chore(deps): bump hono from 4.12.31 to 4.13.3 in /mcp - #30029
Conversation
Bumps [hono](https://github.com/honojs/hono) from 4.12.31 to 4.13.3. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.31...v4.13.3) --- updated-dependencies: - dependency-name: hono dependency-version: 4.13.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
carlotestor
left a comment
carlotestor
left a comment
There was a problem hiding this comment.
Summary
Transitive-only lockfile bump of hono 4.12.31 → 4.13.3 in mcp/. hono is not a direct dependency of ccxt-mcp — it is pulled in by @modelcontextprotocol/sdk (hono@^4.11.4) and is a peer of @hono/node-server (hono@^4), so mcp/package.json is correctly left untouched. Diff is 3 lines in one file (version, resolved URL, integrity).
Verification performed
- Integrity hash is authentic. Downloaded
hono-4.13.3.tgzfrom the registry and recomputed the SHA-512 SRI; it matches theintegrityvalue in the diff byte for byte. - Lockfile installs cleanly.
npm ciagainst the PR lockfile resolves and installs, andnpm ls hono --allshows a single dedupedhono@4.13.3under both@modelcontextprotocol/sdkand@hono/node-server— no duplicate/split versions. - Runtime smoke passes. A
Honoapp served through@hono/node-serverreturned HTTP 200, and the actual consumers@modelcontextprotocol/sdk/server/mcp.jsand.../streamableHttp.jsboth import successfully against the new version. No breaking-change surface for the MCP server. - Version lineage checked. 4.12.34 was published 2026-08-03T02:36Z and 4.13.0 later the same day at 21:54Z, so 4.13.x is a linear continuation and carries the 4.12.34 fixes — not a parallel branch cut before them.
Security impact (the real reason to take this)
This is more than a routine version nudge — it clears the entire hono advisory cluster. npm audit on the master tree vs this PR's tree:
| master (4.12.31) | this PR (4.13.3) | |
|---|---|---|
hono advisories |
4 | 0 |
| total | 6 | 5 |
Resolved here (all patched in 4.12.34, vulnerable range < 4.12.34):
- ReDoS in CORS middleware via
Access-Control-Request-Headers(GHSA-8j4g-w8fx-2239) memo()retains SSR output across requests → cross-user data disclosure (GHSA-f23p-vx2j-j53r)- Algorithmic-complexity DoS in Language middleware (GHSA-54fx-42gc-7vw4)
- Proxy helper does not strip response headers named in
Connection(GHSA-79qm-7rj5-m7r9)
Spot-checked the shipped code rather than trusting version math: dist/middleware/cors/index.js in 4.13.3 builds the allow-headers string with a linear split(',')/trim()/join(',') and no backtracking regex, consistent with the ReDoS fix.
Non-blocking follow-up
@hono/node-server stays at 1.19.14 in this lockfile, which npm audit still flags for the Windows serve-static encoded-backslash (%5C) path traversal, fixed in 1.19.15. Out of scope for this PR and a separate Dependabot bump will pick it up; noting it only so the remaining audit line after merge is not a surprise. It does not affect this change.
CI was still pending at review time, so the usual green-checks precondition applies.
Merge gate: 🟢
Merge probability: 94%
Merge digestDependabot bumps
flowchart LR
empty["no call graph"]
@@ -1208,9 +1208,9 @@
- "version": "4.12.31",
- "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.31.tgz",
- "integrity": "sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==",
+ "version": "4.13.3",
+ "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.3.tgz",
+ "integrity": "sha512-r8AO2mYHoLxSHkgafNeC/BXyb2vWRxD3jem4Ts+ptav8oTG5FIRifAjuJEmZI4bSvvc2ns0GxmIYiZnHqN3mMw==", |
2 participants
Bumps hono from 4.12.31 to 4.13.3.
Release notes
Sourced from hono's releases.
... (truncated)
Commits
02933434.13.35ad469afeat(pretty-json): support structured JSON content-types (+json) (#5226)c91ec9bfix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...eea9735fix(csrf): exempt OPTIONS request from CSRF validation (#5250)a194628fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...63bbcf5fix(trie-router): match suffix wildcard routes (#5236)ef0739ddocs(context): add custom headers append option example to Context JSDoc (#5248)8bf03c3fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)546eca0fix(etag): avoid skipping headers when filtering 304 response headers (#5234)7195c24fix(etag): copy pending stream bytes (#5239)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.