From f5780712d2c653f59776dd45962127b6960c06d7 Mon Sep 17 00:00:00 2001 From: Aryam Goyal Date: Tue, 4 Aug 2026 11:59:26 +0530 Subject: [PATCH] fix: clear the high-severity advisories blocking npm audit `npm run ci` has been failing at `audit:production` since advisories landed for two transitive production dependencies after v0.8.7 was released: fast-uri 3.1.4 high host confusion via backslash authority introducer GHSA-7p8r-x3mc-p8w7 ip-address 10.2.0 high leading-zero octets decoded as decimal, CIDR suffix suppressing special-use classification, and IPv4-mapped/NAT64 misclassification - each able to bypass an SSRF or trust-boundary check GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg hono 4.12.31 (moderate, ReDoS in CORS middleware, GHSA-8j4g-w8fx-2239) is below the --audit-level=high gate but is bumped in the same pass rather than left as the only known advisory in the tree. All three are patchable inside the ranges their parents already declare, so no manifest changes: ajv wants fast-uri ^3.0.1 and 3.1.5 is the patched 3.x; express-rate-limit wants ip-address ^10.2.0; @hono/node-server and the MCP SDK want hono ^4 and ^4.11.4. All three are dependency-free leaves, so only version, resolved and integrity move. The lockfile was patched in place rather than regenerated. Running npm install on Windows drops the optional @emnapi/* entries that npm ci needs on the Linux runner, which has broken CI three times before. The @emnapi entry count is 28 before and after, the diff is nine lines across exactly three entries, and npm ci then resolves the tree cleanly. Verified: npm ci clean, `npm audit --omit=dev --audit-level=high` reports 0 vulnerabilities, and the full `npm run ci` passes end to end. Co-Authored-By: Claude Opus 5 --- package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 0fec1f8..1d2964c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4770,9 +4770,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", + "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", "funding": [ { "type": "github", @@ -5243,9 +5243,9 @@ } }, "node_modules/hono": { - "version": "4.12.31", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.31.tgz", - "integrity": "sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==", + "version": "4.13.0", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz", + "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==", "license": "MIT", "peer": true, "engines": { @@ -5347,9 +5347,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.4.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz", + "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==", "license": "MIT", "engines": { "node": ">= 12"