fix(deps): hono 4.13.12 → 4.13.16 and @hono/node-server 2.1.5 → 2.1.6 — seven public advisories fail the scheduled OSV audit on main

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Filing gate: ① a defect with a named producer, measured: the scheduled Validate Dependencies run 43549452164 (job 132308268047, step "Audit dependencies for known vulnerabilities (OSV-Scanner)") failed on main at 2026-11-14 03:01Z.

What the scanner reports (public advisories, `pnpm-lock.yaml`)

Package	Locked	Fixed in	Advisories
`@hono/node-server`	2.1.5	2.1.6	GHSA-jpvv-r467-5p4w, GHSA-qv5m-9pm6-hqp3 (CVSS 5.3 each)
`hono`	4.13.12	4.13.16	GHSA-3gg2-335m-rxc6 (3.4), GHSA-46wx-v44x-9hh2, GHSA-4h7h-rv7c-7m2v, GHSA-4m76-xfj5-7975, GHSA-h7mg-cq63-vhpq (5.3 each)

That is 0 critical, 0 high, 6 medium and 1 low; all seven have a fixed version. The one existing exemption in osv-scanner.toml is unrelated and still valid.

Why it matters

hono and @hono/node-server are the HTTP stack every deployment runs (plugin-hono-server, adapters/hono), and 18.4.0 ships these versions. The scheduled audit stays red until the lock moves.

Do

Bump both to their fixed releases (patch-level), regenerate pnpm-lock.yaml, run the server and REST suites, and run a dogfood boot once.
Do not add exemptions to make the audit green. The fixes exist. Exempt only an advisory with no fix, with an ignoreUntil and an advisory link, as the ledger requires.
Add a patch changeset for the packages that pin them.

Reader

domain:server (the HTTP stack). Precedent: PR #33066 (fast-xml-parser onto its fixed release, with the OSV ledger kept clean).

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: grade · `domain:server` · p1 · `pm:queue` · 2026-11-14T03:46Z

⛔ Not a claim.

Row: public, fixable advisories (6 medium, 1 low) in the HTTP stack that every deployment runs, shipped in 18.4.0. A patch-level bump closes all seven. A real user is exposed on the default configuration, which raises it to p1 (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997 rule 7). The fix is small and low-risk, so it should not wait in the p2 queue.
The advisory mechanisms are public (osv.dev links on the card). This card judges no exploit path in our code. If a reviewer finds one, it routes to the security lane per security-findings.md.

domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx

Claim: PM loop round 18, card thread · 2026-11-14T04:22Z · p1 per triage 6871201116 (public fixable advisories in the HTTP stack every deployment runs)
Session: session_01L9qibyksdYkFdXq4KWWzwP
Account: os-tesla
Branch: claude/project-thread-dsyzlu
Worktree: objectstack-issue-33211
Domain: domain:server
Seat: domain:server#7
File surface: the package.json files that pin hono or @hono/node-server (named in the card thread's first report), pnpm-lock.yaml, one root changeset. No code change without the seat first; osv-scanner.toml unchanged. Stop on breach.
Container & model: S, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate; PM default), effort: medium
Clause-②: no — a patch-level dependency bump; any answer of ours that moves is named and the line becomes yes
Metadata-protocol: none
Responsibility: the locked hono 4.13.12 and @hono/node-server 2.1.5 (pnpm-lock.yaml), objectstack | every deployment's HTTP stack, and the scheduled dependency audit red on main | every deployment on 18.4.0
Thread-read: 6871201116
Premise: re-measure at origin/main — the OSV scan's seven advisories, every pin, and the upstream changes between the versions against our body-limit path (#33172)
Serial constraints cleared: no other card of this seat touches the hono pins or the lock's hono entries; #33172 has merged (67274aca)

domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx

Claim amendment to this seat's claim 6871633430 on #33211 · 2026-11-14T04:24Z: the file surface names the pins and adds the workspace overrides.

package.json of plugin-hono-server, plugin-auth, adapters/hono (its hono dev pin only; the peer range stays), trigger-api, plugin-webhooks, plugin-approvals and client: targets ^4.13.16 and ^2.1.6.
pnpm-workspace.yaml: the two override targets (hono@<5.0.0, @hono/node-server@<3.0.0) lifted in lockstep, with a dated note line. The overrides rewrite every in-scope specifier, so the declarations alone do not move the lock. This follows the precedent of Validate Package Dependencies now fails on every PR and will fail on main's next scheduled run — 15 advisories across 7 packages (2 Critical in next), all with fix versions, and no lockfile moved #16999 and deps: the daily OSV scan has been red since at least 2026-10-26 on 6 public advisories; bump @hono/node-server (a shipped dependency of plugin-hono-server and client), qs and systeminformation, and decide deepmerge (no fixed version) #27921.
pnpm-lock.yaml and one root changeset, as claimed.

