From bba20b51fde4ab7493d13af30b6da23e780525f7 Mon Sep 17 00:00:00 2001
From: sim <sim@local>
Date: Tue, 8 Sep 2026 21:33:51 -0400
Subject: [PATCH] fix: pin transitive hono dependency to >=4.13.5 (moderate
 advisory)

A moderate-severity advisory chain (GHSA-gqvv-2mrq-wpjv,
GHSA-g6gw-c38x-mqfc, GHSA-crvj-82cr-hjcx) was newly published against
hono <4.13.5, pulled in transitively via @anthropic-ai/claude-agent-sdk
-> @modelcontextprotocol/sdk. Discovered blocking
tests/npm-integrity-gate.test.cjs while verifying #4513 (unrelated to
that batch's diff); fixed inline per this repo's no-defer policy.

Adds "hono": ">=4.13.5" to package.json's existing overrides block
(same pattern already used for qs, body-parser, @hono/node-server).
npm audit --omit=dev now reports 0 vulnerabilities.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .changeset/zesty-seals-click.md | 5 +++++
 package-lock.json               | 6 +++---
 package.json                    | 3 ++-
 3 files changed, 10 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/zesty-seals-click.md

diff --git a/.changeset/zesty-seals-click.md b/.changeset/zesty-seals-click.md
new file mode 100644
index 000000000..7cc2694e1
--- /dev/null
+++ b/.changeset/zesty-seals-click.md
@@ -0,0 +1,5 @@
+---
+type: Security
+pr: 0
+---
+**Pinned the transitive `hono` dependency to `>=4.13.5`** — fixes a moderate-severity path-traversal/DoS advisory chain (GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc, GHSA-crvj-82cr-hjcx) in `hono <4.13.5`, pulled in transitively via `@anthropic-ai/claude-agent-sdk` -> `@modelcontextprotocol/sdk`. Discovered as a newly-published advisory blocking `tests/npm-integrity-gate.test.cjs` while verifying an unrelated PR; fixed inline per this repo's no-defer policy rather than left for a separate PR. (#4513)
diff --git a/package-lock.json b/package-lock.json
index fce181925..38a77f2a1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3615,9 +3615,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.0",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
-      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
+      "version": "4.13.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
+      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
diff --git a/package.json b/package.json
index 99019bdcc..e3cc83000 100644
--- a/package.json
+++ b/package.json
@@ -85,7 +85,8 @@
   "overrides": {
     "qs": ">=6.15.2",
     "body-parser": ">=2.3.0",
-    "@hono/node-server": ">=2.0.5"
+    "@hono/node-server": ">=2.0.5",
+    "hono": ">=4.13.5"
   },
   "optionalDependencies": {
     "fallow": "^2.70.0"