Skip to content

Commit 973777f

Browse files
committed
fix(deps): drop @hono/node-server override to patch GHSA-wc8c-qw6v-h7f6
The override pinning @hono/node-server to 1.19.7 was added in 7197610 as a workaround when @modelcontextprotocol/sdk 1.25.3 required ^1.19.9, which did not yet exist on the public npm registry. That constraint is now obsolete: the SDK is pinned to 1.25.2 (requires ^1.19.7), and 1.19.8-1.19.11 have since been published. Removing the override lets npm naturally resolve 1.19.11, which includes the fix for the HIGH-severity auth bypass in the Serve Static middleware (GHSA-wc8c-qw6v-h7f6, fixed in 1.19.10). Lockfile regenerated against registry.npmjs.org (no artifactory URLs).
1 parent 6b12fff commit 973777f

2 files changed

Lines changed: 3 additions & 4 deletions

File tree

package-lock.json

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,6 @@
121121
"seroval": "1.4.1",
122122
"seroval-plugins": "1.4.2",
123123
"solid-js": "1.9.10",
124-
"@hono/node-server": "1.19.7",
125124
"@types/node": "20.19.27"
126125
}
127126
}

0 commit comments

Comments
 (0)