From 831a381ab48502be8bba37c9d4520ba5114839a5 Mon Sep 17 00:00:00 2001 From: Jhin Lee Date: Fri, 13 Nov 2026 08:00:34 -0500 Subject: [PATCH 1/2] fix: patch Hono interoperability fixture dependencies --- test/interop/ts/README.md | 6 +++++- test/interop/ts/package-lock.json | 14 +++++++------- test/interop/ts/package.json | 2 +- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/test/interop/ts/README.md b/test/interop/ts/README.md index c2d602d5..04772583 100644 --- a/test/interop/ts/README.md +++ b/test/interop/ts/README.md @@ -9,13 +9,17 @@ fixtures in `../ts_2026_07_28/`. The manifest pins these transitive security fixes: -- `@hono/node-server 2.1.3` addresses +- `@hono/node-server 2.1.8` addresses [GHSA-rmxm-3fg6-px4f](https://github.com/advisories/GHSA-rmxm-3fg6-px4f). - `glob 14.0.2` addresses [GHSA-3g3m-2fjr-6pw4](https://github.com/advisories/GHSA-3g3m-2fjr-6pw4). - `minimatch 11.0.1` addresses [GHSA-g3hv-75wg-m249](https://github.com/advisories/GHSA-g3hv-75wg-m249). +The lockfile also resolves `hono 4.13.18` within the SDK's existing range for +Hono security fixes, including the mount-prefix middleware bypass described in +[GHSA-4m76-xfj5-7975](https://github.com/honojs/hono/security/advisories/GHSA-4m76-xfj5-7975). + The glob and minimatch overrides cross their parents' declared major ranges. They were selected explicitly for this Node 24 fixture; the matching behavior, filesystem tool calls, and lint file selection must remain covered by tests. diff --git a/test/interop/ts/package-lock.json b/test/interop/ts/package-lock.json index 30a3b962..9da22b67 100644 --- a/test/interop/ts/package-lock.json +++ b/test/interop/ts/package-lock.json @@ -192,15 +192,15 @@ } }, "node_modules/@hono/node-server": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.3.tgz", - "integrity": "sha512-TA//nWMqPhbfdfneACk6t5a9eqbS9lABEPyKn0/xZTah3H3U2XaVg85rJFl0/Fyit0I552YDHgXGVSf3GwqbUw==", + "version": "2.1.8", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.8.tgz", + "integrity": "sha512-jdf7FHh6A1lzjpHHQUgxsg2GeER2vMetnAOfeActzcoli6jamlK+NAwL6Dsr5Fl3BS3tYUQzCdtZjU8Qxv7bEA==", "license": "MIT", "engines": { "node": ">=20" }, "peerDependencies": { - "hono": "^4" + "hono": "^4 || ^5.0.0-0" } }, "node_modules/@humanfs/core": { @@ -1690,9 +1690,9 @@ } }, "node_modules/hono": { - "version": "4.13.13", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz", - "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==", + "version": "4.13.18", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.18.tgz", + "integrity": "sha512-H9q/E1XizaWstJxUW881dmLxEj+t/TrGGnyxINkm4+sK0qUwsMtFdo2BWI9Vs3cIS19MU6b6iCijoUoEf4f3DA==", "license": "MIT", "engines": { "node": ">=16.9.0" diff --git a/test/interop/ts/package.json b/test/interop/ts/package.json index 7262ffdd..4042ddbd 100644 --- a/test/interop/ts/package.json +++ b/test/interop/ts/package.json @@ -30,7 +30,7 @@ "typescript-eslint": "^8.72.1" }, "overrides": { - "@hono/node-server": "2.1.3", + "@hono/node-server": "2.1.8", "glob": "14.0.2", "minimatch": "11.0.1" }, From 581065df1a82622312f04ad5c30133ff16854550 Mon Sep 17 00:00:00 2001 From: Jhin Lee Date: Fri, 13 Nov 2026 08:15:48 -0500 Subject: [PATCH 2/2] ci: pin example tooling to compatible releases --- .github/workflows/test_core.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test_core.yml b/.github/workflows/test_core.yml index 30e8c7d7..a06de619 100644 --- a/.github/workflows/test_core.yml +++ b/.github/workflows/test_core.yml @@ -39,6 +39,8 @@ jobs: - name: Set up Flutter and Dart uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0 with: + # Keep formatter resolution before Jaspr's Dart 3.14 migration. + flutter-version: '3.47.9' channel: stable cache: true @@ -467,7 +469,8 @@ jobs: - name: Set up Dart uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1 with: - sdk: stable + # Retain the current Jaspr graph until its Dart 3.14 migration. + sdk: '3.13.7' - name: Install dependencies working-directory: example/jaspr-client @@ -494,6 +497,8 @@ jobs: - name: Set up Flutter uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0 with: + # Keep the existing Material API until the example is migrated. + flutter-version: '3.47.9' channel: stable cache: true