From fbf3ed77acc24eb5df00f8c8cf549c72f401a014 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 6 Aug 2026 15:23:38 +0000
Subject: [PATCH] FE-1324: Override @hono/node-server to 2.0.10 to clear the
 serve-static path traversal advisory

brunch resolved @hono/node-server 1.19.14 transitively via
@modelcontextprotocol/sdk (^1.19.9). That version is flagged by
GHSA-frvp-7c67-39w9 (path traversal in serve-static on Windows via an
encoded backslash).

Upstream backported the fix to 1.19.15 and latest-1 is now 1.19.17, but
the advisory range is still <2.0.5 (re-verified 2026-08-06 against the
GitHub advisory record and the npm bulk audit endpoint). An in-range
1.19.x bump therefore still fails the required Dependencies / Review
check, so pin an overrides entry instead, matching the existing hono and
ws pins.

2.0.10 rather than 2.0.5 because GHSA-9mqv-5hh9-4cgg covers
>=2.0.0 <=2.0.9. Drop the override once upstream narrows the range.
---
 package-lock.json | 8 ++++----
 package.json      | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index ab67855fb..9545a0db1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3425,13 +3425,13 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.14",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
-      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
+      "version": "2.0.10",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.10.tgz",
+      "integrity": "sha512-ZcnNVhKTmyDJeg0UlnZjvM73JBsTAuhrH/J4fjwGOw59PwOW51r4J+p6CsKZWXdKSme4MFqU62CZMOsdDrU4CA==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18.14.1"
+        "node": ">=20"
       },
       "peerDependencies": {
         "hono": "^4"
diff --git a/package.json b/package.json
index 4b590e427..70ce22dbc 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
   "overrides": {
     "esbuild": "^0.25.12",
     "react-inspector": "^9.0.0",
+    "@hono/node-server": "2.0.10",
     "hono": "4.12.25",
     "protobufjs": "7.6.4",
     "ws": "8.21.0"