Skip to content

chore: upgrade @hono/node-server to ^2.0.5 to address GHSA-frvp-7c67-39w9#1491

Draft
linear-code[bot] wants to merge 2 commits into
mainfrom
linear/sou-1584-sourcebot-devsourcebot-ghsa-frvp-7c67-39w9-nodejs-878e
Draft

chore: upgrade @hono/node-server to ^2.0.5 to address GHSA-frvp-7c67-39w9#1491
linear-code[bot] wants to merge 2 commits into
mainfrom
linear/sou-1584-sourcebot-devsourcebot-ghsa-frvp-7c67-39w9-nodejs-878e

Conversation

@linear-code

@linear-code linear-code Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Fixes SOU-1584

Addresses GHSA-frvp-7c67-39w9 (MEDIUM), a path traversal in @hono/node-server's serve-static on Windows via an encoded backslash (%5C), patched in 2.0.5.

@hono/node-server is pulled in transitively by @modelcontextprotocol/sdk (both directly and via @react-grab/mcp). The existing resolutions override pinned it to the vulnerable ^1.19.13; this bumps that override to ^2.0.5, which now resolves to 2.0.11.

The only breaking changes in @hono/node-server v2 are dropping Node 18 support and removing the Vercel adapter. Sourcebot runs on Node 24, and the MCP SDK only uses serve / getRequestListener, both unchanged in v2.

@github-actions

Copy link
Copy Markdown
Contributor

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants