From e6b481d09309a748cea5233e0a616f09b8c276ec Mon Sep 17 00:00:00 2001 From: reaatech Date: Mon, 18 May 2026 17:39:49 +0000 Subject: [PATCH] fix(ci-failing-on-main-all-checks-passed-security-audit): close #2 Fixed. Three files changed: bumped from to (patching 5 moderate hono advisories); added for , , and (patching 2 high + 1 moderate transitive vulns), plus a path-specific override (patching the 4 moderate hono vulns in the MCP SDK's bundled copy); and updated accordingly. No known vulnerabilities found now reports zero known vulnerabilities, and all CI checks (build, lint, typecheck, tests) continue to pass. --- ...all-checks-passed-security-audit-issue2.md | 7 +++ package.json | 8 ++++ packages/server/package.json | 2 +- pnpm-lock.yaml | 48 +++++++++++-------- 4 files changed, 43 insertions(+), 22 deletions(-) create mode 100644 .changeset/repobot-ci-failing-on-main-all-checks-passed-security-audit-issue2.md diff --git a/.changeset/repobot-ci-failing-on-main-all-checks-passed-security-audit-issue2.md b/.changeset/repobot-ci-failing-on-main-all-checks-passed-security-audit-issue2.md new file mode 100644 index 0000000..728ebe9 --- /dev/null +++ b/.changeset/repobot-ci-failing-on-main-all-checks-passed-security-audit-issue2.md @@ -0,0 +1,7 @@ +--- +"@reaatech/a2a-reference-server": patch +--- + +Fix: CI failing on main: All Checks Passed, Security Audit + +Closes #2 diff --git a/package.json b/package.json index db6d55d..fea5835 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,14 @@ "url": "https://github.com/reaatech/a2a-reference-ts/issues" }, "homepage": "https://github.com/reaatech/a2a-reference-ts#readme", + "pnpm": { + "overrides": { + "fast-uri": "^3.1.2", + "ip-address": "^10.1.1", + "brace-expansion@>=5": ">=5.0.6", + "@modelcontextprotocol/sdk>hono": "^4.12.18" + } + }, "devDependencies": { "@biomejs/biome": "^1.9.4", "@changesets/changelog-github": "^0.6.0", diff --git a/packages/server/package.json b/packages/server/package.json index 208411b..79699d1 100644 --- a/packages/server/package.json +++ b/packages/server/package.json @@ -40,7 +40,7 @@ "@reaatech/a2a-reference-observability": "workspace:*", "@reaatech/a2a-reference-persistence": "workspace:*", "express": "^5.1.0", - "hono": "^4.7.7", + "hono": "^4.12.18", "zod": "^3.24.2" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c36df54..0df152c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,12 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + fast-uri: ^3.1.2 + ip-address: ^10.1.1 + brace-expansion@>=5: '>=5.0.6' + '@modelcontextprotocol/sdk>hono': ^4.12.18 + importers: .: @@ -321,8 +327,8 @@ importers: specifier: ^5.1.0 version: 5.2.1 hono: - specifier: ^4.7.7 - version: 4.12.14 + specifier: ^4.12.18 + version: 4.12.19 zod: specifier: ^3.24.2 version: 3.25.76 @@ -1063,8 +1069,8 @@ packages: brace-expansion@2.1.0: resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==} - brace-expansion@5.0.5: - resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} + brace-expansion@5.0.6: + resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -1317,8 +1323,8 @@ packages: fast-safe-stringify@2.1.1: resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==} - fast-uri@3.1.0: - resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==} + fast-uri@3.1.2: + resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} fastq@1.20.1: resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==} @@ -1433,8 +1439,8 @@ packages: help-me@5.0.0: resolution: {integrity: sha512-7xgomUX6ADmcYzFik0HzAxh/73YlKR9bmFzf51CZwR+b6YtzU2m0u49hQCqV6SvlqIqsaxovfwdvbnsw3b/zpg==} - hono@4.12.14: - resolution: {integrity: sha512-am5zfg3yu6sqn5yjKBNqhnTX7Cv+m00ox+7jbaKkrLMRJ4rAdldd1xPd/JzbBWspqaQv6RSTrgFN95EsfhC+7w==} + hono@4.12.19: + resolution: {integrity: sha512-xa3eYXYXx68XTT4hZ7dRzsXBhaq85ToSrlUJNoR0gwz/1Ap/CNwX47wfvV7pc/xWhjKVVkLT7zBJy8chhNguqQ==} engines: {node: '>=16.9.0'} html-escaper@2.0.2: @@ -1463,8 +1469,8 @@ packages: resolution: {integrity: sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA==} engines: {node: '>=12.22.0'} - ip-address@10.1.0: - resolution: {integrity: sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==} + ip-address@10.2.0: + resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2562,9 +2568,9 @@ snapshots: '@esbuild/win32-x64@0.27.7': optional: true - '@hono/node-server@1.19.14(hono@4.12.14)': + '@hono/node-server@1.19.14(hono@4.12.19)': dependencies: - hono: 4.12.14 + hono: 4.12.19 '@inquirer/external-editor@1.0.3(@types/node@25.6.0)': dependencies: @@ -2618,7 +2624,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.14) + '@hono/node-server': 1.19.14(hono@4.12.19) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -2628,7 +2634,7 @@ snapshots: eventsource-parser: 3.0.8 express: 5.2.1 express-rate-limit: 8.3.2(express@5.2.1) - hono: 4.12.14 + hono: 4.12.19 jose: 6.2.2 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -2897,7 +2903,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.0 + fast-uri: 3.1.2 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2963,7 +2969,7 @@ snapshots: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.5: + brace-expansion@5.0.6: dependencies: balanced-match: 4.0.4 @@ -3170,7 +3176,7 @@ snapshots: express-rate-limit@8.3.2(express@5.2.1): dependencies: express: 5.2.1 - ip-address: 10.1.0 + ip-address: 10.2.0 express@5.2.1: dependencies: @@ -3221,7 +3227,7 @@ snapshots: fast-safe-stringify@2.1.1: {} - fast-uri@3.1.0: {} + fast-uri@3.1.2: {} fastq@1.20.1: dependencies: @@ -3359,7 +3365,7 @@ snapshots: help-me@5.0.0: {} - hono@4.12.14: {} + hono@4.12.19: {} html-escaper@2.0.2: {} @@ -3395,7 +3401,7 @@ snapshots: transitivePeerDependencies: - supports-color - ip-address@10.1.0: {} + ip-address@10.2.0: {} ipaddr.js@1.9.1: {} @@ -3536,7 +3542,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.5 + brace-expansion: 5.0.6 minimatch@9.0.9: dependencies: