From ed9737c71a58859f756d08dd8c6a1f06e041c791 Mon Sep 17 00:00:00 2001
From: aaronjmars <61592645+aaronjmars@users.noreply.github.com>
Date: Thu, 23 Jul 2026 18:21:44 -0400
Subject: [PATCH] fix(deps): patch @hono/node-server path-traversal advisory
 (MEDIUM)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Override @hono/node-server to ^2.0.5 (resolves 2.0.11) to close
GHSA-frvp-7c67-39w9 — path traversal in serve-static on Windows via
encoded backslash (%5C). No 1.x patch exists; the fix ships only in 2.x.

Transitive via shadcn -> @modelcontextprotocol/sdk (^1.19.9), which is
only reachable through shadcn's MCP CLI, not the runtime app. Latest MCP
SDK (1.29.0) still pins hono/node-server ^1.x, so an override is the only
path to the patched line. Diff limited to package.json + package-lock.json.
---
 package-lock.json | 8 ++++----
 package.json      | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index bc6dfa3..6ced1c3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1733,12 +1733,12 @@
       "license": "MIT"
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.14",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
-      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.11.tgz",
+      "integrity": "sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==",
       "license": "MIT",
       "engines": {
-        "node": ">=18.14.1"
+        "node": ">=20"
       },
       "peerDependencies": {
         "hono": "^4"
diff --git a/package.json b/package.json
index 6cc95e5..0a2c974 100644
--- a/package.json
+++ b/package.json
@@ -66,6 +66,7 @@
   "overrides": {
     "postcss": "^8.5.10",
     "sharp": "^0.35.0",
+    "@hono/node-server": "^2.0.5",
     "@esbuild-kit/core-utils": {
       "esbuild": "^0.25.10"
     }