chore(deps): patch 8 Dependabot alerts (hono, fast-uri, ip-address)#237
Merged
Conversation
Resolves 8 open Dependabot alerts via pnpm.overrides on transitive deps. Versions pinned exactly (no caret) to satisfy the 7-day staleness policy. - hono ^4.12.14 → 4.12.18 (GHSA-69xw-7hcm-h432, GHSA-9vqf-7f2p-gf9v, GHSA-p77w-8qqv-26rm, GHSA-hm8q-7f3q-5f36, GHSA-qp7p-654g-cw7p) - fast-uri (new) → 3.1.2 (GHSA-q3j6-qgpj-74h6, GHSA-v39h-62p7-jpjc) - ip-address (new) → 10.1.1 (GHSA-v2v4-37r5-5v8g) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add labeled/unlabeled to pull_request types so applying bypass-age-gate re-runs the dependency-check job; without these, the action never sees the label until the next push. Lower min-age-days from 14 to 7 and set warn-age-days to 14. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
dines-rl
approved these changes
May 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 8 open Dependabot alerts by bumping three transitive deps via
pnpm.overrides. All target versions were published more than 7 days ago (per repo policy on avoiding bleeding-edge releases).All three are pulled in transitively:
fast-uri←ajv@8.18.0(already pinned via MCP SDK override)hono←@hono/node-server(override existed at^4.12.14; bumped to exact4.12.18)ip-address←express-rate-limit@8.3.2Pinning strategy
Versions are pinned exactly (no caret) on the three vuln-fix overrides to prevent
pnpm installfrom drifting forward into freshly-published releases — e.g.^4.12.18resolved to4.12.21(published today) on first try, so we tightened the range.Advisories addressed
VaryTest plan
pnpm installresolves to pinned versions (hono@4.12.18,fast-uri@3.1.2,ip-address@10.1.1)pnpm run build(tsc) passespnpm run lint— 0 errors (warnings pre-existing)pnpm test— 793/797 pass; 4 failures are pre-existing e2e tests that require a live API key (401 unrelated to deps)🤖 Generated with Claude Code