diff --git a/.changeset/widen-hono-node-server-range.md b/.changeset/widen-hono-node-server-range.md new file mode 100644 index 0000000000..30a73b35c8 --- /dev/null +++ b/.changeset/widen-hono-node-server-range.md @@ -0,0 +1,5 @@ +--- +'@modelcontextprotocol/node': patch +--- + +Widen the `@hono/node-server` range to `^1.19.9 || ^2.0.5` so installs can resolve past GHSA-frvp-7c67-39w9 (Windows-only path traversal in `serve-static`, moderate severity; fixed in 2.0.5 — no patched 1.x exists). This mirrors the v1.x fix (#2549, shipped in 1.30.0), which was merged on a branch that does not use changesets and therefore could not propagate here. `getRequestListener` — the only symbol this package imports — keeps the same signature and contract in 2.x, the root entry's exports are a superset of 1.x's, and the `hono@^4` peer is the same; 2.x does drop the `./vercel` subpath and ships `.d.mts`/`.d.cts` declarations only, neither of which this package relies on. `@hono/node-server@2` requires Node >= 20, matching this package's existing engines floor. diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c663ad7086..bd351255bf 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -96,8 +96,8 @@ catalogs: version: 6.2.2 runtimeServerOnly: '@hono/node-server': - specifier: ^1.19.9 - version: 1.19.11 + specifier: ^1.19.9 || ^2.0.5 + version: 2.0.11 cors: specifier: ^2.8.5 version: 2.8.6 @@ -306,7 +306,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:^ version: link:shared @@ -432,7 +432,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -504,7 +504,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -529,7 +529,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -551,7 +551,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -598,7 +598,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -642,7 +642,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -667,7 +667,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -726,7 +726,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -810,7 +810,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -835,7 +835,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -894,7 +894,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -916,7 +916,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -941,7 +941,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -1148,7 +1148,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -1173,7 +1173,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -1198,7 +1198,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -1223,7 +1223,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -1248,7 +1248,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -1270,7 +1270,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@mcp-examples/shared': specifier: workspace:* version: link:../shared @@ -1728,7 +1728,7 @@ importers: dependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) hono: specifier: catalog:runtimeServerOnly version: 4.12.9 @@ -1989,7 +1989,7 @@ importers: devDependencies: '@hono/node-server': specifier: catalog:runtimeServerOnly - version: 1.19.11(hono@4.12.9) + version: 2.0.11(hono@4.12.9) '@modelcontextprotocol/client': specifier: workspace:^ version: link:../../packages/client @@ -3025,6 +3025,12 @@ packages: peerDependencies: hono: ^4 + '@hono/node-server@2.0.11': + resolution: {integrity: sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==} + engines: {node: '>=20'} + peerDependencies: + hono: ^4 + '@humanfs/core@0.19.1': resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} engines: {node: '>=18.18.0'} @@ -7702,6 +7708,10 @@ snapshots: dependencies: hono: 4.12.9 + '@hono/node-server@2.0.11(hono@4.12.9)': + dependencies: + hono: 4.12.9 + '@humanfs/core@0.19.1': {} '@humanfs/node@0.16.7': diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 3303ad0607..5d8a4fbe13 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -40,7 +40,7 @@ catalogs: eventsource-parser: ^3.0.0 jose: ^6.1.3 runtimeServerOnly: - '@hono/node-server': ^1.19.9 + '@hono/node-server': ^1.19.9 || ^2.0.5 cors: ^2.8.5 express: ^5.2.1 fastify: ^5.2.0