From 56b9946be3a5008c9d95ddee893bf4c8e0e0d546 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 08:31:45 +0000 Subject: [PATCH 1/4] FE-1286: Bump seroval, postcss and @hono/node-server (security) Lockfile-only security bumps for the three findings from the 2026-07-27 npm scan not covered by #332 or open Dependabot PRs: - seroval 1.5.2 -> 1.5.6 (CRITICAL GHSA-mv8w-475r-vwqw) - postcss 8.5.14 -> 8.5.23 (HIGH GHSA-r28c-9q8g-f849), pulls nanoid 3.3.11 -> 3.3.16 via its updated range - @hono/node-server 1.19.14 -> 2.0.5 (MODERATE GHSA-frvp-7c67-39w9) via a new package.json override, since the only dependent (@modelcontextprotocol/sdk) pins ^1.19.9 and the fix is 2.x-only Verified with npm ci --dry-run --ignore-scripts. --- package-lock.json | 28 ++++++++++++++-------------- package.json | 1 + 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/package-lock.json b/package-lock.json index 509b75f5f..87c3326eb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3456,13 +3456,13 @@ } }, "node_modules/@hono/node-server": { - "version": "1.19.14", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz", - "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==", + "version": "2.0.5", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.5.tgz", + "integrity": "sha512-yQFvDmyDo3y6rEOJZDUYPJ49DIKTPpIk4kGvm40xx4Ejne0Pu9a1+exxPN+C1UppWK/WGZX9F++/Xs231tE86g==", "devOptional": true, "license": "MIT", "engines": { - "node": ">=18.14.1" + "node": ">=20" }, "peerDependencies": { "hono": "^4" @@ -19550,9 +19550,9 @@ } }, "node_modules/postcss": { - "version": "8.5.14", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz", - "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "funding": [ { "type": "opencollective", @@ -19569,7 +19569,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.11", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -19592,9 +19592,9 @@ } }, "node_modules/postcss/node_modules/nanoid": { - "version": "3.3.11", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz", - "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "funding": [ { "type": "github", @@ -21098,9 +21098,9 @@ } }, "node_modules/seroval": { - "version": "1.5.2", - "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.2.tgz", - "integrity": "sha512-xcRN39BdsnO9Tf+VzsE7b3JyTJASItIV1FVFewJKCFcW4s4haIKS3e6vj8PGB9qBwC7tnuOywQMdv5N4qkzi7Q==", + "version": "1.5.6", + "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.5.6.tgz", + "integrity": "sha512-rVQVWjjSvlINzaQPZH5JFqsqEsIWdTxY3iJZCnTL/5gQbXIRooVZKI60tVCkOVfzcRPejboxO2t0P89dg5mQaA==", "license": "MIT", "engines": { "node": ">=10" diff --git a/package.json b/package.json index ecef0f8a9..7079b1edd 100644 --- a/package.json +++ b/package.json @@ -29,6 +29,7 @@ "access": "public" }, "overrides": { + "@hono/node-server": "2.0.5", "esbuild": "^0.25.12", "react-inspector": "^9.0.0", "hono": "4.12.25", From 010b93216325450d74852ae46f5f71e9778f3072 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 08:33:35 +0000 Subject: [PATCH 2/4] FE-1286: Bump @hono/node-server override to 2.0.10 2.0.5 does not cover GHSA-9mqv-5hh9-4cgg, which is only patched in 2.0.10; Dependency Review flagged the earlier bump as insufficient. --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 87c3326eb..f36417dcb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3456,9 +3456,9 @@ } }, "node_modules/@hono/node-server": { - "version": "2.0.5", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.5.tgz", - "integrity": "sha512-yQFvDmyDo3y6rEOJZDUYPJ49DIKTPpIk4kGvm40xx4Ejne0Pu9a1+exxPN+C1UppWK/WGZX9F++/Xs231tE86g==", + "version": "2.0.10", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.10.tgz", + "integrity": "sha512-ZcnNVhKTmyDJeg0UlnZjvM73JBsTAuhrH/J4fjwGOw59PwOW51r4J+p6CsKZWXdKSme4MFqU62CZMOsdDrU4CA==", "devOptional": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 7079b1edd..137dd0b49 100644 --- a/package.json +++ b/package.json @@ -29,7 +29,7 @@ "access": "public" }, "overrides": { - "@hono/node-server": "2.0.5", + "@hono/node-server": "2.0.10", "esbuild": "^0.25.12", "react-inspector": "^9.0.0", "hono": "4.12.25", From