[Zach Dunn (zachdunn)]

The API, auth, MCP, and Slack workers were still resolving Hono 4.13.3, which sits inside several open advisories. Transitive copies of @hono/node-server and undici were on vulnerable releases too. This moves every copy in the lockfile onto a patched version.

What it does

• Direct hono ranges in the API, auth, MCP, and Slack workers move from ^4.13.3 to ^4.13.13.
• Workspace overrides, next to the existing @modelcontextprotocol/sdk pin, force hono to ^4.13.13, @hono/node-server to ^1.19.15, undici@7 to ^7.29.1, and undici@8 to ^8.10.2.
• Application code is unchanged. There is no changeset: the apps are private, and @buildinternet/uploads does not declare these packages.

Advisories

Hono. Each of these is fixed in 4.13.11 or earlier:

• GHSA-5r4p-p66f-jhc7 — serveStatic bypass, fixed in 4.13.11
• GHSA-hxh3-vqpv-xpqv — JSX ErrorBoundary XSS, fixed in 4.13.7
• GHSA-g6gw-c38x-mqfc — parseBody memory exhaustion, fixed in 4.13.5
• GHSA-crvj-82cr-hjcx — query parser fragment, fixed in 4.13.5
• GHSA-gqvv-2mrq-wpjv — toSSG traversal, fixed in 4.13.5

@hono/node-server:

• GHSA-frvp-7c67-39w9 — Windows serve-static path traversal, fixed in 1.19.15

undici. Each of these is patched in 7.29.1 and 8.10.2:

• GHSA-pmjh-fq2x-6v4x — RetryHandler denial of service
• GHSA-2gqq-gqf2-x968 — dump interceptor response truncation
• GHSA-3xpg-4rpp-hhhm — unbounded decompression
• GHSA-8436-99hf-9mmv — cache replay of unsafe methods
• GHSA-w293-vg96-wgc3 — BalancedPool drops custom TLS checks

Resolved versions

Package	Before	After
hono	4.13.3	4.13.13
@hono/node-server	1.19.14	1.19.17
undici 7	7.29.0 and 7.29.1	7.29.1
undici 8	8.10.0	8.12.3

The @hono/node-server and undici 8 overrides are caret ranges, so the lockfile took the newest release that still satisfies them. Both are past the patched floors. The lockfile has no hono below 4.13.11, no @hono/node-server below 1.19.15, and no undici below 7.29.1 or 8.10.2.

Test plan

• pnpm typecheck
• pnpm lint and pnpm format:check
• pnpm changeset:lint, pnpm server-json:check, pnpm plugin-version:check, pnpm plugin-skills:check
• pnpm test (7617 passed, 2 skipped)
• pnpm --filter @buildinternet/uploads run pack:check
• pnpm --filter @uploads/mcp run bundle:check
• pnpm viewer:bundle:check
• CI on this pull request

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: 822579e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 2

• coderabbit:review
• review

🚫 Excluded labels (none allowed): 1

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e06332df-f7a6-4041-89c1-be03e903c94d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}