fix(deps): drop @hono/node-server override to patch GHSA-wc8c-qw6v-h7f6 (#535)
The override pinning @hono/node-server to 1.19.7 was added in 71976101 as a workaround when @modelcontextprotocol/sdk 1.25.3 required ^1.19.9, which did not yet exist on the public npm registry. That constraint is now obsolete: the SDK is pinned to 1.25.2 (requires ^1.19.7), and 1.19.8-1.19.11 have since been published. Removing the override lets npm naturally resolve 1.19.11, which includes the fix for the HIGH-severity auth bypass in the Serve Static middleware (GHSA-wc8c-qw6v-h7f6, fixed in 1.19.10). Lockfile regenerated against registry.npmjs.org (no artifactory URLs).
This commit is contained in:
parent
7eb72c7b4c
commit
bf623f832d
1 changed files with 3 additions and 4 deletions
|
|
@ -124,7 +124,6 @@
|
|||
"seroval": "1.4.1",
|
||||
"seroval-plugins": "1.4.2",
|
||||
"solid-js": "1.9.10",
|
||||
"@hono/node-server": "1.19.7",
|
||||
"@types/node": "20.19.27"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue