Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: update Hono security patches - #2620

Open
yoominho91 wants to merge 1 commit into
openstatusHQ:mainfrom
yoominho91:security/bump-hono-4.12.34
Open

fix: update Hono security patches#2620
yoominho91 wants to merge 1 commit into
openstatusHQ:mainfrom
yoominho91:security/bump-hono-4.12.34

Conversation

@yoominho91

@yoominho91 yoominho91 commented Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • update the Hono catalog entry from 4.12.21 to 4.12.34
  • override transitive Hono copies so the MCP SDK cannot retain 4.12.21
  • pin @hono/node-server to the patched 1.19.15 release

Security impact

The server currently uses cors() with default options in:

  • apps/server/src/routes/public/index.ts
  • apps/server/src/routes/v1/index.ts

Hono 4.12.21 reaches the vulnerable default allowHeaders path described in GHSA-8j4g-w8fx-2239, where an unauthenticated preflight request can trigger quadratic header parsing and consume disproportionate CPU.

The lockfile also retained vulnerable Hono and Node adapter copies through @modelcontextprotocol/sdk. The overrides keep all workspace and transitive copies on patched releases.

Verification

  • pnpm audit --prod: Hono / @hono/node-server advisories 15 → 0 (2 high, 12 moderate, 1 low removed)
  • pnpm install --frozen-lockfile --lockfile-only
  • pnpm verify with the repository-pinned Node 24.12.0 and Deno 2.9.4: 39/39 packages passed

The lockfile change is intentional and contains only the Hono resolution and peer snapshot updates required by these overrides.

@vercel

vercel Bot commented Aug 30, 2026

Copy link
Copy Markdown

@irontaek is attempting to deploy a commit to the OpenStatus Team on Vercel.

A member of the Team first needs to authorize it.

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Aug 30, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Re-trigger cubic

@yoominho91
yoominho91 force-pushed the security/bump-hono-4.12.34 branch from f73401e to fc6bc33 Compare August 30, 2026 09:27
@yoominho91

yoominho91 commented Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

CI note: the first run passed the API job, while the server job failed during test cleanup with SQLITE_BUSY: database is locked. I refreshed the branch because external contributors cannot use GitHub's rerun action. On the second run the server job passed, while the API job hit the same SQLITE_BUSY error in unrelated database tests.

All other GitHub checks passed, and the failure moved between unrelated suites without a code change. Could a maintainer rerun the failed Tests workflow? The three Vercel statuses also report Authorization required to deploy, which requires team approval.

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Aug 30, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 2 files (changes from recent commits).

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread pnpm-workspace.yaml Outdated
@yoominho91
yoominho91 force-pushed the security/bump-hono-4.12.34 branch from fc6bc33 to 1feeecd Compare August 30, 2026 09:55
@yoominho91

yoominho91 commented Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Addressed in 1feeecd: the Hono override now uses hono: "catalog:", so the catalog is the single version source while transitive Hono copies remain pinned. I also tested the suggested $hono form with pnpm 11.2.1, but it fails here because the workspace root has no direct hono dependency. Frozen lockfile install, the targeted Hono audit (0 advisories), and pnpm verify (39/39) all pass with the catalog override.

@thibaultleouay

thibaultleouay commented Aug 31, 2026

Copy link
Copy Markdown
Member

@claude review this

@claude

claude Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @thibaultleouay's task in 55s —— View job

Review

  • Gather context (PR description, comments, review history)
  • Inspect pnpm-workspace.yaml changes
  • Inspect pnpm-lock.yaml changes
  • Verify the CORS/GHSA-8j4g-w8fx-2239 claim against actual usage
  • Post review feedback

Summary: This is a clean, well-scoped security patch bump. I verified the specific claims made in the PR description rather than taking them at face value:

  • ✅ CORS claim checked — cors() is called with default options (no allowHeaders override) in apps/server/src/routes/public/index.ts:9 and apps/server/src/routes/v1/index.ts:30, so the GHSA-8j4g-w8fx-2239 exposure described is accurate.
  • ✅ Single source of truth fixed — pnpm-workspace.yaml now sets hono: "catalog:" in the overrides block (per the 1feeecd follow-up), resolving cubic's P3 comment about the catalog/override divergence risk. The lockfile confirms overrides.hono resolves to 4.12.34, matching catalog.hono.
  • ✅ Transitive copies verified fixed — walked the pnpm-lock.yaml diff for the @modelcontextprotocol/sdk → @hono/node-server → hono chain; both [email protected] and [email protected] peer variants of the SDK now resolve to @hono/[email protected]([email protected]), so no stale 4.12.21/1.19.9 copies remain anywhere in the lockfile.
  • ✅ No other direct hono deps drift — apps/screenshot-service, apps/server, and apps/workflows all declare "hono": "catalog:" in package.json, so all workspace consumers stay pinned through the catalog + override combo.
  • ✅ CI is green — all 5 checks (Tests, Check, DX Check, autofix.ci) currently pass, so the earlier SQLITE_BUSY flakes mentioned in the thread are resolved on the latest commit.
  • ℹ️ Note on pnpm-lock.yaml importer entries: the diff shows hono: { specifier: 'catalog:' → specifier: 4.12.34 } for apps/server/apps/workflows/apps/screenshot-service importers even though package.json still says "catalog:". This is expected pnpm behavior — the lockfile snapshot reflects the override-resolved version, not a package.json edit — but worth knowing so it isn't mistaken for drift in a future diff review.

No correctness or security issues found. The changes are minimal and scoped exactly to what the description claims (catalog bump, node-server pin, override for transitive copies).

@yoominho91

yoominho91 commented Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Friendly ping — the review you kicked off came back with no correctness or security issues, cubic's catalog/override note is addressed in 1feeecd, and all checks are green. Nothing outstanding on my side.

Anything you'd like changed before this goes in?

@yoominho91
yoominho91 force-pushed the security/bump-hono-4.12.34 branch from 1feeecd to 7ab5425 Compare September 11, 2026 10:53
@irontaek
fix: update Hono security patches
f8bf51b 
Bumps the hono catalog entry to 4.12.34 and pins @hono/node-server to 1.19.15
through overrides, so every transitive copy picks up the patched versions.

Rebased onto pnpm 12 (openstatusHQ#2694). The lockfile diff is larger than the version
change: with pnpm 12.3.4, touching the lockfile at all rewrites peer-suffix
strings (e.g. `([email protected])`) across unrelated entries. A catalog-only
bump without the overrides produces the same ~840-line rewrite, and a no-op
install on main produces none, so the churn is the resolver, not the override.
@yoominho91
yoominho91 force-pushed the security/bump-hono-4.12.34 branch from 7ab5425 to f8bf51b Compare September 13, 2026 04:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cubic-dev-ai cubic-dev-ai[bot] cubic-dev-ai[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@yoominho91 @thibaultleouay @irontaek