Skip to content

chore: upgrade hono to ^4.12.25 to address CVE-2026-54290#1317

Closed
brendan-kellam wants to merge 1 commit into
mainfrom
linear/sou-1340-sourcebot-devsourcebot-cve-2026-54290-hono-cors-ad1e
Closed

chore: upgrade hono to ^4.12.25 to address CVE-2026-54290#1317
brendan-kellam wants to merge 1 commit into
mainfrom
linear/sou-1340-sourcebot-devsourcebot-cve-2026-54290-hono-cors-ad1e

Conversation

@brendan-kellam

@brendan-kellam brendan-kellam commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Fixes SOU-1340

Refreshes the hono lockfile entry to 4.12.25 to address CVE-2026-54290, where the CORS middleware reflects any Origin with Access-Control-Allow-Credentials: true when credentials: true and no explicit origin is set.

hono is a transitive dependency (@modelcontextprotocol/sdk → hono, also via @react-grab/mcp). The existing ^4.11.4 ranges already admit the patched version, so this is a lockfile refresh via yarn up -R hono — no package.json or resolutions change. Verified all instances are now 4.12.25 with yarn why hono --recursive.

@coderabbitai

coderabbitai Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 15a1f63b-3420-4ead-b2fd-a56e5af5789c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch linear/sou-1340-sourcebot-devsourcebot-cve-2026-54290-hono-cors-ad1e

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@brendan-kellam brendan-kellam force-pushed the linear/sou-1340-sourcebot-devsourcebot-cve-2026-54290-hono-cors-ad1e branch from 291e6ac to ab62128 Compare June 17, 2026 22:20
@github-actions

github-actions Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️ Status: PASS

Metric Count
Total packages 2136
Resolved (non-standard) 20
Unresolved 0
Strong copyleft 0
Weak copyleft 39

Weak Copyleft Packages (informational)

Package Version License
@img/sharp-libvips-darwin-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm 1.0.5 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-wasm32 0.33.5 Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-wasm32 0.34.5 Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32 0.33.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64 0.33.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
axe-core 4.10.3 MPL-2.0
dompurify 3.4.0 (MPL-2.0 OR Apache-2.0)
lightningcss 1.32.0 MPL-2.0
lightningcss-android-arm64 1.32.0 MPL-2.0
lightningcss-darwin-arm64 1.32.0 MPL-2.0
lightningcss-darwin-x64 1.32.0 MPL-2.0
lightningcss-freebsd-x64 1.32.0 MPL-2.0
lightningcss-linux-arm-gnueabihf 1.32.0 MPL-2.0
lightningcss-linux-arm64-gnu 1.32.0 MPL-2.0
lightningcss-linux-arm64-musl 1.32.0 MPL-2.0
lightningcss-linux-x64-gnu 1.32.0 MPL-2.0
lightningcss-linux-x64-musl 1.32.0 MPL-2.0
lightningcss-win32-arm64-msvc 1.32.0 MPL-2.0
lightningcss-win32-x64-msvc 1.32.0 MPL-2.0
Resolved Packages (20)
Package Version Original Resolved Source
memorystream 0.3.1 UNKNOWN MIT npm registry (registry.npmjs.org) licenses object — {"type":"MIT"}
map-stream 0.1.0 UNKNOWN MIT npm registry (registry.npmjs.org) license field
codemirror-lang-elixir 4.0.0 UNKNOWN Apache-2.0 npm registry (registry.npmjs.org) license field
lezer-elixir 1.1.2 UNKNOWN Apache-2.0 npm registry (registry.npmjs.org) license field
valid-url 1.0.9 UNKNOWN MIT GitHub repo LICENSE (ogt/valid-url)
element-source 0.0.3 UNKNOWN MIT GitHub repo LICENSE (aidenybai/element-source)
@react-grab/cli 0.1.23 UNKNOWN MIT GitHub monorepo LICENSE (aidenybai/react-grab; package.json omits license field)
@react-grab/cli 0.1.29 UNKNOWN MIT GitHub monorepo LICENSE (aidenybai/react-grab; package.json omits license field)
@react-grab/mcp 0.1.29 UNKNOWN MIT GitHub monorepo LICENSE (aidenybai/react-grab; package.json omits license field)
pause-stream 0.0.11 ["MIT","Apache2"] (MIT OR Apache-2.0) extracted from license array (npm registry licenses field); "Apache2" normalized to Apache-2.0
posthog-js 1.369.0 SEE LICENSE IN LICENSE Apache-2.0 AND MIT GitHub repo LICENSE (PostHog/posthog-js) — Apache-2.0 primary, MIT for vendored third-party code
@sentry/cli 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-darwin 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-linux-arm 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-linux-arm64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-linux-i686 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-linux-x64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-win32-arm64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-win32-i686 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft
@sentry/cli-win32-x64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT extracted from license field — FSL-1.1-MIT (Functional Source License 1.1, MIT future grant); self-describing, non-copyleft

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brendan-kellam