fix(deps): npm audit fix — clear hono + js-yaml production advisories - #128
fix(deps): npm audit fix — clear hono + js-yaml production advisories#128chitcommit wants to merge 5 commits into
Conversation
Newly-published advisories landed on production dependencies, failing both the build-job audit and the reusable governance dependency-audit gate (both run production-scoped --omit=dev): - hono <=4.12.24 (HIGH): path traversal in serve-static via encoded backslash; CORS middleware reflecting any Origin with credentials under wildcard; body limit bypass on Lambda; Set-Cookie merging; repeated-header dropping. - js-yaml <=4.1.1 (moderate): quadratic-complexity DoS in merge-key handling. `npm audit fix` resolves all of them within the existing semver ranges, so package.json is unchanged — this is a package-lock.json-only update (also clears the dev-tree esbuild/ws advisories). Non-breaking by construction. Verified: `npm audit --audit-level=high` (full + --omit=dev) => found 0 vulnerabilities; `npm run typecheck` passes. Full vitest suite runs in CI (needs a live DATABASE_URL via globalSetup), not locally.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pull request updates the ChangesDependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This dependency update removes reported production advisories without changing declared dependency ranges; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
chittycommand | b4ef5ff | Aug 14 2026, 02:13 PM |
|
To use Codex here, create a Codex account and connect to github. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd15fa85e0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…-22 bump Review (Codex P2): the prior `npm audit fix` resolved wrangler 4.73.0 -> 4.105.0, which declares `node >=22`, while CI provisions Node 20. There is no engine-strict config so CI stayed green, but shipping a Node-22 wrangler requirement via a security PR is unnecessary scope creep — wrangler is a dev dependency and is already scoped out of both audit gates by `--omit=dev`. Re-scope the lockfile to the production vulnerabilities only: - hono 4.12.23 -> 4.12.27 (clears the HIGH serve-static / CORS advisories) - js-yaml updated within range (clears the moderate DoS) - wrangler stays 4.73.0 (node >=20), matching CI. The dev-tree esbuild/ws advisories remain but never ship and are excluded by the production-scoped gate. Verified: `npm ci` + `npm run typecheck` pass; `npm audit --audit-level=high --omit=dev` => found 0 vulnerabilities; wrangler 4.73.0 runs. package.json unchanged.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
To use Codex here, create a Codex account and connect to github. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
|
To use Codex here, create a Codex account and connect to github. |
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
To use Codex here, create a Codex account and connect to github. |
Two problems surfaced after main was merged into this branch: 1. ETARGET install failure — main (a60d0e1 "upgrade agents SDK to 0.19.0") set `hono-agents` to `^0.19.0`, a version that does not exist (hono-agents tops out at 3.0.11; 0.19.0 belongs to the separate Cloudflare `agents` package). package.json and the lockfile (still ^3.0.7) disagreed, so `npm ci` died with ETARGET and every job (build, dependency-audit, Workers deploy) failed at install. Restore `hono-agents` to `^3.0.7`, matching the lockfile's resolved 3.0.7. 2. New production advisories — since the original June remediation, fresh advisories landed (hono <=4.12.33, js-yaml <=4.3.0) and main pulled in new prod deps carrying their own HIGHs (fast-uri, ip-address, nanoid). Ran a semver-compatible `npm audit fix` (no --force): production tree is now clean. Verified on Node 20 CI parity: - `npm ci` succeeds (ETARGET gone) - `npm run typecheck` passes - `npm audit --audit-level=high --omit=dev` => found 0 vulnerabilities wrangler stays 4.73.0 (node >=20) — no Node-22 bump reintroduced. Remaining dev-only advisories (esbuild/sharp/ws) never ship and are excluded by the production-scoped gate. Only direct-dep change is the hono-agents correction.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
|
To use Codex here, create a Codex account and connect to github. |
What
npm audit fixto clear production-dependency advisories.package-lock.jsononly —package.jsonis unchanged.Why
Newly-published advisories landed on production deps and are now failing both audit gates (both run production-scoped
--omit=dev, so this is real shipped-code risk, not dev tooling):hono≤4.12.24serve-static(encoded%5C); CORS middleware reflects any Origin with credentials under wildcard; body-limit bypass on Lambda; Set-Cookie merging; repeated-header droppingjs-yaml≤4.1.1honois the core framework shipped to the Worker, so the CORS-with-credentials and path-traversal items are directly relevant. This also incidentally clears the dev-treeesbuild/wsadvisories.This is the real remediation behind the gate scoping in #124 — and it confirms that gate is working:
--omit=devcorrectly surfaced a genuine production vuln.Non-breaking by construction
npm audit fix(no--force) resolved everything within the existing semver ranges, sopackage.jsondid not change — only the lockfile. No major upgrades.Verification
The full
vitestsuite runs in CI (its globalSetup applies migrations against a liveDATABASE_URL), so it was not run in this sandbox.Unblocks
This clears the
buildandgates / dependency-auditfailures currently red onmainand on the docs PR #127. Once this merges, #127 will be rebased to go green.https://claude.ai/code/session_01886crB52Jw3LWiqPh33WUM
Generated by Claude Code
Summary by CodeRabbit