fix: update hono to 4.13.13 in the conformance harness lockfile for GHSA-5r4p-p66f-jhc7 #837
No reviewers
Labels
No labels
breaking
bug
documentation
enhancement
epic
good first issue
help wanted
refactoring
resolution/duplicate
resolution/invalid
resolution/wontfix
security
severity/critical
severity/high
severity/low
severity/medium
status/abandoned
status/blocked
status/needs-decision
status/needs-info
status/needs-verification
testing
upstream
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
sixfold-space/madtea!837
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix-hono-ghsa-5r4p"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
The gate's osv-scanner step fails on main. It reports GHSA-5r4p-p66f-jhc7 (CVSS 5.3) against hono 4.13.9 in
conformance/mcp-client/package-lock.json. The fixed version is 4.13.11.hono is a transitive dependency of the MCP conformance harness. It comes in through
@modelcontextprotocol/sdk(^4.11.4) and@hono/node-server(^4). I updated only the lockfile, withnpm update hono --package-lock-only --ignore-scripts. That moves hono to 4.13.13, the newest version in both ranges.package.jsondoes not change../scripts/gate.shpasses on this commit, osv-scanner included.