FE-1324: Override @hono/node-server to 2.0.10 to clear the serve-static path traversal advisory

[claude]

Requested by Ciaran Morinan · Slack thread

Replaces #383. That PR bundled three security bumps; two of them (seroval 1.5.6 and postcss 8.5.25 / nanoid 3.3.17) have since landed independently on main via #387 and #404, so @hono/node-server is all that was left. This is that one fix, rebased onto current main, with nothing else in it.

Before

@modelcontextprotocol/sdk declares @hono/node-server: ^1.19.9, and the lockfile resolved that to 1.19.14. That version is covered by GHSA-frvp-7c67-39w9 — path traversal in serve-static on Windows, where an encoded backslash (%5C) decodes to a Windows path separator and lets a request slip past prefix-mounted middleware. Moderate severity. No other open PR covers it (#408 bumps hono, the framework, which is a different package).

After

A pinned overrides entry forces 2.0.10, in the same style as the existing hono and ws pins:

"@hono/node-server": "2.0.10",

@hono/node-server 1.19.14 is gone from package-lock.json — one entry, replaced in place, and no other package moved.

Package	From	To	Advisory closed
@hono/node-server	1.19.14	2.0.10 (override)	GHSA-frvp-7c67-39w9

Why 2.0.10 and not a 1.19.x bump

This is the awkward part, and it hasn't improved since #383.

Upstream did backport the traversal fix into the 1.x line at 1.19.15, and latest-1 is now 1.19.17. So on the merits, an in-range bump to 1.19.17 would fix the bug without a major version change — much cleaner. I re-checked whether the advisory had caught up, on 2026-08-06:

• The GitHub advisory record for GHSA-frvp-7c67-39w9 still lists affected as < 2.0.5, patched 2.0.5. Last reviewed 2026-07-21.
• npm's bulk audit endpoint (the same advisory data the tooling consumes) reports 1.19.17 as vulnerable, range <2.0.5. 2.0.10 comes back clean.

The range has not been narrowed. Because Dependencies / Review is a required status check here via the org-wide ruleset, a 1.19.17 lockfile would still be rejected by the gate — #383 tried exactly that and had to revert it. So the override stays until upstream fixes the range.

Why 2.0.10 specifically, and not 2.0.5: GHSA-9mqv-5hh9-4cgg — unauthenticated memory-leak DoS via an aborted WebSocket handshake — covers >= 2.0.0 <= 2.0.9. Worth being precise about this one: it does not affect the 1.19.14 we're on today, so it isn't a bug we currently have. It's a landmine in the escape route. Any override landing in 2.0.0–2.0.9 would trade the traversal advisory for a DoS advisory; 2.0.10 is the first version clean on both.

Worth a reviewer's eye

This force-resolves a major version (1.x → 2.x) underneath @modelcontextprotocol/sdk, which asked for ^1.19.9. The peer requirement hono: ^4 is still satisfied by our pinned 4.12.25, and the build passes, but a type-level pass is not the same as a runtime pass. A smoke test of MCP server functionality before merge is the thing I'd most want a second pair of eyes on.

Follow-up

When upstream narrows GHSA-frvp-7c67-39w9 to admit the 1.19.x backport, delete this override and let @modelcontextprotocol/sdk resolve in range again. Tracked on the Linear issue.

Verification

• npm run verify — check and build pass. test has 3 failures (sandbox-guard.test.ts ×2, petrinaut-events.test.ts ×1), all of which reproduce identically on unmodified main in the same container; they are environment-sensitive (bwrap availability) and unrelated to this change.
• Lockfile audited: @hono/node-server 1.19.14 removed, 2.0.10 added, nothing else touched.

Linear: FE-1324

[cursor]

PR Summary

Medium Risk
Forces a major semver jump (1.x → 2.x) on a transitive dependency used by the MCP SDK; build passes but runtime MCP behavior deserves a quick smoke test.

Overview
Pins @hono/node-server to 2.0.10 via a new npm overrides entry (alongside existing hono / ws pins), so the lockfile no longer resolves 1.19.14 from @modelcontextprotocol/sdk’s ^1.19.9 range.

This closes GHSA-frvp-7c67-39w9 (serve-static path traversal on Windows). 2.0.10 is chosen so the override is also clear of the WebSocket DoS advisory that affects 2.0.0–2.0.9. The lockfile update is limited to swapping that package’s version, engine floor (>=20), and integrity hash.

^{Reviewed by Cursor Bugbot for commit fbf3ed7. Bugbot is set up for automated code reviews on this repo. Configure here.}