From 78a839f1bdd33cee2d979bda565ea2bc1f294052 Mon Sep 17 00:00:00 2001 From: finalerock44 Date: Thu, 1 Oct 2026 16:42:30 +0100 Subject: [PATCH] chore(deps): bump hono override to 4.13.7 to clear audit pnpm audit flagged GHSA-hxh3-vqpv-xpqv (hono/jsx XSS, moderate) on hono <4.13.7, pulled in via @modelcontextprotocol/sdk. It fails the lint-and-test audit step on the 5.7.0 promotion (#205). --- package.json | 2 +- pnpm-lock.yaml | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index f630240..4eef9c6 100644 --- a/package.json +++ b/package.json @@ -111,7 +111,7 @@ "esbuild@<0.28.1": ">=0.28.1", "qs@<6.16.0": "6.16.0", "fast-uri@>=3.0.0 <3.1.8": "3.1.8", - "hono@>=4.0.0 <4.13.5": "4.13.5", + "hono@>=4.0.0 <4.13.7": "4.13.7", "micromatch>picomatch": "^2.3.2", "tinyglobby>picomatch": "^4.0.4" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 07fea09..07a3d88 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -31,7 +31,7 @@ overrides: esbuild@<0.28.1: '>=0.28.1' qs@<6.16.0: 6.16.0 fast-uri@>=3.0.0 <3.1.8: 3.1.8 - hono@>=4.0.0 <4.13.5: 4.13.5 + hono@>=4.0.0 <4.13.7: 4.13.7 micromatch>picomatch: ^2.3.2 tinyglobby>picomatch: ^4.0.4 @@ -353,7 +353,7 @@ packages: resolution: {integrity: sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==} engines: {node: '>=20'} peerDependencies: - hono: 4.13.5 + hono: 4.13.7 '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -979,8 +979,8 @@ packages: resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} engines: {node: '>= 0.4'} - hono@4.13.5: - resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==} + hono@4.13.7: + resolution: {integrity: sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==} engines: {node: '>=16.9.0'} hookified@1.15.1: @@ -1778,9 +1778,9 @@ snapshots: '@eslint/core': 1.2.1 levn: 0.4.1 - '@hono/node-server@2.1.1(hono@4.13.5)': + '@hono/node-server@2.1.1(hono@4.13.7)': dependencies: - hono: 4.13.5 + hono: 4.13.7 '@humanfs/core@0.19.2': dependencies: @@ -1812,7 +1812,7 @@ snapshots: '@modelcontextprotocol/sdk@1.30.1(zod@4.6.5)': dependencies: - '@hono/node-server': 2.1.1(hono@4.13.5) + '@hono/node-server': 2.1.1(hono@4.13.7) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -1822,7 +1822,7 @@ snapshots: eventsource-parser: 3.1.1 express: 5.2.1 express-rate-limit: 8.7.0(express@5.2.1) - hono: 4.13.5 + hono: 4.13.7 jose: 6.2.12 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -2506,7 +2506,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.13.5: {} + hono@4.13.7: {} hookified@1.15.1: {}