v4.12.21

## Security fixes

This release includes fixes for the following security issues:

### app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Affects: `app.mount()`. Fixes prefix stripping using the raw URL pathname instead of the decoded path, where percent-encoded characters in the mount prefix or path could cause the prefix to be removed at the wrong position, resulting in the sub-application receiving an incorrect path. GHSA-2gcr-mfcq-wcc3

### IP Restriction bypasses static deny rules for non-canonical IPv6

Affects: `hono/ip-restriction`. Fixes IP address comparison using string equality, where non-canonical IPv6 representations of a denied address — such as compressed forms or hex-notation IPv4-mapped addresses — could bypass static deny rules. GHSA-xrhx-7g5j-rcj5

### Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Affects: `hono/cookie`. Fixes missing validation of `sameSite` and `priority` options against injection characters (`;`, `\r`, `\n`), where user-controlled input passed to either option could inject additional attributes into the Set-Cookie response header. GHSA-3hrh-pfw6-9m5x

### JWT middleware accepts any Authorization scheme, not only Bearer

Affects: `hono/jwt`, `hono/jwk`. Fixes missing scheme validation in the Authorization header, where any two-part header value was accepted regardless of the scheme name, allowing non-Bearer schemes to pass JWT authentication. GHSA-f577-qrjj-4474

---

Users who use `app.mount()`, `hono/ip-restriction`, `hono/cookie`, or `hono/jwt`/`hono/jwk` are encouraged to upgrade to this version.