From 1cc6d839de67ae22aa3c7fa6caa1b671aa44eb4d Mon Sep 17 00:00:00 2001 From: "n8n-cat-bot[bot]" Date: Wed, 9 Sep 2026 04:05:52 +0000 Subject: [PATCH] chore: Bump hono 4.12.34 -> 4.13.5 (minor) on 1.x to clear 3 Aikido findings hono is transitive only, reaching the tree through @modelcontextprotocol/sdk (both directly and via @hono/node-server), and is already pinned by a root pnpm override. Raise the existing `hono@<=4.12.34` selector to `<=4.13.5` and refresh the lockfile so the single resolved copy in the tree is 4.13.5, clearing CVE-2026-84363 (medium), CVE-2026-84364 (low) and CVE-2026-84365 (medium). No source file imports hono, so this is a runtime-dependency bump with no type surface of ours to adjust. Co-Authored-By: Claude Opus 5 --- package.json | 2 +- pnpm-lock.yaml | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 66975531ba2..110006fc0d8 100644 --- a/package.json +++ b/package.json @@ -168,7 +168,7 @@ "ws": "8.21.1", "axios": "1.18.0", "pg@<8.21.0": "8.21.0", - "hono@<=4.12.34": "4.12.34", + "hono@<=4.13.5": "4.13.5", "vue-i18n@<=11.4.4": "11.4.4", "@intlify/shared@<=11.4.4": "11.4.4", "linkify-it@<=5.0.2": "5.0.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0d92fcaa0de..c9291748ff8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -276,7 +276,7 @@ overrides: ws: 8.21.1 axios: 1.18.0 pg@<8.21.0: 8.21.0 - hono@<=4.12.34: 4.12.34 + hono@<=4.13.5: 4.13.5 vue-i18n@<=11.4.4: 11.4.4 '@intlify/shared@<=11.4.4': 11.4.4 linkify-it@<=5.0.2: 5.0.2 @@ -5277,7 +5277,7 @@ packages: resolution: {integrity: sha512-Za2ai6TLdKjUvnur+eenO6nuYYipVAEhyCAdaV8IRvmU9kK8crOZUSYvIXn72E4f8fJqyAbpcJuTsYYmZp9Deg==} engines: {node: '>=18.14.1'} peerDependencies: - hono: 4.12.34 + hono: 4.13.5 '@huggingface/inference@4.0.5': resolution: {integrity: sha512-/Qc45BGrN+FBA3JfdeoHfafxfNShH/dxvOsXbBdcxyxIRIYOyefeiXSlShZGVCaiqYpm+10na28D0YtvjKPTlw==} @@ -12239,8 +12239,8 @@ packages: resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==} engines: {node: '>=0.10.0'} - hono@4.12.34: - resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} + hono@4.13.5: + resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==} engines: {node: '>=16.9.0'} hookable@5.5.3: @@ -21442,9 +21442,9 @@ snapshots: protobufjs: 7.6.5 yargs: 17.7.2 - '@hono/node-server@1.19.15(hono@4.12.34)': + '@hono/node-server@1.19.15(hono@4.13.5)': dependencies: - hono: 4.12.34 + hono: 4.13.5 '@huggingface/inference@4.0.5': dependencies: @@ -22440,7 +22440,7 @@ snapshots: '@modelcontextprotocol/sdk@1.26.0(zod@3.25.67)': dependencies: - '@hono/node-server': 1.19.15(hono@4.12.34) + '@hono/node-server': 1.19.15(hono@4.13.5) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -22450,7 +22450,7 @@ snapshots: eventsource-parser: 3.0.1 express: 5.2.1 express-rate-limit: 8.2.2(express@5.2.1) - hono: 4.12.34 + hono: 4.13.5 jose: 6.2.9 json-schema-typed: 8.0.2 pkce-challenge: 5.0.0(patch_hash=651e785d0b7bbf5be9210e1e895c39a16dc3ce8a5a3843b4819565fb6e175b90) @@ -29645,7 +29645,7 @@ snapshots: dependencies: parse-passwd: 1.0.0 - hono@4.12.34: {} + hono@4.13.5: {} hookable@5.5.3: {}