From 41f90bac3f07434f3b99a77656c8162bc8a3e86d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 4 Nov 2026 16:56:20 +0100 Subject: [PATCH] chore(deps): move @hono/node-server to 2.x and lift systeminformation The serveStatic double decode has no fix on the 1.x line, and the MCP SDK accepts 2.x. The app uses the web-standard transport and never loads it. systeminformation sits under the shadcn CLI at dev time. --- CHANGELOG.md | 8 ++++++++ Dockerfile | 2 +- pnpm-lock.yaml | 21 +++++++++++---------- pnpm-workspace.yaml | 17 ++++++++++------- 4 files changed, 30 insertions(+), 18 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3dc9b4ba1..b545980e5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,14 @@ - Dependabot no longer proposes a new Node major for the image. The major is tied to `engines`, `.nvmrc` and `.node-version` and moves by hand. +### Security + +- `@hono/node-server` moves to the 2.x line, which fixes a second decode of + the request path in `serveStatic`. It arrives under the MCP SDK; the app + uses the SDK's web-standard transport and never loads it, but the copy + was in the tree. `systeminformation`, under the shadcn CLI at dev time, + moves past a Windows command injection. + ## [1.47.0] — 2026-11-04 ### Added diff --git a/Dockerfile b/Dockerfile index e5adabd18..90654a917 100644 --- a/Dockerfile +++ b/Dockerfile @@ -133,7 +133,7 @@ RUN mkdir -p /opt/prisma-cli && \ npm init -y && \ npm pkg set 'overrides.deepmerge-ts=^8.0.0' && \ npm pkg set 'overrides.mysql2=^3.22.0' && \ - npm pkg set 'overrides.@hono/node-server=^1.19.15' && \ + npm pkg set 'overrides.@hono/node-server=^2.1.3' && \ npm pkg set 'overrides.valibot=^1.4.2' && \ npm pkg set 'allowScripts.@prisma/engines=true' 'allowScripts.prisma=true' 'allowScripts.esbuild=true' --json && \ npm install --omit=dev prisma@7.10.1 @prisma/engines@7.10.1 tsx@4.23.1 dotenv@18.0.9 --no-fund --no-audit diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 48d7a9ff6..aace7cce0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -12,12 +12,13 @@ overrides: dompurify@<3.4.17: ^3.4.17 postcss@<8.5.23: ^8.5.23 nanoid@<3.3.18: ^3.3.18 - '@hono/node-server@<1.19.15': ^1.19.15 + '@hono/node-server@<2.1.3': ^2.1.3 picomatch@<4.0.4: ^4.0.4 body-parser@<2.4.0: ^2.4.0 source-map-js@<1.2.2: ^1.2.2 postcss-selector-parser@<7.1.6: ^7.1.6 smol-toml@<1.9.0: ^1.9.0 + systeminformation@<5.33.16: ^5.33.16 qs@<6.16.0: ^6.16.0 fast-uri@<3.1.9: ^3.1.9 flatted@<3.4.2: ^3.4.2 @@ -870,9 +871,9 @@ packages: '@hexagon/base64@1.1.28': resolution: {integrity: sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==} - '@hono/node-server@1.19.17': - resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==} - engines: {node: '>=18.14.1'} + '@hono/node-server@2.1.6': + resolution: {integrity: sha512-p/KH9MnfNcsm3sR6x4lNgm5j+QN4Et8srKredl9DZfXiyZ1UQ3aQ2YVpFLbqktYN5JI+DB+VZFKM2PqE5hLKjQ==} + engines: {node: '>=20'} peerDependencies: hono: ^4.13.11 @@ -6679,8 +6680,8 @@ packages: resolution: {integrity: sha512-qsjeeq5YjBZ5eMdFuUa4ZosMLxgr5RZ+F+Y1OrDhuOCEInRMA3x74XdBtggJcj9kOeInz0WE+LgCPDkZFlBYJw==} engines: {node: '>=12.0.0'} - systeminformation@5.33.15: - resolution: {integrity: sha512-s5RloL0F7xhN0ZjfHtLGnbf7EW74EI0N8NFL+1xR7Oxz9QA33obNZsl7lyfnJOhN04E/kGFPoJPlvY7TZ5fzmw==} + systeminformation@5.33.19: + resolution: {integrity: sha512-Zm7wGeCG7PqfvzegMJIzrxICopWqYCeLATVmvxOOci1isLcNVKgY4Fr0hhYQzvc7cgtK3377jQVChTFAnznOiA==} engines: {node: '>=10.0.0'} os: [darwin, linux, win32, freebsd, openbsd, netbsd, sunos, android] hasBin: true @@ -7925,7 +7926,7 @@ snapshots: object-treeify: 1.1.33 open: 8.4.2 picomatch: 4.0.7 - systeminformation: 5.33.15 + systeminformation: 5.33.19 undici: 7.30.1 which: 4.0.0 yocto-spinner: 1.2.2 @@ -8079,7 +8080,7 @@ snapshots: '@hexagon/base64@1.1.28': {} - '@hono/node-server@1.19.17(hono@4.13.13)': + '@hono/node-server@2.1.6(hono@4.13.13)': dependencies: hono: 4.13.13 @@ -8374,7 +8375,7 @@ snapshots: '@modelcontextprotocol/sdk@1.32.2(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.6.7)': dependencies: - '@hono/node-server': 1.19.17(hono@4.13.13) + '@hono/node-server': 2.1.6(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -14105,7 +14106,7 @@ snapshots: svg-pathdata@6.0.3: optional: true - systeminformation@5.33.15: {} + systeminformation@5.33.19: {} tagged-tag@1.0.0: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index f716b3daf..0d63e5b6d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -22,13 +22,13 @@ overrides: # bump; the fix landed in 8.5.23. "postcss@<8.5.23": "^8.5.23" "nanoid@<3.3.18": "^3.3.18" - # GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. Mirrored for - # /opt/prisma-cli in the Dockerfile, which is where the flagged 1.19.11 - # actually landed: prisma pulls it through @prisma/dev, and that install - # reads npm `overrides`, not this file. The bound stays on the 1.x line - # because the advisory is fixed there too and 2.x is a major nothing asked - # for. - "@hono/node-server@<1.19.15": "^1.19.15" + # GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. The + # serveStatic double decode fixed in 2.1.3 has no fix on the 1.x line, so + # the bound moves to 2.x, which the MCP SDK accepts (`^1.19.9 || ^2.0.5`). + # The app never calls serveStatic; the copy sits on the MCP path all the + # same. Mirrored for /opt/prisma-cli in the Dockerfile, where an older + # @prisma/dev once pulled it in. + "@hono/node-server@<2.1.3": "^2.1.3" "picomatch@<4.0.4": "^4.0.4" # CVE-2026-111181 (HIGH) raised the floor from 2.3.0. The copy arrives # under express in the MCP SDK, on a production path. @@ -40,6 +40,9 @@ overrides: "source-map-js@<1.2.2": "^1.2.2" "postcss-selector-parser@<7.1.6": "^7.1.6" "smol-toml@<1.9.0": "^1.9.0" + # Command injection through services() on Windows, under shadcn's CLI at + # dev time only. 5.33.16 has the fix. + "systeminformation@<5.33.16": "^5.33.16" # Array-limit bypass through bracket-key comma parsing, and a denial of # service through an attacker-controlled isBuffer. 6.16.0 covers both. "qs@<6.16.0": "^6.16.0"