tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-14 14:40:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): raise the hono floor to 4.13.16

Browse Source
This commit is contained in:
Marc-André Bombeck committed 2026-11-14 08:25:58 +01:00
1 parent deb7db2ffa
commit 1c247f27e3
3 files changed
+19 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+8
View File
@@ -2,6 +2,14 @@
## [Unreleased]
### Security
- The `hono` dependency floor is raised to 4.13.16 (CVE-2026-126355 to
CVE-2026-126358). HealthLog only gets it under the MCP SDK and loads none
of the affected parts (CSRF and validator middleware, `mount`, the
RegExpRouter), so this clears the audit rather than closing a reachable
hole.
## [1.47.5] — 2026-11-12
### Fixed
pnpm-lock.yaml
Generated
+9 -9
View File
@@ -6,7 +6,7 @@ settings:
overrides:
js-yaml@<4.3.2: ^4.3.2
hono@<4.13.11: ^4.13.11
hono@<4.13.16: ^4.13.16
baseline-browser-mapping@<2.11.0: ^2.11.0
sharp@<0.35.4: ^0.35.4
dompurify@<3.4.17: ^3.4.17
@@ -875,7 +875,7 @@ packages:
resolution: {integrity: sha512-p/KH9MnfNcsm3sR6x4lNgm5j+QN4Et8srKredl9DZfXiyZ1UQ3aQ2YVpFLbqktYN5JI+DB+VZFKM2PqE5hLKjQ==}
engines: {node: '>=20'}
peerDependencies:
hono: ^4.13.11
hono: ^4.13.16
'@humanfs/core@0.19.2':
resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
@@ -4754,8 +4754,8 @@ packages:
hermes-parser@0.25.1:
resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
hono@4.13.13:
resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==}
hono@4.13.18:
resolution: {integrity: sha512-H9q/E1XizaWstJxUW881dmLxEj+t/TrGGnyxINkm4+sK0qUwsMtFdo2BWI9Vs3cIS19MU6b6iCijoUoEf4f3DA==}
engines: {node: '>=16.9.0'}
html-escaper@2.0.2:
@@ -7999,9 +7999,9 @@ snapshots:
'@hexagon/base64@1.1.28': {}
'@hono/node-server@2.1.6(hono@4.13.13)':
'@hono/node-server@2.1.6(hono@4.13.18)':
dependencies:
hono: 4.13.13
hono: 4.13.18
'@humanfs/core@0.19.2':
dependencies:
@@ -8294,7 +8294,7 @@ snapshots:
'@modelcontextprotocol/sdk@1.32.2(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.6.7)':
dependencies:
'@hono/node-server': 2.1.6(hono@4.13.13)
'@hono/node-server': 2.1.6(hono@4.13.18)
ajv: 8.20.0
ajv-formats: 3.0.1(ajv@8.20.0)
content-type: 1.0.5
@@ -8304,7 +8304,7 @@ snapshots:
eventsource-parser: 3.1.1
express: 5.2.1(supports-color@7.2.0)
express-rate-limit: 8.6.2(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0)
hono: 4.13.13
hono: 4.13.18
jose: 6.2.15
json-schema-typed: 8.0.2
pkce-challenge: 5.0.1
@@ -12043,7 +12043,7 @@ snapshots:
dependencies:
hermes-estree: 0.25.1
hono@4.13.13: {}
hono@4.13.18: {}
html-escaper@2.0.2: {}
pnpm-workspace.yaml
+2 -2
View File
@@ -1,12 +1,12 @@
overrides:
# CVE-2026-84375 (js-yaml < 4.3.2, HIGH), CVE-2026-84363/84364/84365 (hono
# < 4.13.5, via @hono/node-server under the MCP SDK; GHSA-5r4p-p66f-jhc7 raised the
# floor to 4.13.11), CVE-2026-45819
# floor to 4.13.11, CVE-2026-126355 to 126358 to 4.13.16), CVE-2026-45819
# (baseline-browser-mapping < 2.11.0), GHSA-rgj7-g3m4-5g8c (sharp < 0.35.4,
# pulled by next). None is a direct dependency; the bounds move the copies
# the scanner flags and nothing else.
"js-yaml@<4.3.2": "^4.3.2"
"hono@<4.13.11": "^4.13.11"
"hono@<4.13.16": "^4.13.16"
"baseline-browser-mapping@<2.11.0": "^2.11.0"
"sharp@<0.35.4": "^0.35.4"
# GHSA-55q2-fjhq-7xh7: a crafted document gets past the sanitiser and its