Bump @hono/node-server from 2.1.1 to 2.1.4

[dependabot]

Bumps @hono/node-server from 2.1.1 to 2.1.4.

Release notes

Sourced from @​hono/node-server's releases.

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

• ci: add autofix.ci by @​yusukebe in honojs/node-server#392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in honojs/node-server#390
• chore: add better benchmarks by @​BlankParticle in honojs/node-server#391
• docs(readme): update the benchmark by @​yusukebe in honojs/node-server#394
• test(request): accept asynchronous body read errors by @​usualoma in honojs/node-server#403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits

• d57ed9b 2.1.4
• 92b014c chore: allow hono v5 as a peer dependency (#406)
• 720ac78 2.1.3
• 9821792 Merge commit from fork
• 35bca95 2.1.2
• 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
• fe7467c test(request): accept asynchronous body read errors (#403)
• 64dc09e docs(readm): update the benchmark (#394)
• 8f505ae chore: add better benchmarks (#391)
• 2469b1a fix: type error in early hints and add typecheck to CI (#390)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fc4e8f44-6a05-427f-83d2-e0b256dc8595

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}