#48 cleared 10 of the 15 open Dependabot alerts. Of the 5 left, four are dev-only (vite ×2, esbuild ×1 — all arriving via vitest, never in a published tarball; Renovate #24 already bumps vitest independently).
The fifth is this one, and it's the only remaining alert in a runtime path:
|
|
| package |
@hono/node-server |
| current |
1.19.14 |
| patched |
2.0.5 |
| severity |
medium |
| scope |
runtime (transitive — no manifest declares it) |
It was deliberately kept out of #48 because 1.19.14 → 2.0.5 is a major version jump, and a breaking-change bump does not belong riding inside a patch-level security PR where it can't be assessed separately.
What this needs
- Find what pulls it in — it's transitive, so first establish whether anything in the workspace actually exercises it or whether it arrives purely as a peer of
hono.
- Read the 2.0 release notes for the API break.
- If forcing it needs a
pnpm.overrides entry, weigh that against the exposure — an override is a permanent manifest pin.
- Verify locally, not by audit summary.
pnpm audit compares version numbers and never loads the module; the same class of false green is documented in wave-av/claude-workstation#554, where an override took audit to 0 vulnerabilities and passed 195/195 tests while the dependency was fully broken at runtime.
Blocked on the same thing as everything else
CI cannot run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes). Verification would have to be local, as it was for #48 (pnpm -r build + pnpm -r test → 143 tests / 48 packages green).
Follow-up from #48. Part of the publishing audit in #42.
#48 cleared 10 of the 15 open Dependabot alerts. Of the 5 left, four are dev-only (
vite×2,esbuild×1 — all arriving viavitest, never in a published tarball; Renovate #24 already bumps vitest independently).The fifth is this one, and it's the only remaining alert in a runtime path:
@hono/node-serverIt was deliberately kept out of #48 because
1.19.14 → 2.0.5is a major version jump, and a breaking-change bump does not belong riding inside a patch-level security PR where it can't be assessed separately.What this needs
hono.pnpm.overridesentry, weigh that against the exposure — an override is a permanent manifest pin.pnpm auditcompares version numbers and never loads the module; the same class of false green is documented in wave-av/claude-workstation#554, where an override took audit to 0 vulnerabilities and passed 195/195 tests while the dependency was fully broken at runtime.Blocked on the same thing as everything else
CI cannot run — Actions are refusing every job org-wide on an account-level billing lock (
plan=free,locked=yes). Verification would have to be local, as it was for #48 (pnpm -r build+pnpm -r test→ 143 tests / 48 packages green).Follow-up from #48. Part of the publishing audit in #42.