fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 - #2549
Conversation
Allow ^2.0.5 (patched) while keeping ^1.19.9 for Node 18 consumers. getRequestListener API is unchanged; serveStatic is unused by the SDK. Closes modelcontextprotocol#2531 Closes modelcontextprotocol#2548
|
commit: |
|
Follow-up note after self-review: The dual range So the “Node 18 keeps 1.x” framing in the earlier description was wrong. What this PR actually does:
If maintainers prefer a cleaner story, happy to switch to Also happy to add a changeset if this branch uses them for the published package (v1.x layout may differ from main monorepo). |
|
Another affected downstream here: a Vue / shadcn-vue app that only pulls the SDK transitively (shadcn-vue → @modelcontextprotocol/sdk) as a build-time CLI. We never run the HTTP server transport at all, yet every Confirming the fix from a consumer's side: I applied |
The runtimeServerOnly catalog pinned ^1.19.9, which cannot reach the advisory's fix (2.0.5; no patched 1.x exists). Widen to ^1.19.9 || ^2.0.5, matching the range merged for v1.x in modelcontextprotocol#2549 and shipped in 1.30.0 — that fix landed on a branch without changesets, so it could not propagate to the v2 monorepo. The lockfile resolution moves to 2.0.11, as the v1.x change did. getRequestListener is the only imported symbol and is unchanged in 2.x; @hono/node-server@2 requires Node >= 20, which @modelcontextprotocol/node already declares. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The runtimeServerOnly catalog pinned ^1.19.9, which cannot reach the advisory's fix (2.0.5; no patched 1.x exists). Widen to ^1.19.9 || ^2.0.5, matching the range merged for v1.x in modelcontextprotocol#2549 and shipped in 1.30.0 — that fix landed on a branch without changesets, so it could not propagate to the v2 monorepo. The lockfile resolution moves to 2.0.11, as the v1.x change did. getRequestListener is the only imported symbol and keeps the same signature and contract in 2.x; @hono/node-server@2 requires Node >= 20, which @modelcontextprotocol/node already declares. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3 participants
Summary
Widens
@hono/node-serverso consumers can resolve a version that clears GHSA-frvp-7c67-39w9 (path traversal inserve-staticon Windows; fixed in>= 2.0.5). There is no patched1.xline, so^1.19.9alone can never satisfy the advisory.Range change:
"^1.19.9"→"^1.19.9 || ^2.0.5"1.xfloor for Node 18 installs (SDK still declaresengines.node: >=18).^2.0.5makes the first patched version (and later 2.x) reachable without requiring every consumer to add anoverridesentry.getRequestListenerfrom@hono/node-server(src/server/streamableHttp.ts); it does not useserveStatic. Downstream reports (see Widen@hono/node-serverrange:^1.19.9cannot resolve past GHSA-frvp-7c67-39w9 (no patched 1.x) #2531) confirm the 2.x export is a drop-in for that symbol.Fixes #2531
Fixes #2548 (duplicate)
Motivation
Unlike the
hono/fast-uricases in #2036 / #2042, this cannot be fixed by a lockfile refresh alone: the published range cannot select any patched version.npm audittherefore keeps flagging every consumer of@modelcontextprotocol/sdk@>=1.25.0, and npm’s suggested remediation incorrectly points at a downgrade to1.24.3(before the dependency existed), which breaksStreamableHTTPServerTransport.Test plan
node -e "import { getRequestListener } from '@hono/node-server'"— function export present on@hono/node-server@2.0.11npm run build(esm + cjs)npm test -- test/server/streamableHttp.test.ts— 162 passednpm test -- test/integration-tests/stateManagementStreamableHttp.test.ts— 8 passed@hono/node-serverdependency resolves to2.0.11under the new range (lockfile updated)Notes
@hono/node-server@2.xdeclaresnode >= 20. The dual range preserves Node 18 compatibility for consumers who stay on 1.x; Node 20+ installs can take 2.x and clear the advisory.@modelcontextprotocol/conformance’s older SDK copy is out of scope for this PR.