[dependabot]

Bumps @hono/node-server from 1.19.17 to 2.1.5.

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in honojs/node-server#404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in honojs/node-server#405

New Contributors

• @​affanmomin made their first contribution in honojs/node-server#404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

• ci: add autofix.ci by @​yusukebe in honojs/node-server#392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in honojs/node-server#390
• chore: add better benchmarks by @​BlankParticle in honojs/node-server#391
• docs(readme): update the benchmark by @​yusukebe in honojs/node-server#394
• test(request): accept asynchronous body read errors by @​usualoma in honojs/node-server#403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378

... (truncated)

Commits

• 4b47a0d 2.1.5
• e77824a fix(serve-static): only serve GET and HEAD requests (#405)
• 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
• d57ed9b 2.1.4
• 92b014c chore: allow hono v5 as a peer dependency (#406)
• 720ac78 2.1.3
• 9821792 Merge commit from fork
• 35bca95 2.1.2
• 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
• fe7467c test(request): accept asynchronous body read errors (#403)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[maxigimenez]

Security triage: Tier B — needs a human decision

What and why

@hono/node-server 1.19.17 -> 2.1.5 (moderate; via @modelcontextprotocol/sdk)

• GHSA-rmxm-3fg6-px4f, CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), CWE-174
• Affected >=1.19.10 <2.1.3. The installed 1.19.17 is in range; 2.1.5 is out of it.
• No Vanta finding, so no SLA clock. This one is visible only to npm audit — see the "in the lockfile, not in Vanta" note in today's digest. It is being triaged on its merits, not against a deadline.

Exposure

Runtime, and it ships: @currents/mcp is published to npm (2.7.0), and @hono/node-server resolves under the root dependencies tree, not devDependencies.

The advisory: serveStatic decodes the request path a second time, so a percent-encoded path can be routed to a static file after middleware has already matched against the undecoded form — middleware guarding a static path can be bypassed.

serveStatic is not called anywhere in mcp-server/src. The package reaches @hono/node-server only transitively through @modelcontextprotocol/sdk, which declares ^1.19.9 || ^2.0.5. Whether the SDK's own HTTP transport reaches serveStatic is the one thing I could not settle from this repo, and it is what decides whether the advisory is live here at all.

The fix

lockfile-upgrade, and the diff is exactly that: mcp-server/package-lock.json only, one stanza, 5 additions and 5 deletions. No manifest edit — 2.1.5 already satisfies the SDK's existing ^2.0.5 branch, so nothing had to be widened or pinned.

Breaking-change check

This crosses a major line, 1.x -> 2.x, and the lockfile diff shows two constraints moving with it:

• engines.node >=18.14.1 -> >=20
• peerDependencies.hono ^4 -> ^4 || ^5.0.0-0

The peer range only widens, so it cannot newly conflict. The engines floor is the one to confirm against whatever Node the published server is expected to run on; >=20 is not a problem for CI here but it is a published package, so it constrains consumers rather than just this repo.

I could not obtain a changelog for the 1.x -> 2.x transition itself — the release notes reachable from the PR cover the patch line, not the major's removals. That absence is on its own a Tier B trigger.

Verification

Not run. This is Dependabot's branch and it is Tier B on two independent counts (major bump; runtime dependency of a published package), so a local run would not change the verdict, and it is not a Phase 5 candidate.

CI coverage

Not assessed — the verdict does not turn on it, since nothing here is mergeable without a human either way.

What a human should still check

1. Does @modelcontextprotocol/sdk actually reach serveStatic? If it does not, this is a hygiene bump rather than a fix, and can wait for the SDK to move on its own.
2. The engines.node >=20 floor, because @currents/mcp is published and this tightens what its dependency tree demands of consumers.
3. The missing 2.0.0 changelog. A major with no obtainable release notes is worth one look at the upstream diff before it goes into a published package.

Needs release

@currents/mcp is published to npm. Merging this changes the dependency tree of a published package, so it needs a release to reach consumers — package @currents/mcp, currently 2.7.0. I am not publishing it.

Recorded in the triage ledger with mechanism dependabot-pr so it is not re-commented tomorrow.

---

Generated by Claude Code

[maxigimenez]

Settling the open question from my triage above, since I could answer it from the other repo's installed tree.

The SDK does not reach serveStatic. Both this repo and currents-dev/currents resolve @modelcontextprotocol/sdk at exactly 1.32.0, and in that package's dist serveStatic appears nowhere — the SDK touches @hono/node-server only in server/streamableHttp.js, its streamable-HTTP transport. Combined with serveStatic being absent from mcp-server/src, GHSA-rmxm-3fg6-px4f is not reachable on any path this package has.

So item 1 in "what a human should still check" is answered: this is a hygiene bump rather than a live fix, and it does not need to be rushed.

The Tier B verdict is unchanged, and for the reasons that did not depend on that question: it crosses a major (1.x -> 2.x, with engines.node moving to >=20), it is a runtime dependency of a published package, and I could not obtain a changelog for the major itself. Items 2 and 3 still want a human.

One addition from reading the upstream release notes: the two behavior changes in the 2.x line are both inside serveStatic — 2.1.3 rejects paths still containing % after decoding unless allowPercentInPath is set, and 2.1.5 restricts it to GET and HEAD. Both are inert here for the same reason.

---

Generated by Claude Code