From a0e725556ba0a44ae5a19fadd2962e98f38ba8b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Tue, 20 Oct 2026 19:45:11 +0200 Subject: [PATCH] chore(deps): raise the hono floor to 4.13.11 --- pnpm-lock.yaml | 22 +++++++++++----------- pnpm-workspace.yaml | 5 +++-- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 6a9f052b4..4a51aab68 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: js-yaml@<4.3.2: ^4.3.2 - hono@<4.13.5: ^4.13.5 + hono@<4.13.11: ^4.13.11 baseline-browser-mapping@<2.11.0: ^2.11.0 sharp@<0.35.4: ^0.35.4 dompurify@<3.4.16: ^3.4.16 @@ -669,7 +669,7 @@ packages: resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==} engines: {node: '>=18.14.1'} peerDependencies: - hono: ^4.13.5 + hono: ^4.13.11 '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -4436,8 +4436,8 @@ packages: hermes-parser@0.25.1: resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==} - hono@4.13.7: - resolution: {integrity: sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==} + hono@4.13.13: + resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==} engines: {node: '>=16.9.0'} html-escaper@2.0.2: @@ -7382,9 +7382,9 @@ snapshots: '@hexagon/base64@1.1.28': {} - '@hono/node-server@1.19.17(hono@4.13.7)': + '@hono/node-server@1.19.17(hono@4.13.13)': dependencies: - hono: 4.13.7 + hono: 4.13.13 '@humanfs/core@0.19.2': dependencies: @@ -7581,7 +7581,7 @@ snapshots: '@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.17(hono@4.13.7) + '@hono/node-server': 1.19.17(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -7591,7 +7591,7 @@ snapshots: eventsource-parser: 3.1.1 express: 5.2.1(supports-color@7.2.0) express-rate-limit: 8.6.2(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0) - hono: 4.13.7 + hono: 4.13.13 jose: 6.2.12 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -7605,7 +7605,7 @@ snapshots: '@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.6.7)': dependencies: - '@hono/node-server': 1.19.17(hono@4.13.7) + '@hono/node-server': 1.19.17(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -7615,7 +7615,7 @@ snapshots: eventsource-parser: 3.1.1 express: 5.2.1(supports-color@7.2.0) express-rate-limit: 8.6.2(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0) - hono: 4.13.7 + hono: 4.13.13 jose: 6.2.12 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -11247,7 +11247,7 @@ snapshots: dependencies: hermes-estree: 0.25.1 - hono@4.13.7: {} + hono@4.13.13: {} html-escaper@2.0.2: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index e98b2596f..a699c5cd7 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,11 +1,12 @@ overrides: # CVE-2026-84375 (js-yaml < 4.3.2, HIGH), CVE-2026-84363/84364/84365 (hono - # < 4.13.5, via @hono/node-server under the MCP SDK), CVE-2026-45819 + # < 4.13.5, via @hono/node-server under the MCP SDK; GHSA-5r4p-p66f-jhc7 raised the + # floor to 4.13.11), CVE-2026-45819 # (baseline-browser-mapping < 2.11.0), GHSA-rgj7-g3m4-5g8c (sharp < 0.35.4, # pulled by next). None is a direct dependency; the bounds move the copies # the scanner flags and nothing else. "js-yaml@<4.3.2": "^4.3.2" - "hono@<4.13.5": "^4.13.5" + "hono@<4.13.11": "^4.13.11" "baseline-browser-mapping@<2.11.0": "^2.11.0" "sharp@<0.35.4": "^0.35.4" # GHSA-55q2-fjhq-7xh7: a crafted document gets past the sanitiser and its