diff --git a/apps/api/package.json b/apps/api/package.json
index b7272c0..1cceba5 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -24,7 +24,7 @@
     "@sublistme/db": "workspace:*",
     "arctic": "^3.7.0",
     "drizzle-orm": "^0.38.3",
-    "hono": "^4.11.7",
+    "hono": "^4.12.18",
     "lucia": "^3.2.2",
     "oslo": "^1.2.1",
     "zod": "^4.3.6"
diff --git a/apps/web/package.json b/apps/web/package.json
index 8c0eb74..0e7b71e 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -18,7 +18,7 @@
     "@tanstack/react-table": "^8.21.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "hono": "^4.11.7",
+    "hono": "^4.12.18",
     "lucide-react": "^0.469.0",
     "next": "16.1.5",
     "next-intl": "^4.7.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 938d99c..b79fd2e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -28,7 +28,7 @@ importers:
     dependencies:
       '@hono/zod-validator':
         specifier: ^0.7.6
-        version: 0.7.6(hono@4.11.7)(zod@4.3.6)
+        version: 0.7.6(hono@4.12.18)(zod@4.3.6)
       '@lucia-auth/adapter-sqlite':
         specifier: ^3.0.2
         version: 3.0.2(lucia@3.2.2)
@@ -42,8 +42,8 @@ importers:
         specifier: ^0.38.3
         version: 0.38.4(@cloudflare/workers-types@4.20260101.0)(@types/react@19.2.7)(react@19.2.3)
       hono:
-        specifier: ^4.11.7
-        version: 4.11.7
+        specifier: ^4.12.18
+        version: 4.12.18
       lucia:
         specifier: ^3.2.2
         version: 3.2.2
@@ -109,8 +109,8 @@ importers:
         specifier: ^2.1.1
         version: 2.1.1
       hono:
-        specifier: ^4.11.7
-        version: 4.11.7
+        specifier: ^4.12.18
+        version: 4.12.18
       lucide-react:
         specifier: ^0.469.0
         version: 0.469.0(react@19.2.3)
@@ -2704,6 +2704,7 @@ packages:
 
   glob@10.5.0:
     resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
 
   has-flag@4.0.0:
@@ -2714,8 +2715,8 @@ packages:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
-  hono@4.11.7:
-    resolution: {integrity: sha512-l7qMiNee7t82bH3SeyUCt9UF15EVmaBvsppY2zQtrbIhl/yzBTny+YUxsVjSjQ6gaqaeVtZmGocom8TzBlA4Yw==}
+  hono@4.12.18:
+    resolution: {integrity: sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==}
     engines: {node: '>=16.9.0'}
 
   html-escaper@2.0.2:
@@ -3970,9 +3971,9 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@hono/zod-validator@0.7.6(hono@4.11.7)(zod@4.3.6)':
+  '@hono/zod-validator@0.7.6(hono@4.12.18)(zod@4.3.6)':
     dependencies:
-      hono: 4.11.7
+      hono: 4.12.18
       zod: 4.3.6
 
   '@img/colour@1.0.0': {}
@@ -5363,7 +5364,7 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
-  hono@4.11.7: {}
+  hono@4.12.18: {}
 
   html-escaper@2.0.2: {}