ci(deps): OSV 批次 2026-08 —— undici 7.29.0 / hono 4.12.34 / fast-uri 3.1.5,把 main 上永远红的共享门禁修绿 (#5032)

.changeset/osv-batch-2026-08-fixable-bumps.md

@@ -0,0 +1,59 @@
+---
+"@objectstack/plugin-hono-server": patch
+---
+
+ci(deps): OSV security batch 2026-08 — undici to 7.29.0, hono to 4.12.34,
+fast-uri to 3.1.5, so `Validate Package Dependencies` stops failing on every PR (#5032)
+
+Eight advisories (2 high, 6 medium) matched packages resolved in `main`'s
+`pnpm-lock.yaml`, and all eight name a fixed version:
+
+| advisory | CVSS | package | resolved | fixed |
+| --- | --- | --- | --- | --- |
+| `GHSA-7p8r-x3mc-p8w7` | 7.5 | `fast-uri` | 3.1.4 | 3.1.5 |
+| `GHSA-8j4g-w8fx-2239` | 5.3 | `hono` | 4.12.32, 4.12.33 | 4.12.34 |
+| `GHSA-4cwx-7wf7-3272` | 7.4 | `undici` | 7.28.0 | 7.29.0 |
+| `GHSA-jr45-8vmc-qm54` | 5.9 | `undici` | 7.28.0 | 7.29.0 |
+| `GHSA-8xcm-r25x-g524` | 4.8 | `undici` | 7.28.0 | 7.29.0 |
+| `GHSA-v3r7-h72x-cjcm` | 4.8 | `undici` | 7.28.0 | 7.29.0 |
+| `GHSA-m8rv-5g2x-5cg5` | 4.2 | `undici` | 7.28.0 | 7.29.0 |
+
+The OSV-Scanner step in `.github/workflows/validate-deps.yml` reads
+`pnpm-lock.yaml` directly and exits non-zero on any match, so the job was red on
+`main` itself and attached that red to every PR touching a manifest or the
+lockfile, whatever the PR contained (observed on #5027, whose own lockfile delta
+is three lines and resolves no new package). A permanently red gate is worse
+than no gate: the next PR that really does introduce a vulnerable dependency
+looks exactly like all the others.
+
+`undici` repeats the trap #4945 taught. The existing pin
+(`undici@>=7.23.0 <7.28.0: ^7.28.0`, added for `GHSA-vmh5-mc38-953g`) had
+settled on 7.28.0 — the version these five advisories affect — and its exclusive
+upper bound no longer covered it, so the override sat there doing nothing.
+Selector and target move together, to `<7.29.0` / `^7.29.0`. Transitive-only via
+`@vscode/vsce` > `cheerio`; `@ai-sdk/provider-utils` already resolved 7.29.0, so
+the two dedupe onto one copy. `jsdom`'s `undici` 8.9.0 is outside the selector
+and untouched.
+
+`fast-uri` is transitive-only through `ajv@8.20.0` (declares `^3.0.1`), reaching
+`@modelcontextprotocol/sdk`, `@objectstack/objectql`, `secretlint` and `table`;
+a `fast-uri@<3.1.5: ^3.1.5` override covers all of them.
+
+`hono` is the one that is not transitive-only, which is why this changeset
+releases something. Two versions were resolved: 4.12.32 from our own packages
+and 4.12.33 pulled by `@modelcontextprotocol/sdk`. The override moves the
+transitive copy and the declared ranges move with it — `@objectstack/plugin-hono-server`
+`dependencies.hono` to `^4.12.34` (the published-manifest change this patch
+covers), plus the `@objectstack/hono` and `@objectstack/plugin-auth`
+devDependencies. Overrides do not ship with published packages, so a declared
+range left behind would mean downstream resolves a version CI never ran —
+exactly what `scripts/check-override-consistency.mjs` exists to catch. The
+`@objectstack/hono` **peer** range stays the permissive `^4.12.8` on purpose: a
+peer states which host `hono` the adapter works against, and a host that pins an
+old one owns that copy. After the bump the workspace resolves a single
+`hono@4.12.34`.
+
+Scope is the eight advisories #5032 lists and nothing else. #4965 (advisories
+with no fix available, and the `osv-scanner.toml` exemption conventions that
+answer them) is a separate question — every advisory here has a fix, so this is
+an upgrade, not an exemption.

packages/adapters/hono/package.json

@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@objectstack/runtime": "workspace:*",
-    "hono": "^4.12.32",
+    "hono": "^4.12.34",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },

packages/plugins/plugin-auth/package.json

@@ -34,7 +34,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
-    "hono": "^4.12.32",
+    "hono": "^4.12.34",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },

packages/plugins/plugin-hono-server/package.json

@@ -16,7 +16,7 @@
     "@objectstack/observability": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
-    "hono": "^4.12.32"
+    "hono": "^4.12.34"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

pnpm-workspace.yaml

@@ -29,6 +29,16 @@ onlyBuiltDependencies:
 #     dropped requestTls in SOCKS5 ProxyAgent. Pulled 7.27.2 through
 #     @vscode/vsce > cheerio (declares undici ^7.19.0); force the patched
 #     7.28.0 line (stays in the 7.x major cheerio supports). CI audit gate.
+#     Then five more advisories landed on 7.28.0 itself — the version this pin
+#     had settled on (GHSA-4cwx-7wf7-3272 7.4 high, GHSA-jr45-8vmc-qm54 5.9,
+#     GHSA-8xcm-r25x-g524 / GHSA-v3r7-h72x-cjcm 4.8, GHSA-m8rv-5g2x-5cg5 4.2) —
+#     so the bound moves to <7.29.0 / ^7.29.0 (#5032). NOTE the recurring trap:
+#     an exclusive upper bound stops covering the very version it pinned once
+#     that version is itself flagged, so the selector AND the target must move
+#     together — same shape as the brace-expansion 5.0.8 → 5.0.9 lift (#4945).
+#     Still transitive-only via cheerio; @ai-sdk/provider-utils already resolves
+#     7.29.0, so the two dedupe. jsdom's undici 8.9.0 is outside the selector
+#     and unaffected.
 #   - @better-auth/scim: GHSA-j8v8-g9cx-5qf4 (high) — account/provider
 #     takeover. The advisory is patched only in >=1.7.0-beta.4 — there is NO
 #     stable patched release yet (npm `latest` is still on the 1.6.x line), so
@@ -83,7 +93,7 @@ overrides:
   'minimatch@<10.2.3': '10.2.3'
   'tar@>=2.0.0 <7.5.11': '^7.5.11'
   'form-data@<4.0.6': '>=4.0.6'
-  'undici@>=7.23.0 <7.28.0': '^7.28.0'
+  'undici@>=7.23.0 <7.29.0': '^7.29.0'
   # better-auth family — kept on one line (see @better-auth/oauth-provider note).
   'better-auth@<1.7.0-rc.2': '1.7.0-rc.2'
   '@better-auth/core@<1.7.0-rc.2': '1.7.0-rc.2'
@@ -119,3 +129,22 @@ overrides:
   'react-router@<8.3.0': '^8.3.0'
   '@sveltejs/kit@<2.69.1': '^2.69.1'
   '@hono/node-server@<2.0.5': '^2.0.10'
+  # OSV batch 2026-08 (#5032) — all three name a fixed version, so they are
+  # upgrades, not exemptions (the osv-scanner.toml route #4965 defines is for
+  # advisories with NO fix and does not apply here):
+  #   fast-uri GHSA-7p8r-x3mc-p8w7 (7.5 high) — transitive-only via ajv@8.20.0
+  #     (declares ^3.0.1), which reaches @modelcontextprotocol/sdk, objectql,
+  #     secretlint and table. Nothing declares fast-uri directly.
+  #   hono GHSA-8j4g-w8fx-2239 (5.3) — the one entry here that is NOT
+  #     transitive-only: two versions resolved, 4.12.32 from our own packages
+  #     and 4.12.33 pulled by @modelcontextprotocol/sdk. The override moves the
+  #     transitive copy; the declared ranges are bumped to ^4.12.34 in lockstep
+  #     (plugin-hono-server dependency, plugin-auth + @objectstack/hono
+  #     devDependencies) so a downstream install — which never sees these
+  #     overrides — resolves the same patched line that CI tested. The
+  #     @objectstack/hono PEER range stays the permissive ^4.12.8 on purpose: a
+  #     peer states what host hono we work against, and a host that pins an old
+  #     hono owns that copy; narrowing it fixes nothing here and only breaks
+  #     compatibility. check-override-consistency.mjs covers both forms.
+  'fast-uri@<3.1.5': '^3.1.5'
+  'hono@<4.12.34': '^4.12.34'