chore(deps): hono 4.13.5 and joi 18.2.8 override for bun audit - #131
Merged
Merged
Conversation
Three moderate advisories on hono <4.13.5 and two low on joi <18.2.5 (transitive via start-server-and-test > wait-on) were published on 2026-09-08 and now fail the Supply Chain job on every branch. hono is pinned exactly, so bump the pin. wait-on already allows joi ^18.2.3 but both it and start-server-and-test are exact pins, so bun update keeps the locked subtree; an overrides entry moves the transitive. Drop the override once wait-on raises its floor.
Contributor
🧪 Test Summary
|
yahyafakhroji
enabled auto-merge
September 9, 2026 02:01
gaghan430
approved these changes
Sep 9, 2026
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
hono4.13.0 → 4.13.5 (exact pin kept).joi18.2.3 → 18.2.8 insidestart-server-and-test › wait-on, via apackage.jsonoverridesentry ("joi": "^18.2.8").wait-onalready allows^18.2.3, but bothstart-server-and-testandwait-onare exact pins, sobun updatekeeps the locked subtree; the override is the lever that actually moves a transitive. It can be dropped oncewait-onships a floor ≥ 18.2.5.Why
bun auditin the Supply Chain job started failing on every branch, including ones that change no dependency, after five advisories were published on 2026-09-08:hono< 4.13.5: GHSA-gqvv-2mrq-wpjv (incomplete fix for CVE-2026-39408,toSSG()path escape), GHSA-g6gw-c38x-mqfc (parseBody()unbounded dot-notation nesting), GHSA-crvj-82cr-hjcx (query parser reads past the URL fragment).joi< 18.2.5: GHSA-6w3j-5fw6-r9vr and GHSA-gg4h-3hg2-grpc (prototype pollution via custom messages /object().rename()).main's last CI run (2026-09-08 02:31 UTC) passed this job; #130 failed it with an identical lockfile. This PR is the fix so #130 and any later branch can go green.Impact
Patch-level bumps only.
honois our HTTP server framework; 4.13.x → 4.13.5 has no API changes, and typecheck, the unit suite and E2E run in CI here.joiis a dev-only transitive of the E2E runner.Checklist
bun auditreports 0 vulnerabilities locallybun install --frozen-lockfilesucceedsbun run typecheckpassesCHANGELOG.mdentry: dependency-only, not user-facing