Repository navigation
fix(deps): patch transitive Hono audit vulnerability - #583
Merged
Merged
Conversation
Resolve Hono 4.13.11 within existing SDK dependency ranges, clearing GHSA-5r4p-p66f-jhc7 without changing the shipped bundle.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Patch transitive Hono from 4.13.8 to 4.13.11, clearing the moderate static-path middleware advisory that blocks the release audit. Only one generated lockfile record changes; existing dependency ranges, audit exceptions and manifests are unchanged.
Related: #576
Validation: configured root audit reproduced one moderate finding before the update and zero afterward; both root/docs frozen installs and audits pass. MCP/runtime/OAuth tests: 100 passed, 0 failed. Typecheck, lint, schema, build, package budgets and 54 isolated packed Node help invocations pass. Built JavaScript and notices are byte-identical to main's baseline; no new runtime behavior or package growth.
bun install --frozen-lockfile bun audit --audit-level=moderate --ignore GHSA-hp3w-g68c-fv3c bun install --cwd docs --frozen-lockfile bun audit --cwd docs --audit-level=moderate --ignore GHSA-hp3w-g68c-fv3c bun test tests/unit/core/mcp-http-stdio-proxy.test.ts tests/unit/core/mcp-runtime.test.ts tests/unit/core/mcp-proxy.test.ts tests/e2e/mcp-runtime-cli.test.ts tests/e2e/mcp-runtime-stdio-cli.test.ts tests/e2e/mcp-proxy-oauth.test.ts bun run typecheck bun run lint bun run schema:check bun run build bun run package:check bun run package:smokeCode review: skipped (mechanical diff) — one generated dependency record; the version, compatible ranges, integrity and unchanged bundle were independently checked.