From 130044fb3a2161a5fae04ea52b1d1abf77b980c3 Mon Sep 17 00:00:00 2001 From: idapixl Date: Mon, 6 Jul 2026 21:43:43 -0700 Subject: [PATCH] fix(deps): bump transitive hono 4.12.23 -> 4.12.28 in lockfile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hono <4.12.26 carries a high-severity CORS wildcard-reflection advisory plus four medium ones (path traversal, Lambda header handling). The pin comes transitively via @modelcontextprotocol/sdk under the cortex-engine devDependency, so this only affects contributor/CI installs — the published package is unaffected. Dependabot never surfaced an alert for this repo (stale dependency graph); this push should also force a rescan. Verified: npm audit clean (0 vulnerabilities), tsc build green. Co-Authored-By: Claude Fable 5 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 6a0bd16..4094b19 100644 --- a/package-lock.json +++ b/package-lock.json @@ -860,9 +860,9 @@ } }, "node_modules/hono": { - "version": "4.12.23", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.23.tgz", - "integrity": "sha512-eIaZ9qDgu7XV0pxOCrg7/WhnQ6Ivm22UcxhXx/A3dcbqbbYgBEkc6e/J/s7j2tS96zoB0S9VBdLwQNCWwUo4LA==", + "version": "4.12.28", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz", + "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==", "dev": true, "license": "MIT", "engines": {