From c289a88f50b63637315921456788d002eb0a048f Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 15 Jan 2026 03:39:45 +0000
Subject: [PATCH] fix(security): force hono 4.11.4

---
 package.json   |  4 +++-
 pnpm-lock.yaml | 23 +++++++++++++----------
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/package.json b/package.json
index 6ec3c86c4..dc6c0a521 100644
--- a/package.json
+++ b/package.json
@@ -159,6 +159,7 @@
     "express": "^5.2.1",
     "file-type": "^21.3.0",
     "grammy": "^1.39.2",
+    "hono": "4.11.4",
     "jiti": "^2.6.1",
     "json5": "^2.2.3",
     "long": "5.3.2",
@@ -207,7 +208,8 @@
   "pnpm": {
     "minimumReleaseAge": 2880,
     "overrides": {
-      "@sinclair/typebox": "0.34.47"
+      "@sinclair/typebox": "0.34.47",
+      "hono": "4.11.4"
     },
     "patchedDependencies": {
       "@mariozechner/pi-ai@0.45.7": "patches/@mariozechner__pi-ai@0.45.7.patch"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index edd6fa07b..d3e9dfc5f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,6 +6,7 @@ settings:
 
 overrides:
   '@sinclair/typebox': 0.34.47
+  hono: 4.11.4
 
 patchedDependencies:
   '@mariozechner/pi-ai@0.45.7':
@@ -18,7 +19,7 @@ importers:
     dependencies:
       '@buape/carbon':
         specifier: 0.0.0-beta-20260110172854
-        version: 0.0.0-beta-20260110172854(hono@4.11.3)
+        version: 0.0.0-beta-20260110172854(hono@4.11.4)
       '@clack/prompts':
         specifier: ^0.11.0
         version: 0.11.0
@@ -103,6 +104,9 @@ importers:
       grammy:
         specifier: ^1.39.2
         version: 1.39.2
+      hono:
+        specifier: 4.11.4
+        version: 4.11.4
       jiti:
         specifier: ^2.6.1
         version: 2.6.1
@@ -690,7 +694,7 @@ packages:
     resolution: {integrity: sha512-Shz/KjlIeAhfiuE93NDKVdZ7HdBVLQAfdbaXEaoAVO3ic9ibRSLGIQGkcBbFyuLr+7/1D5ZCINM8B+6IvXeMtw==}
     engines: {node: '>=18.14.1'}
     peerDependencies:
-      hono: ^4
+      hono: 4.11.4
 
   '@huggingface/jinja@0.5.3':
     resolution: {integrity: sha512-asqfZ4GQS0hD876Uw4qiUb7Tr/V5Q+JZuo2L+BtdrD4U40QU58nIRq3ZSgAzJgT874VLjhGVacaYfrdpXtEvtA==}
@@ -2703,8 +2707,8 @@ packages:
     resolution: {integrity: sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==}
     engines: {node: '>=12.0.0'}
 
-  hono@4.11.3:
-    resolution: {integrity: sha512-PmQi306+M/ct/m5s66Hrg+adPnkD5jiO6IjA7WhWw0gSBSo1EcRegwuI1deZ+wd5pzCGynCcn2DprnE4/yEV4w==}
+  hono@4.11.4:
+    resolution: {integrity: sha512-U7tt8JsyrxSRKspfhtLET79pU8K+tInj5QZXs1jSugO1Vq5dFj3kmZsRldo29mTBfcjDRVRXrEZ6LS63Cog9ZA==}
     engines: {node: '>=16.9.0'}
 
   hookified@1.15.0:
@@ -4639,14 +4643,14 @@ snapshots:
 
   '@borewit/text-codec@0.2.1': {}
 
-  '@buape/carbon@0.0.0-beta-20260110172854(hono@4.11.3)':
+  '@buape/carbon@0.0.0-beta-20260110172854(hono@4.11.4)':
     dependencies:
       '@types/node': 24.10.7
       discord-api-types: 0.38.36
     optionalDependencies:
       '@cloudflare/workers-types': 4.20251205.0
       '@discordjs/voice': 0.19.0
-      '@hono/node-server': 1.19.6(hono@4.11.3)
+      '@hono/node-server': 1.19.6(hono@4.11.4)
       '@types/bun': 1.3.3
       '@types/ws': 8.18.1
       ws: 8.18.3
@@ -4842,9 +4846,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@hono/node-server@1.19.6(hono@4.11.3)':
+  '@hono/node-server@1.19.6(hono@4.11.4)':
     dependencies:
-      hono: 4.11.3
+      hono: 4.11.4
     optional: true
 
   '@huggingface/jinja@0.5.3': {}
@@ -7015,8 +7019,7 @@ snapshots:
 
   highlight.js@11.11.1: {}
 
-  hono@4.11.3:
-    optional: true
+  hono@4.11.4: {}
 
   hookified@1.15.0: {}