[roomote-roomote]

​Opened on behalf of @daniel-lxs. View the session or mention @roomote-roomote for follow-up asks.

Related issue

Security maintenance for GHSA-rmxm-3fg6-px4f (medium, CVSS 5.3). No linked repository issue.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

Bump the three direct @hono/node-server pins and existing workspace-wide override from 2.0.10 to 2.1.3. Update the lockfile resolution, integrity and MCP SDK transitive reference. No unrelated package upgrades or package-manager policy changes.

The advisory identifies >=1.19.10 <2.1.3 as affected and 2.1.3 as the first patched release for inconsistent static-path decoding. Upstream release notes confirm the fix. Official package metadata requires Node >=20 and Hono ^4, compatible with the repository's Node ranges and unchanged Hono 4.13.11. The September 29 release satisfies the existing seven-day minimum release age without an exception.

No intended change to ordinary serving. Upstream now rejects remaining percent signs in decoded static paths by default; applications intentionally serving literal-percent filenames require upstream's allowPercentInPath option. No application settings were changed.

How it was tested

On Node 24.22.1 and pnpm 10.29.3:

• Frozen install passes with the minimal final lockfile; pnpm -r why @hono/node-server confirms direct and transitive resolution to 2.1.3.
• Local HTTP smoke against the installed adapter passes for both serve and createAdaptorServer: JSON health, static text GET, ordinary encoded-space filenames, HEAD and missing-file 404. This is an isolated normal-serving check, not full application end-to-end coverage.
• API graceful shutdown tests: 7 pass. BullMQ dashboard authentication and health tests: 20 pass. Initial API test startup overlapped installation and failed to resolve Vitest; the post-install rerun passes. Both attempts are retained in the log.
• Affected-package typechecks pass. Normal pre-push gates pass: oxlint, residual ESLint, repository-wide fast typechecks (27 tasks) and knip (one non-failing existing configuration hint).
• Pre-commit formatting hook and git diff --check pass.
• Full test suite, production build/deployment, Node 22, full running application flows and exploit reproduction were not checked. Browser proof is not applicable to this dependency-only change.

Validation log: commands, exit codes and output. Normal-serving smoke source.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
  • Ran the repository's normal lint:fast-equivalent pre-push gates and check-types:fast successfully; formatting-inclusive full commands were not run.
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset
  • No changeset added for this scoped dependency security patch.

[roomote-community]

No code issues found. See session

Reviewed all five changed files, direct and transitive dependency alignment, registry integrity and Node/Hono compatibility, and API, BullMQ static-file, and worker adapter usage. No concrete regression identified.

CI: completed checks are passing, including lint, Knip and CodeQL. Tests, typechecking, Docker builds and upgrade compatibility are still running. Repository validation suites were left to CI.

_{Reviewed 625b408}