From 9830acc295946485c0798d456b4d8b276e742db6 Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Tue, 8 Sep 2026 22:22:21 -0700 Subject: [PATCH] chore(ui): take the hono fixes both browser graphs were pinned away from MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `bun audit` fails the gate on three moderate advisories reaching both browser dependency graphs through @modelcontextprotocol/sdk's node server: a `toSSG()` path traversal, unbounded dot-notation nesting in `parseBody()`, and a query parser that reads past the URL fragment. All three are fixed in 4.13.5; the override held 4.12.34. Move both overrides to 4.13.7 and regenerate the notices inventory, which names the resolved version and is checked, not written, by the gate. None of this code runs in the browser bundles — the MCP SDK pulls the server half in transitively — but an advisory the gate can see is an advisory that stops every unrelated change until it is dealt with. Claude-Session: https://claude.ai/code/session_014UGBcvMuCtZnsTTdVoQgMo --- THIRD_PARTY_NOTICES | 4 ++-- ui/apps/bun.lock | 4 ++-- ui/apps/package.json | 2 +- ui/host/bun.lock | 4 ++-- ui/host/package.json | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/THIRD_PARTY_NOTICES b/THIRD_PARTY_NOTICES index f625a63a..fb81d3f6 100644 --- a/THIRD_PARTY_NOTICES +++ b/THIRD_PARTY_NOTICES @@ -194,7 +194,7 @@ COMPONENT INVENTORY - npm: hasown 2.0.4 (declared license: MIT) - npm: hast-util-to-jsx-runtime 2.3.6 (declared license: MIT) - npm: hast-util-whitespace 3.0.0 (declared license: MIT) -- npm: hono 4.12.34 (declared license: MIT) +- npm: hono 4.13.7 (declared license: MIT) - npm: html-url-attributes 3.0.1 (declared license: MIT) - npm: http-errors 2.0.1 (declared license: MIT) - npm: iconv-lite 0.7.3 (declared license: MIT) @@ -6563,7 +6563,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --- Applies to ------------------------------------------------------------- -- npm: hono 4.12.34 / LICENSE +- npm: hono 4.13.7 / LICENSE ---------------------------------------------------------------------------- MIT License diff --git a/ui/apps/bun.lock b/ui/apps/bun.lock index 1c8ae599..7a020448 100644 --- a/ui/apps/bun.lock +++ b/ui/apps/bun.lock @@ -30,7 +30,7 @@ "overrides": { "@hono/node-server": "1.19.15", "fast-uri": "3.1.7", - "hono": "4.12.34", + "hono": "4.13.7", "ip-address": "10.5.0", "nanoid": "3.3.18", }, @@ -243,7 +243,7 @@ "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="], - "hono": ["hono@4.12.34", "", {}, "sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA=="], + "hono": ["hono@4.13.7", "", {}, "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ=="], "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="], diff --git a/ui/apps/package.json b/ui/apps/package.json index 1a1af712..303192fe 100644 --- a/ui/apps/package.json +++ b/ui/apps/package.json @@ -36,7 +36,7 @@ "overrides": { "@hono/node-server": "1.19.15", "fast-uri": "3.1.7", - "hono": "4.12.34", + "hono": "4.13.7", "ip-address": "10.5.0", "nanoid": "3.3.18" } diff --git a/ui/host/bun.lock b/ui/host/bun.lock index 824e917e..12049091 100644 --- a/ui/host/bun.lock +++ b/ui/host/bun.lock @@ -38,7 +38,7 @@ "overrides": { "@hono/node-server": "1.19.15", "fast-uri": "3.1.7", - "hono": "4.12.34", + "hono": "4.13.7", "ip-address": "10.5.0", "nanoid": "3.3.18", }, @@ -437,7 +437,7 @@ "hast-util-whitespace": ["hast-util-whitespace@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw=="], - "hono": ["hono@4.12.34", "", {}, "sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA=="], + "hono": ["hono@4.13.7", "", {}, "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ=="], "html-url-attributes": ["html-url-attributes@3.0.1", "", {}, "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ=="], diff --git a/ui/host/package.json b/ui/host/package.json index 22f441b9..2906bd9a 100644 --- a/ui/host/package.json +++ b/ui/host/package.json @@ -43,7 +43,7 @@ "overrides": { "@hono/node-server": "1.19.15", "fast-uri": "3.1.7", - "hono": "4.12.34", + "hono": "4.13.7", "ip-address": "10.5.0", "nanoid": "3.3.18" }