Repository navigation
fix(deps): bump hono to 4.13.17 for five advisories - #908
Merged
Merged
Conversation
GitHub opened five Dependabot alerts on Nov 13 for hono below 4.13.16: GHSA-h7mg-cq63-vhpq and GHSA-4m76-xfj5-7975 (middleware bypass in the router and in mount()), GHSA-4h7h-rv7c-7m2v (form validation skipped), GHSA-46wx-v44x-9hh2 (csrf() and text/ping) and GHSA-3gg2-335m-rxc6 (HTML injection in the css helper). hono is not ours. It comes in as a peer of @hono/node-server, under @modelcontextprotocol/sdk, and nothing in Threadlines imports it. The desktop app does not ship it at all: none of the 5,216 script files in nightly 0.10.1-nightly.20261113.383 contain hono code. So this only moves the version the repo installs for development and tests, from 4.13.13 to 4.13.17 (six days old; 4.13.18 is under three). Only the lockfile changes: the parents' ranges already allow the fixed version, so no override is left behind.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
GitHub opened five Dependabot alerts on Nov 13 (#90 to #94) for
honobelow 4.13.16: two middleware bypasses (GHSA-h7mg-cq63-vhpq in the router, GHSA-4m76-xfj5-7975 inmount()), skipped form validation (GHSA-4h7h-rv7c-7m2v),csrf()missingtext/pingrequests (GHSA-46wx-v44x-9hh2) and HTML injection in thecsshelper (GHSA-3gg2-335m-rxc6).honois not ours. It comes in as a peer of@hono/node-server, under@modelcontextprotocol/sdk, and nothing in Threadlines imports it. The desktop app does not ship it at all: none of the 5,216 script files in nightly0.10.1-nightly.20261113.383contain hono code. The alerts are about the version the repo installs for development and tests.Fix
The lockfile moves
honofrom 4.13.13 to 4.13.17 (six days old; 4.13.18 is under three). Onlypnpm-lock.yamlchanges: the parents' ranges already allow the fixed version, so it was moved with a temporary override and no pin is left behind.Checks:
vp fmt,vp lint,vp run typecheck, and the server test that uses the MCP SDK (oauthHttp).