[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the npm_and_yarn group with 2 updates in the /sdk/typescript/integration/fixtures/mastra-0 directory: @ai-sdk/provider-utils and @hono/node-server.

Removes @ai-sdk/provider-utils

Updates @hono/node-server from 2.1.1 to 2.1.6

Release notes

Sourced from @​hono/node-server's releases.

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

... (truncated)

Commits

• 123f782 2.1.6
• cfaa79f Merge commit from fork
• 61cc026 Merge commit from fork
• a152a45 test: wait for the first chunk before sending the second in the readable-stre...
• fb97395 Merge commit from fork
• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• d57ed9b 2.1.4
• 92b014c chore: allow hono v5 as a peer dependency (#406)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4d62270d-be73-4b0c-8dab-6d0523d9c6dc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Thanks @dependabot[bot] for keeping our dependencies current! 🙌

[github-actions]

Automated approval for Dependabot dependency update.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​mastra/​memory@​0.15.13 ⏵ 1.40.0	+1		+16		-19

View full report

[hermes-exosphere]

pr-autopilot will not merge this automatically (commit a4f5277).

Why:

• 7283 changed lockfile lines (limit 6000)
• the title says 2 updates but only 1 could be read

A person needs to review and merge it.

_{pr-autopilot · Codex in a locked-down container · traced by failproofai}

[NiveditJain]

Closing, as SECURITY.md says to for a PR that moves a pin. This moves @mastra/core from 0.24.9 to 1.81.0, off the floor mastra-0 exists to hold: the same move as #955, reopened before #966 merged.

#966 cleared this fixture's fixable advisories without the move, and gave @ai-sdk/provider-utils its own ignore range. Dependabot's job for this PR on the merged config now ends in all_versions_ignored.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml