fix(deps): drop @hono/node-server override to patch GHSA-wc8c-qw6v-h7f6 (#535)

The override pinning @hono/node-server to 1.19.7 was added in 71976101
as a workaround when @modelcontextprotocol/sdk 1.25.3 required ^1.19.9,
which did not yet exist on the public npm registry.

That constraint is now obsolete: the SDK is pinned to 1.25.2 (requires
^1.19.7), and 1.19.8-1.19.11 have since been published. Removing the
override lets npm naturally resolve 1.19.11, which includes the fix for
the HIGH-severity auth bypass in the Serve Static middleware
(GHSA-wc8c-qw6v-h7f6, fixed in 1.19.10).

Lockfile regenerated against registry.npmjs.org (no artifactory URLs).
This commit is contained in:
Olivier Chafik 2026-03-06 17:22:34 +00:00 • committed by GitHub
commit bf623f832d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -124,7 +124,6 @@
"seroval": "1.4.1",
"seroval-plugins": "1.4.2",
"solid-js": "1.9.10",
"@hono/node-server": "1.19.7",
"@types/node": "20.19.27"
}
}