fix(devbox): fixed log flashing on some terminals - #78
Merged
Conversation
dines-rl
pushed a commit
that referenced
this pull request
Jan 27, 2026
🤖 I have created a release *beep* *boop* --- ## [1.7.1](v1.7.0...v1.7.1) (2026-01-27) ### Bug Fixes * **devbox:** fixed log flashing on some terminals ([#78](#78)) ([8107796](8107796)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mrw-rl
added a commit
that referenced
this pull request
Jun 8, 2026
## What Bumps the pnpm `hono` override `4.12.18` → `4.12.24` to clear four medium Dependabot alerts (#76–#79), all fixed in hono **4.12.21**: | Alert | GHSA | Issue | |-------|------|-------| | #76 | `GHSA-f577-qrjj-4474` | JWT middleware accepts any `Authorization` scheme, not just Bearer | | #77 | `GHSA-xrhx-7g5j-rcj5` | IP restriction bypasses static deny rules for non-canonical IPv6 | | #78 | `GHSA-2gcr-mfcq-wcc3` | `app.mount()` strips prefix using undecoded path → mis-routing on percent-encoded paths | | #79 | `GHSA-3hrh-pfw6-9m5x` | Cookie helper does not sanitize `sameSite`/`priority` → Set-Cookie injection | ## Why this approach `hono` is purely transitive (`@modelcontextprotocol/sdk` → `@hono/node-server`) and already governed by the pnpm `overrides` block, so a single pin bump is the clean fix. Targeting `4.12.24` (latest in the same minor line) rather than the minimum `4.12.21` — all patch-level releases, a superset of the fixes, zero breaking surface. Peer ranges accept it: `@hono/node-server` wants `^4`, the MCP SDK wants `^4.11.4`. Lockfile resolves `hono@4.12.24` at every site with no stragglers below the patched floor. ## Verification - `pnpm run build` (tsc) → clean - Tests: 800/804 pass. The 4 failures are the live-API `scp`/`rsync` e2e suite failing on `401` (no API key in CI/sandbox) — unrelated to this change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Note: PR titles should follow Conventional Commits format (e.g.,
feat(devbox): add support for custom env varsorfix(snapshot): resolve pagination issue) as they are used for automatic release notes generation.Type of Change
Related Issues
Closes #
Changes Made
Testing
Checklist
Screenshots (if applicable)
Additional Notes