ffb6d8cdb3da3b45ec77555e80af098e12db284b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 23:05:00 +0000 Subject: [PATCH 3/4] Use @hono/node-server 1.19.17 backport instead of 2.0.10 override The GHSA-frvp-7c67-39w9 path-traversal fix was backported to @hono/node-server 1.19.15, so @modelcontextprotocol/sdk's ^1.19.9 range now resolves in-range to 1.19.17 without forcing a major bump. GHSA-9mqv-5hh9-4cgg only affects 2.0.0-2.0.9 and never applied to 1.x. --- package-lock.json | 28 ++++++++++++++-------------- package.json | 1 - 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/package-lock.json b/package-lock.json index f36417dcb..86dbd68dc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1561,7 +1561,7 @@ "typebox": "1.1.38" }, "bin": { - "pi-ai": "./dist/cli.js" + "pi-ai": "dist/cli.js" }, "engines": { "node": ">=22.19.0" @@ -3455,19 +3455,6 @@ "url": "https://github.com/sponsors/ayuhito" } }, - "node_modules/@hono/node-server": { - "version": "2.0.10", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.10.tgz", - "integrity": "sha512-ZcnNVhKTmyDJeg0UlnZjvM73JBsTAuhrH/J4fjwGOw59PwOW51r4J+p6CsKZWXdKSme4MFqU62CZMOsdDrU4CA==", - "devOptional": true, - "license": "MIT", - "engines": { - "node": ">=20" - }, - "peerDependencies": { - "hono": "^4" - } - }, "node_modules/@iconify/types": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz", @@ -5498,6 +5485,19 @@ } } }, + "node_modules/@modelcontextprotocol/sdk/node_modules/@hono/node-server": { + "version": "1.19.17", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz", + "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==", + "devOptional": true, + "license": "MIT", + "engines": { + "node": ">=18.14.1" + }, + "peerDependencies": { + "hono": "^4" + } + }, "node_modules/@modelcontextprotocol/sdk/node_modules/ajv": { "version": "8.18.0", "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz", diff --git a/package.json b/package.json index 137dd0b49..ecef0f8a9 100644 --- a/package.json +++ b/package.json @@ -29,7 +29,6 @@ "access": "public" }, "overrides": { - "@hono/node-server": "2.0.10", "esbuild": "^0.25.12", "react-inspector": "^9.0.0", "hono": "4.12.25", From f1ad8127421a7d566a876f563443179a6051f954 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 23:17:32 +0000 Subject: [PATCH 4/4] Revert "Use @hono/node-server 1.19.17 backport instead of 2.0.10 override" This reverts commit ffb6d8cdb3da3b45ec77555e80af098e12db284b. --- package-lock.json | 28 ++++++++++++++-------------- package.json | 1 + 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/package-lock.json b/package-lock.json index 86dbd68dc..f36417dcb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1561,7 +1561,7 @@ "typebox": "1.1.38" }, "bin": { - "pi-ai": "dist/cli.js" + "pi-ai": "./dist/cli.js" }, "engines": { "node": ">=22.19.0" @@ -3455,6 +3455,19 @@ "url": "https://github.com/sponsors/ayuhito" } }, + "node_modules/@hono/node-server": { + "version": "2.0.10", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.10.tgz", + "integrity": "sha512-ZcnNVhKTmyDJeg0UlnZjvM73JBsTAuhrH/J4fjwGOw59PwOW51r4J+p6CsKZWXdKSme4MFqU62CZMOsdDrU4CA==", + "devOptional": true, + "license": "MIT", + "engines": { + "node": ">=20" + }, + "peerDependencies": { + "hono": "^4" + } + }, "node_modules/@iconify/types": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz", @@ -5485,19 +5498,6 @@ } } }, - "node_modules/@modelcontextprotocol/sdk/node_modules/@hono/node-server": { - "version": "1.19.17", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz", - "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==", - "devOptional": true, - "license": "MIT", - "engines": { - "node": ">=18.14.1" - }, - "peerDependencies": { - "hono": "^4" - } - }, "node_modules/@modelcontextprotocol/sdk/node_modules/ajv": { "version": "8.18.0", "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz", diff --git a/package.json b/package.json index ecef0f8a9..137dd0b49 100644 --- a/package.json +++ b/package.json @@ -29,6 +29,7 @@ "access": "public" }, "overrides": { + "@hono/node-server": "2.0.10", "esbuild": "^0.25.12", "react-inspector": "^9.0.0", "hono": "4.12.25",