github-mirror/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2026-10-17 21:49:36 +02:00
Code Issues Actions 13 Packages Projects Releases Wiki Activity Graph

chore: Bump hono 4.12.34 -> 4.13.5 (minor) on 1.x to clear 3 Aikido findings

Browse Source 
hono is transitive only, reaching the tree through @modelcontextprotocol/sdk (both
directly and via @hono/node-server), and is already pinned by a root pnpm
override. Raise the existing `hono@<=4.12.34` selector to `<=4.13.5` and refresh
the lockfile so the single resolved copy in the tree is 4.13.5, clearing
CVE-2026-84363 (medium), CVE-2026-84364 (low) and CVE-2026-84365 (medium).

No source file imports hono, so this is a runtime-dependency bump with no type
surface of ours to adjust.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
n8n-cat-bot[bot] 2026-09-09 04:05:52 +00:00
parent f9edcd565f
commit 1cc6d839de
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package.json
View File

@ -168,7 +168,7 @@
"ws": "8.21.1",
"axios": "1.18.0",
"pg@<8.21.0": "8.21.0",
"hono@<=4.12.34": "4.12.34",
"hono@<=4.13.5": "4.13.5",
"vue-i18n@<=11.4.4": "11.4.4",
"@intlify/shared@<=11.4.4": "11.4.4",
"linkify-it@<=5.0.2": "5.0.2",

18
pnpm-lock.yaml
View File

@ -276,7 +276,7 @@ overrides:
ws: 8.21.1
axios: 1.18.0
pg@<8.21.0: 8.21.0
hono@<=4.12.34: 4.12.34
hono@<=4.13.5: 4.13.5
vue-i18n@<=11.4.4: 11.4.4
'@intlify/shared@<=11.4.4': 11.4.4
linkify-it@<=5.0.2: 5.0.2
@ -5277,7 +5277,7 @@ packages:
resolution: {integrity: sha512-Za2ai6TLdKjUvnur+eenO6nuYYipVAEhyCAdaV8IRvmU9kK8crOZUSYvIXn72E4f8fJqyAbpcJuTsYYmZp9Deg==}
engines: {node: '>=18.14.1'}
peerDependencies:
hono: 4.12.34
hono: 4.13.5
'@huggingface/inference@4.0.5':
resolution: {integrity: sha512-/Qc45BGrN+FBA3JfdeoHfafxfNShH/dxvOsXbBdcxyxIRIYOyefeiXSlShZGVCaiqYpm+10na28D0YtvjKPTlw==}
@ -12239,8 +12239,8 @@ packages:
resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==}
engines: {node: '>=0.10.0'}
hono@4.12.34:
resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==}
hono@4.13.5:
resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==}
engines: {node: '>=16.9.0'}
hookable@5.5.3:
@ -21442,9 +21442,9 @@ snapshots:
protobufjs: 7.6.5
yargs: 17.7.2
'@hono/node-server@1.19.15(hono@4.12.34)':
'@hono/node-server@1.19.15(hono@4.13.5)':
dependencies:
hono: 4.12.34
hono: 4.13.5
'@huggingface/inference@4.0.5':
dependencies:
@ -22440,7 +22440,7 @@ snapshots:
'@modelcontextprotocol/sdk@1.26.0(zod@3.25.67)':
dependencies:
'@hono/node-server': 1.19.15(hono@4.12.34)
'@hono/node-server': 1.19.15(hono@4.13.5)
ajv: 8.18.0
ajv-formats: 3.0.1(ajv@8.18.0)
content-type: 1.0.5
@ -22450,7 +22450,7 @@ snapshots:
eventsource-parser: 3.0.1
express: 5.2.1
express-rate-limit: 8.2.2(express@5.2.1)
hono: 4.12.34
hono: 4.13.5
jose: 6.2.9
json-schema-typed: 8.0.2
pkce-challenge: 5.0.0(patch_hash=651e785d0b7bbf5be9210e1e895c39a16dc3ce8a5a3843b4819565fb6e175b90)
@ -29645,7 +29645,7 @@ snapshots:
dependencies:
parse-passwd: 1.0.0
hono@4.12.34: {}
hono@4.13.5: {}
hookable@5.5.3: {}