v4.3.0 - Critical Security & Reliability Fixes

🔒 Critical Security & Reliability Fixes

Security Updates

• CRITICAL: Fix fail-open vulnerability in GitHub Actions that could bypass security gates (#71)
• CRITICAL: Patch 8 Hono CVEs including XSS, path traversal, and authentication bypass (#75, #66, #65, #64, #62)
  • GHSA-69xw-7hcm-h432: HTML injection via unvalidated JSX tag names
  • GHSA-9vqf-7f2p-gf9v: bodyLimit() bypass for chunked requests
  • GHSA-458j-xx4x-4375: Improper JSX attribute name handling
  • GHSA-wmmm-f939-6g9c: Middleware bypass via repeated slashes
  • GHSA-xf4j-xp2r-rqqx: Path traversal in toSSG()
  • GHSA-xpcf-pg52-r92g: IPv4-mapped IPv6 address bypass
  • GHSA-26pp-8wgv-hjvm: Missing cookie name validation
  • GHSA-r5rp-j6wh-rvv4: Cookie prefix bypass

Bug Fixes

• Fix confidence threshold filtering case sensitivity (#73)
• Fix SARIF generation for GitHub Code Scanning (#72)

Dependencies

• Update Hono 4.12.7 → 4.12.16
• Update @hono/node-server to 1.19.13
• Update Vite to 7.3.2
• Update Lodash 4.17.23 → 4.18.1
• Update PostCSS, path-to-regexp, picomatch

Testing

• Add 18 new regression tests for critical fixes
• All 420+ tests passing

⚠️ Upgrade recommended for production use.

See CHANGELOG.md for complete details.

Installation

npm install -g agent-security-scanner-mcp@4.3.0

What Changed

• 18 PRs merged (3 critical bug fixes + 15 security dependency updates)
• 100% backward compatible
• No breaking changes