Skip to content

chore(deps): bump hono override to 4.13.7 to clear audit - #206

Merged
finalerock44 merged 1 commit into
devfrom
fix/audit-hono-4.13.7
Oct 1, 2026
Merged

finalerock44 merged 1 commit into
devfrom
fix/audit-hono-4.13.7

Conversation

@finalerock44

Copy link
Copy Markdown
Contributor

pnpm audit flagged GHSA-hxh3-vqpv-xpqv (hono/jsx XSS, moderate) on hono <4.13.7, pulled in via @modelcontextprotocol/sdk. It fails the lint-and-test audit step on the 5.7.0 promotion (#205).

What & why

Type of change

  • fix — bug fix
  • feat — new feature
  • perf — performance improvement
  • refactor — code change that's neither a fix nor a feature
  • docs — documentation only
  • chore / ci / build / test — tooling, no user-facing change
  • Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

  • PR title follows the Conventional Commits format (see comment above)
  • pnpm lint passes
  • pnpm typecheck passes
  • pnpm build passes
  • I have not bumped the version or edited CHANGELOG.md (release-please handles this)
  • I have signed the CLA (the bot will prompt on first contribution)
  • Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test

pnpm audit flagged GHSA-hxh3-vqpv-xpqv (hono/jsx XSS, moderate) on
hono <4.13.7, pulled in via @modelcontextprotocol/sdk. It fails the
lint-and-test audit step on the 5.7.0 promotion (#205).
@finalerock44 finalerock44 self-assigned this Oct 1, 2026
@finalerock44
finalerock44 merged commit 24f4283 into dev Oct 1, 2026
9 checks passed
@finalerock44
finalerock44 deleted the fix/audit-hono-4.13.7 branch October 1, 2026 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant