Repository navigation
build(deps): @types/node 26 for the Node.js 26 LTS, @hono/node-server 2.1.5 - #16
Merged
Merged
Conversation
Node.js 26 became LTS "Lithium" on 2026-10-28. The server runs on Bun, so only the Node.js type definitions follow it: @types/node ^22.20.5 -> ^26.6.6 (published 2026-10-28, past the one-day release age). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bun audit fails on a moderate advisory in @hono/node-server 1.x: serveStatic decodes the request path twice and can bypass middleware on static paths (fixed in >=2.1.3). This server does not use serveStatic, but the audit blocks every PR and the base branch. The fix exists only in 2.x; @modelcontextprotocol/sdk accepts ^2.0.5, so one 2.1.5 copy remains. v2 keeps the public API. Its breaking changes are dropping Node.js 18 and the Vercel adapter; neither applies here (Bun runtime, only serve and HttpBindings are used). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
agentHits
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Зачем
28 октября 2026 года ветка Node.js 26 стала LTS под именем «Lithium». Сервер работает на Bun, поэтому от Node.js в проекте только типы
@types/node, и они отставали на две ветки: стояла 22.Заодно чинится аудит зависимостей, который с 29 октября был красным и на базовой ветке. В
@hono/node-server1.x нашли уязвимость средней тяжести:serveStaticдважды декодирует путь запроса, и запрос может обойти middleware на статических путях. Исправление вышло только в 2.x. СерверserveStaticне использует, но аудит блокировал все PR.Что изменилось
@types/node(devDependency)^22.20.5^26.6.6, вышел 2026-10-28, старше суток@hono/node-server^1.19.17^2.1.5, вышел 2026-10-13Публичный API у
@hono/node-server2.x тот же. Ломающих изменений два: отказ от Node.js 18 и удалён адаптер для Vercel. Ни одно к нам не относится: сервер работает на Bun и использует толькоserveиHttpBindings.@modelcontextprotocol/sdkдопускает^2.0.5, поэтому в проекте осталась одна копия 2.1.5. Код, образ (oven/bun:1.4.4) и версия Bun не менялись.Проверки
bun audit --audit-level=moderatebun run type-check(основной проект иguard)bun testbun run lint,bun run buildbuild/index.js/health200,/mcpбез токена 401,initializeс токеном возвращаетserverInfo🤖 Generated with Claude Code