fix(deps): patch @hono/node-server path-traversal (MEDIUM, GHSA-frvp-7c67-39w9)#124
Merged
Merged
Conversation
Override @hono/node-server to ^2.0.5 (resolves 2.0.11) to close GHSA-frvp-7c67-39w9 — path traversal in serve-static on Windows via encoded backslash (%5C). No 1.x patch exists; the fix ships only in 2.x. Transitive via shadcn -> @modelcontextprotocol/sdk (^1.19.9), which is only reachable through shadcn's MCP CLI, not the runtime app. Latest MCP SDK (1.29.0) still pins hono/node-server ^1.x, so an override is the only path to the patched line. Diff limited to package.json + package-lock.json.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the last open Dependabot advisory on this repo (the other four — #121, #122, #123 — are already merged).
Change (transitive-only)
@hono/node-serveroverrides: ^2.0.5)serve-staticon Windows via encoded backslash (%5C), patched in 2.0.5Why an override (and why a major bump)
There is no patched 1.x release — the fix ships only in the 2.x line. The dependency chain is:
shadcn→@modelcontextprotocol/sdk@1.29.0(^1.19.9) →@hono/node-serverEven the latest MCP SDK (1.29.0, already installed) still pins
@hono/node-serverto^1.x, so bumping the SDK doesn't help — anoverridesentry is the only way to reach the patched version.Blast radius
@hono/node-serveris reachable only through shadcn's MCP CLI feature, not the deployed Next.js app's runtime, and the vuln is Windows-specific. So forcing the 2.x major has minimal risk here.Verification
npm ci(pinnednpm@10.9.8) clean,eslintclean, 292/292 vitest tests pass locally.package.json+package-lock.json(8 lockfile lines); no other dependency changed.