary values and potentially affecting cache behavior.

Details

The middleware previously copied the Vary header from the request when origin was not set to "*". Since Vary is a response header that should only be managed by the server, this could allow an attacker to influence caching behavior or cause inconsistent CORS handling.

Most environments will see impact only when shared caches or proxies rely on the Vary header. The practical effect varies by configuration.

Impact

May cause cache key pollution and inconsistent CORS enforcement in certain setups. No direct confidentiality, integrity, or availability impact in default configurations.

Resolution

Update to the latest patched release. The CORS middleware has been corrected to handle Vary exclusively as a response header.

---

Release Notes

honojs/hono (hono@<4.6.5)

v4.10.3

Compare Source

Securiy Fix

A security issue in the CORS middleware has been fixed. In some cases, a request header could affect the Vary response header. Please update to the latest version if you are using the CORS middleware.

What's Changed

• fix(aws-lambda): serve microsoft office files as binary in lambda handler by @​matthiasfeist in #​4469
• fix(request-id): validation accepts = by @​ryuapp in #​4478
• refactor(jwt): reduce the size of the code generated by minification by @​usualoma in #​4480

New Contributors

• @​matthiasfeist made their first contribution in #​4469

Full Changelog: honojs/hono@v4.10.2...v4.10.3

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[homarr-approvals]

Automatically approved by GitHub Action

[deepsource-io]

Here's the code health analysis summary for commits 0ca225d..3209f9f. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
JavaScript	✅ Success		View Check ↗

---

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	25.22%	14921 / 59157
🔵	Statements	25.22%	14921 / 59157
🔵	Functions	37.54%	690 / 1838
🔵	Branches	72.31%	1669 / 2308

File Coverage

No changed files found.

Generated in workflow #8969 for commit 3209f9f by the Vitest Coverage Report Action