3ngram 1.4.3

3ngram v1.4.3

Patch release: a transitive @hono/node-server advisory fix that reaches the
MCP HTTP transport. No source changed in any published package and no runtime
behaviour moves — the fix is a resolution, carried by the lockfile and by the
image built from it.

Changes

• @hono/node-server moves 1.19.14 → 1.19.17 (GHSA-frvp-7c67-39w9). The
  advisory is a serve-static path traversal reachable on Windows through an
  encoded backslash. @hono/node-server is not a declared dependency of
  @3ngram/server; it arrives transitively as a regular dependency of
  @modelcontextprotocol/node, which the MCP HTTP transport relies on. Because
  it is a regular dependency rather than an optional peer, a scoped root
  override (@hono/node-server@<1.19.15: ^1.19.15) reaches it — unlike hono
  itself, which had to become a declared dependency in v1.2.6.

  The resolution is 1.19.17 rather than the advisory's 1.19.15 because 1.19.16
  was never published.

  The workspace lockfile is what pins this, and the published
  ghcr.io/b3dmar/3ngram image builds from that lockfile, so the image carries
  the patched version from this release forward.

• Dev-scope advisory overrides re-raised. nanoid 3.3.16 → 3.3.17
  (GHSA-2v37-7h3g-55p8) and js-yaml 3.15.0 → 3.15.1 / 4.3.0 → 4.3.1
  (GHSA-5p4m-2wfm-xmqj). Both are reached only through devDependencies —
  nanoid via vitest → vite → postcss, js-yaml via @changesets/cli — so
  neither is present in any published package or in the server image. The
  js-yaml selectors had gone inert (3.15.0 no longer matches <3.15.0) and
  are re-raised to the new advisory boundaries, still split so the unaffected
  5.x major stays put. The orphaned fast-uri override, which had left the
  dependency graph entirely, was pruned; it changed no resolution.

• A CI gate now re-asserts every dependency override against the lockfile.
  An override is written once and never re-examined — --frozen-lockfile
  replays the recorded resolution, so CI passed whether or not an entry still
  did anything. scripts/check-override-freshness.mjs fails on two outcomes:
  NOT APPLIED (a resolved version still satisfies the override's own selector,
  the optional-peer failure mode that forced hono to become a declared
  dependency) and ORPHANED (the package is gone from the lockfile). It runs in
  the hygiene lane with no install, reading only pnpm-workspace.yaml and
  pnpm-lock.yaml. Repository tooling only — no runtime change, and no package
  version moves with it.

Upgrading

No configuration or migration changes, and no API changes.

Nothing in the published @3ngram/server, @3ngram/sdk, or 3ngram package
contents changed; the version exists to carry the patched resolution. Running
ghcr.io/b3dmar/3ngram:1.4.3 is sufficient — the image is built from the
lockfile that pins 1.19.17.

Consumers who resolve their own dependency graph rather than running the
published image should confirm their own @hono/node-server resolves to
>= 1.19.15 — an override or a lockfile refresh, since the vulnerable version
is reached transitively there too.

Library versions

@3ngram/core 0.9.2, @3ngram/db 0.8.2, @3ngram/schema 0.7.2,
@3ngram/config 0.2.6, @3ngram/llm 0.2.4 — unchanged; nothing in this
release touched them.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:a9581a67240cebe7fbcd8f5d65f20975d45a2579185c0d38923e3714bd3eaa02