Take hono to 4.13.7 and let Dependabot open the next one #312

New Issue

Closed

opened 2026-09-10 13:22:15 +00:00 by jcoffey-dev · 0 comments

jcoffey-dev commented

2026-09-10 13:22:15 +00:00

Owner

Closes three of the five open Dependabot alerts, and sets up the config that should have surfaced them as PRs in the first place.

hono 4.13.3 → 4.13.7

Three medium advisories, all fixed in 4.13.5:

GHSA	Issue	Exposure here
`gqvv-2mrq-wpjv`	`toSSG()` writes files outside the output directory	None — `toSSG` is never called
`crvj-82cr-hjcx`	Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials	Low — `c.req.query()` is read in `imageproxy.ts`, `icsproxy.ts` and `app.ts`, but `safeFetch` validates the value it actually fetches rather than a separate pre-check, so there is nothing to desync
`g6gw-c38x-mqfc`	Unbounded dot-notation nesting in `parseBody()` can exhaust memory	None — `parseBody` is never called

A patch release with no API change, so it is worth taking regardless of how little of it we are exposed to. The declared range moves from ^4.7.4 to ^4.13.7 as well, so the security floor is recorded in server/package.json and not only in the lockfile.

dependabot.yml

There was no config at all, which is why nothing opened a PR and the alerts sat on the dashboard until someone went looking. One npm entry at the root covers server and web, since they share a single lockfile as one workspace; github-actions and docker entries keep the pinned node:22-alpine base and the action versions moving between weekly releases.

Routine minor and patch updates group into one PR a week. Majors are left out of the group on purpose — they are migrations rather than bumps, and each should carry its own CI run.

Still open after this

Alerts 4 and 5, GHSA-82fw-gwwq-j7x9 — path traversal in @vitest/mocker. There is no fix in the 3.x line: patched versions are 4.1.11 and 5.0.0-rc.2 only, so clearing them is a major bump from 3.2.7 across 133 test files in web. Server tests use tsx --test and are unaffected. Dev-only exposure, no browser mode configured. Worth its own PR.

Verification

npm run typecheck, npm test (168 server tests plus the web suite) and npm run build all pass locally.

Merged 2026-09-10 as coffey-labs/ihasmail@9418d3f935

_{Rebuilt from: git history, session transcript.}

Closes three of the five open Dependabot alerts, and sets up the config that should have surfaced them as PRs in the first place. ## hono 4.13.3 → 4.13.7 Three medium advisories, all fixed in 4.13.5: | GHSA | Issue | Exposure here | |---|---|---| | `gqvv-2mrq-wpjv` | `toSSG()` writes files outside the output directory | None — `toSSG` is never called | | `crvj-82cr-hjcx` | Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials | Low — `c.req.query()` is read in `imageproxy.ts`, `icsproxy.ts` and `app.ts`, but `safeFetch` validates the value it actually fetches rather than a separate pre-check, so there is nothing to desync | | `g6gw-c38x-mqfc` | Unbounded dot-notation nesting in `parseBody()` can exhaust memory | None — `parseBody` is never called | A patch release with no API change, so it is worth taking regardless of how little of it we are exposed to. The declared range moves from `^4.7.4` to `^4.13.7` as well, so the security floor is recorded in `server/package.json` and not only in the lockfile. ## dependabot.yml There was no config at all, which is why nothing opened a PR and the alerts sat on the dashboard until someone went looking. One npm entry at the root covers server and web, since they share a single lockfile as one workspace; github-actions and docker entries keep the pinned `node:22-alpine` base and the action versions moving between weekly releases. Routine minor and patch updates group into one PR a week. Majors are left out of the group on purpose — they are migrations rather than bumps, and each should carry its own CI run. ## Still open after this Alerts 4 and 5, `GHSA-82fw-gwwq-j7x9` — path traversal in `@vitest/mocker`. There is no fix in the 3.x line: patched versions are 4.1.11 and 5.0.0-rc.2 only, so clearing them is a major bump from 3.2.7 across 133 test files in `web`. Server tests use `tsx --test` and are unaffected. Dev-only exposure, no browser mode configured. Worth its own PR. ## Verification `npm run typecheck`, `npm test` (168 server tests plus the web suite) and `npm run build` all pass locally. **Merged** 2026-09-10 as coffey-labs/ihasmail@9418d3f93589 <sub>Rebuilt from: git history, session transcript.</sub>

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coffey-labs/ihasmail-github-archive#312