From 342bd8ca6beef56234dc0e87d0407379880a7a6e Mon Sep 17 00:00:00 2001 From: sim Date: Tue, 8 Sep 2026 22:01:15 -0400 Subject: [PATCH] fix: backfill changeset fragment PR number for #4560 Forgot the pr:0 -> real-number backfill step from CONTRIBUTING.md's documented changeset workflow after opening PR #4560, which broke changeset-lint and docs-lint (fail_invalid_fragment / fail_malformed_fragment). Co-Authored-By: Claude Sonnet 5 --- .changeset/zesty-seals-click.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/zesty-seals-click.md b/.changeset/zesty-seals-click.md index 7cc2694e1..c05bf7f00 100644 --- a/.changeset/zesty-seals-click.md +++ b/.changeset/zesty-seals-click.md @@ -1,5 +1,5 @@ --- type: Security -pr: 0 +pr: 4560 --- **Pinned the transitive `hono` dependency to `>=4.13.5`** — fixes a moderate-severity path-traversal/DoS advisory chain (GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc, GHSA-crvj-82cr-hjcx) in `hono <4.13.5`, pulled in transitively via `@anthropic-ai/claude-agent-sdk` -> `@modelcontextprotocol/sdk`. Discovered as a newly-published advisory blocking `tests/npm-integrity-gate.test.cjs` while verifying an unrelated PR; fixed inline per this repo's no-defer policy rather than left for a separate PR. (#4513)