Skip to content

chore: upgrade hono to ^4.12.25 to address CVE-2026-54288#1318

Closed
brendan-kellam wants to merge 2 commits into
mainfrom
linear/sou-1343-sourcebot-devsourcebot-cve-2026-54288-hono-body-limit-e576
Closed

chore: upgrade hono to ^4.12.25 to address CVE-2026-54288#1318
brendan-kellam wants to merge 2 commits into
mainfrom
linear/sou-1343-sourcebot-devsourcebot-cve-2026-54288-hono-body-limit-e576

Conversation

@brendan-kellam

@brendan-kellam brendan-kellam commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Fixes SOU-1343

Refreshes the hono lockfile entry from 4.12.24 to 4.12.25 to address CVE-2026-54288 (Body Limit Middleware bypass on AWS Lambda via understated Content-Length).

hono is a transitive dependency via @modelcontextprotocol/sdk (^4.11.4), which already admits the patched version, so this is a yarn up -R hono lockfile refresh with no package.json change.

@coderabbitai

coderabbitai Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8a55d22f-31da-49fc-a774-8686f7ab4cfb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch linear/sou-1343-sourcebot-devsourcebot-cve-2026-54288-hono-body-limit-e576

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️ Status: PASS

Metric Count
Total packages 2136
Resolved (non-standard) 12
Unresolved 0
Strong copyleft 0
Weak copyleft 39

Weak Copyleft Packages (informational)

Package Version License
@img/sharp-libvips-darwin-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm 1.0.5 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-wasm32 0.33.5 Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-wasm32 0.34.5 Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32 0.33.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64 0.33.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
axe-core 4.10.3 MPL-2.0
dompurify 3.4.0 (MPL-2.0 OR Apache-2.0)
lightningcss 1.32.0 MPL-2.0
lightningcss-android-arm64 1.32.0 MPL-2.0
lightningcss-darwin-arm64 1.32.0 MPL-2.0
lightningcss-darwin-x64 1.32.0 MPL-2.0
lightningcss-freebsd-x64 1.32.0 MPL-2.0
lightningcss-linux-arm-gnueabihf 1.32.0 MPL-2.0
lightningcss-linux-arm64-gnu 1.32.0 MPL-2.0
lightningcss-linux-arm64-musl 1.32.0 MPL-2.0
lightningcss-linux-x64-gnu 1.32.0 MPL-2.0
lightningcss-linux-x64-musl 1.32.0 MPL-2.0
lightningcss-win32-arm64-msvc 1.32.0 MPL-2.0
lightningcss-win32-x64-msvc 1.32.0 MPL-2.0
Resolved Packages (12)
Package Version Original Resolved Source
@react-grab/cli 0.1.23 UNKNOWN MIT GitHub repo (aidenybai/react-grab LICENSE = MIT)
@react-grab/cli 0.1.29 UNKNOWN MIT GitHub repo (aidenybai/react-grab LICENSE = MIT)
@react-grab/mcp 0.1.29 UNKNOWN MIT GitHub repo (aidenybai/react-grab, same npm scope & maintainer abai; LICENSE = MIT)
codemirror-lang-elixir 4.0.0 UNKNOWN Apache-2.0 npm registry (package top-level license & v4.0.1 = Apache-2.0)
d3-array 3.2.4 UNKNOWN ISC npm registry (v3.2.4 license = ISC; original entry had fetch failed error)
element-source 0.0.3 UNKNOWN MIT GitHub repo (aidenybai/element-source, name match; LICENSE = MIT)
lezer-elixir 1.1.2 UNKNOWN Apache-2.0 npm registry (package top-level license & v1.1.3 = Apache-2.0)
map-stream 0.1.0 UNKNOWN MIT npm registry (package top-level license = MIT)
memorystream 0.3.1 UNKNOWN MIT extracted from object: npm metadata license = [{type:'MIT'}]
pause-stream 0.0.11 MIT,Apache2 (MIT OR Apache-2.0) extracted from object: package metadata license array ['MIT','Apache2']
posthog-js 1.369.0 SEE LICENSE IN LICENSE Apache-2.0 GitHub repo (PostHog/posthog-js LICENSE file = Apache License 2.0)
valid-url 1.0.9 UNKNOWN MIT GitHub repo (ogt/valid-url LICENSE file & package.json = MIT)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brendan-kellam