From 58281055aac907604515e1e811a914ea2f3eb86f Mon Sep 17 00:00:00 2001 From: kikashy <35789537+kikashy@users.noreply.github.com> Date: Wed, 28 Oct 2026 20:24:22 -0400 Subject: [PATCH 1/2] Lock @hono/node-server at 2.1.5 for GHSA-rmxm-3fg6-px4f The MCP SDK pulls @hono/node-server (^1.19.9 || ^2.0.5); 2.1.1 is inside the advisory's range (serveStatic decodes the request path twice, bypassing middleware on static paths; patched in 2.1.3). Only the lockfile entry moves; the dependency audit passes on the lockfile. Co-Authored-By: Claude Opus 5.5 Signed-off-by: kikashy <35789537+kikashy@users.noreply.github.com> --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index b804f4ab..b40992e0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -821,15 +821,15 @@ } }, "node_modules/@hono/node-server": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz", - "integrity": "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==", + "version": "2.1.5", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.5.tgz", + "integrity": "sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==", "license": "MIT", "engines": { "node": ">=20" }, "peerDependencies": { - "hono": "^4" + "hono": "^4 || ^5.0.0-0" } }, "node_modules/@jridgewell/resolve-uri": { From be51f0c3699aca71490e69e37dd9a6518ec0f8ec Mon Sep 17 00:00:00 2001 From: kikashy <35789537+kikashy@users.noreply.github.com> Date: Wed, 28 Oct 2026 21:09:33 -0400 Subject: [PATCH 2/2] Regenerate the dependency inventory for @hono/node-server 2.1.5 Only the package's metadata record moves (version, integrity, the package.json evidence digest), refreshed from the locked install; every other record is unchanged. Co-Authored-By: Claude Opus 5.5 Signed-off-by: kikashy <35789537+kikashy@users.noreply.github.com> --- docs/dependencies.md | 6 +++--- scripts/dependencies-metadata.json | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/dependencies.md b/docs/dependencies.md index 932dbfcc..7586d7a2 100644 --- a/docs/dependencies.md +++ b/docs/dependencies.md @@ -195,7 +195,7 @@ Native membership: npm packages are not part of this Go package closure. Optiona | node_modules/@esbuild/win32-ia32 | 0.28.2 | development, optional | transitive | {"cpu":["ia32"],"os":["win32"]} | MIT | unknown: versioned package metadata does not declare publishing owner | unknown: versioned package.json unavailable | | node_modules/@esbuild/win32-x64 | 0.28.2 | development, optional | transitive | {"cpu":["x64"],"os":["win32"]} | MIT | unknown: versioned package metadata does not declare publishing owner | unknown: versioned package.json unavailable | | node_modules/@exodus/bytes | 1.15.1 | development | transitive | {"peerDependencies":{"@noble/hashes":"^1.8.0 || ^2.0.0"},"peerDependenciesMeta":{"@noble/hashes":{"optional":true}}} | MIT | unknown: versioned package metadata does not declare publishing owner | git+https://github.com/ExodusOSS/bytes.git | -| node_modules/@hono/node-server | 2.1.1 | runtime graph | transitive | {"peerDependencies":{"hono":"^4"}} | MIT | unknown: versioned package metadata does not declare publishing owner | git+https://github.com/honojs/node-server.git | +| node_modules/@hono/node-server | 2.1.5 | runtime graph | transitive | {"peerDependencies":{"hono":"^4 || ^5.0.0-0"}} | MIT | unknown: versioned package metadata does not declare publishing owner | git+https://github.com/honojs/node-server.git | | node_modules/@jridgewell/resolve-uri | 3.1.2 | development | transitive | {} | MIT | unknown: versioned package metadata does not declare publishing owner | https://github.com/jridgewell/resolve-uri | | node_modules/@jridgewell/sourcemap-codec | 1.6.0 | development | devDependencies | {} | MIT | unknown: versioned package metadata does not declare publishing owner | git+https://github.com/jridgewell/sourcemaps.git | | node_modules/@jridgewell/trace-mapping | 0.3.31 | development | transitive | {} | MIT | unknown: versioned package metadata does not declare publishing owner | git+https://github.com/jridgewell/sourcemaps.git | @@ -450,8 +450,8 @@ Metadata records bind exact module/version/sum or npm location/version/integrity - `go/go.mod`: `a5e7847150e3d021ba92d575887e3fac069ca012d940bb0a207ddfb8241dff99` - `go/go.sum`: `90154d6afad1d1c9111dfc54d4ce606142976ef83bb43d3866e587777a2c902d` -- `package-lock.json`: `c4440cf4db5fdcc86b2a803449954dcbd940629ed262193cfbb9f713ea44d944` +- `package-lock.json`: `745aa703a1ee8a9dd8467145efadc1a43018054c8fba5bc35a25c479cf1eb6af` - `scripts/dependencies-config.json`: `02fbaac28ac926d8abe15484f60c9f8c2833a188bf8c375d149568dddcb56a9b` -- `scripts/dependencies-metadata.json`: `3ea9e16a6740ebaf6b7c30233ff659835f845249e33530f25606afd7f2331fb7` +- `scripts/dependencies-metadata.json`: `0eaf54e569147df4c2a7fc2939133c14eae8015f15531e4c035075ff3d756bf1` Selected third-party modules: 77. npm installation entries: 296. diff --git a/scripts/dependencies-metadata.json b/scripts/dependencies-metadata.json index dfdc7341..2afabeab 100644 --- a/scripts/dependencies-metadata.json +++ b/scripts/dependencies-metadata.json @@ -2126,13 +2126,13 @@ }, "node_modules/@hono/node-server": { "binding": { - "integrity": "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==", - "version": "2.1.1" + "integrity": "sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==", + "version": "2.1.5" }, "evidence": [ { "file": "package.json", - "sha256": "66f3aa3ddef3a6b54c5b99ec22e76cc85b1f5bcabe9bb7849675edd0f7221553" + "sha256": "28b7c255c6c7ae6b994ceae9326211b6c6877c4746adb85b780b759ce1ceba41" } ], "license": "MIT",