From 46ebc9fceddf99f817e0d08b5abc4924ade37d98 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 4 Sep 2026 10:56:39 -0400 Subject: [PATCH 1/2] chore(security): bundle npm transitive fixes for root package-lock.json Raise the fast-uri override to ^3.1.6 (resolves 3.1.7) and add a qs override at ^6.16.0 (resolves 6.16.0), clearing 5 Dependabot alerts. Both packages are transitive-only, and every declaring parent accepts the patched range (fast-uri: ajv ^3.0.1; qs: body-parser ^6.15.2, express ^6.14.0), so plain global overrides are correct here. Verified locally with the exact CI steps: npm ci, npm run build, npm run lint -- all green; npm audit reports 0 vulnerabilities. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 39 ++++++++++++++++++++------------------- package.json | 5 +++-- 2 files changed, 23 insertions(+), 21 deletions(-) diff --git a/package-lock.json b/package-lock.json index f568969..f801ee0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1100,9 +1100,9 @@ } }, "node_modules/es-object-atoms": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz", - "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==", + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz", + "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==", "license": "MIT", "dependencies": { "es-errors": "^1.3.0" @@ -1464,9 +1464,9 @@ "dev": true }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", @@ -2554,12 +2554,13 @@ } }, "node_modules/qs": { - "version": "6.15.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz", - "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.1.0" + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" }, "engines": { "node": ">=0.6" @@ -2846,14 +2847,14 @@ } }, "node_modules/side-channel": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz", - "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", "license": "MIT", "dependencies": { "es-errors": "^1.3.0", - "object-inspect": "^1.13.3", - "side-channel-list": "^1.0.0", + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" }, @@ -2865,13 +2866,13 @@ } }, "node_modules/side-channel-list": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz", - "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==", + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz", + "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==", "license": "MIT", "dependencies": { "es-errors": "^1.3.0", - "object-inspect": "^1.13.3" + "object-inspect": "^1.13.4" }, "engines": { "node": ">= 0.4" diff --git a/package.json b/package.json index 1477a79..0d24f34 100644 --- a/package.json +++ b/package.json @@ -27,10 +27,11 @@ "brace-expansion@^2.0.0": "2.1.4", "@hono/node-server": "1.19.15", "body-parser": "2.3.0", - "fast-uri": "3.1.5", + "fast-uri": "^3.1.6", "hono": "4.12.34", "ip-address": "10.3.1", - "js-yaml": "4.3.1" + "js-yaml": "4.3.1", + "qs": "^6.16.0" }, "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0", From 85e7f9ba9c01e37631b814c4979a289a985225f6 Mon Sep 17 00:00:00 2001 From: Ben Date: Mon, 14 Sep 2026 11:20:46 -0400 Subject: [PATCH 2/2] chore(security): raise hono and js-yaml overrides to caret ranges Closes four Dependabot alerts on the root package-lock.json, all of which fire against this repo's own exact-pin overrides rather than against an upstream dependency: hono 4.12.34 -> ^4.13.5 (resolves 4.13.7) #68 #69 #70 js-yaml 4.3.1 -> ^4.3.2 (resolves 4.3.2) #71 Both packages are transitive-only and every declaring parent accepts the patched range (hono <- @hono/node-server peer ^4 and @modelcontextprotocol/sdk ^4.11.4; js-yaml <- eslint and @eslint/eslintrc ^4.1.0), so global overrides are correct. Caret rather than an exact pin so the next patch advisory does not fire against the pin itself, and caret rather than >= so npm cannot cross a major (js-yaml 5.x and @hono/node-server 2.x remain maintainer decisions). Lockfile churn is exactly these two entries; no packages added or removed. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 12 ++++++------ package.json | 4 ++-- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index f801ee0..4a3d9eb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1784,9 +1784,9 @@ } }, "node_modules/hono": { - "version": "4.12.34", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.34.tgz", - "integrity": "sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==", + "version": "4.13.7", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz", + "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==", "license": "MIT", "engines": { "node": ">=16.9.0" @@ -2059,9 +2059,9 @@ "dev": true }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index 0d24f34..b89a48b 100644 --- a/package.json +++ b/package.json @@ -28,9 +28,9 @@ "@hono/node-server": "1.19.15", "body-parser": "2.3.0", "fast-uri": "^3.1.6", - "hono": "4.12.34", + "hono": "^4.13.5", "ip-address": "10.3.1", - "js-yaml": "4.3.1", + "js-yaml": "^4.3.2", "qs": "^6.16.0" }, "dependencies": {