Clause-②: yes (narrowing). @hono/node-server 2.1.6 answers 400 to a request whose path (before ?) holds a backslash. 2.1.5 normalised it to /, and our routes answered. The changeset names it, and the contract review runs at CONTRACT_REVIEW_TIER. The #33172 request-body path is untouched upstream, and its pins and a dogfood boot prove it. Metadata-protocol: none stands.

domain:server#7 · os-tesla · session_01L9qibyksdYkFdXq4KWWzwP
os-dev-report

{
 "issue": 33211,
 "status": "done",
 "branch": "claude/project-thread-dsyzlu",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/33225",
 "session": "session_01L9qibyksdYkFdXq4KWWzwP",
 "premise_still_valid": true,
 "summary": "hono ^4.13.9 -> ^4.13.16 (plugin-hono-server, plugin-auth deps; adapters/hono, trigger-api, plugin-webhooks, plugin-approvals devDeps; adapters/hono peer ^4.12.8 unchanged) and @hono/node-server ^2.1.3 -> ^2.1.6 (plugin-hono-server dep, client devDep). Per claim amendment 6871660942 the two pnpm-workspace.yaml override targets lift in lockstep with a dated note each; the lock (pnpm 10.31.0) moves only hono 4.13.12 -> 4.13.18 and node-server 2.1.5 -> 2.1.8 plus specifiers (28+/28-). Patch changeset with BREAKING banner and ADR-0087 not-required marker; Clause-② yes (narrowing): node-server answers 400 to a request path holding a backslash (before '?'), pinned by request-target-backslash.pin.test.ts (seat-asked). Head 56fd8aeb (76bc2487 + one origin/main merge, no package/lock change from main). Owes a contract review at CONTRACT_REVIEW_TIER (narrowing) from the new review agent; not to land before it.",
 "tests": "At 76bc2487 on a declaration-built closure: plugin-hono-server 41/41 files, 540 passed (incl. #33172 body-limit + request-body-refusal pins and the new pin); hono 14/14, 258 (incl. hono-body-refusal); rest 409/409, 8346 passed 332 skipped; runtime 598/598, 10645 passed 19 skipped; plugin-auth 269/269, 5114 passed 10 skipped; plugin-approvals 119/119, 1632; client 58/58, 812; plugin-webhooks 25/25, 296; trigger-api 3/3, 73. Ablation: installed @hono/node-server 2.1.8 dist backslash refusal line replaced (anchor 0, marker 1) -> pin 1 failed | 2 passed (backslash request answered 200 routed to t_1); restored, sha256 equal 1c062cab..., 3/3. Dogfood boot (dev:crm --fresh, Console built): page / -> 200 text/html /_console/; API read crm_account 200; 11 MiB JSON on /data/crm_account/query -> 413 PAYLOAD_TOO_LARGE, small body 200; raw /api/v1/health 200, /api/v1\\health 400, /api/v1/health?x=a\\b 200.",
 "gates": "dispatch-gates --commands at 76bc2487: 79 commands, each run with </dev/null, exit captured before any pipe: 79 x exit 0; --ran reconciliation: 79 derived, 79 run, 0 NOT-MEASURED, 0 UNRUN (derived zero). A first pass during a declaration-less ui build (5 prereq/resolve reds) was discarded and fully re-run after rebuilding with declarations. pnpm lint at 56fd8aeb: exit 0. OSV scan NOT MEASURED locally (api.osv.dev refused by the container proxy); PR Validate Dependencies run is the reading. CI check-runs: in_progress at report time.",
 "dogfood_battery": "56fd8aeb · VERDICT command-exit 1 · Test Files 1 failed | 465 passed | 1 skipped (467) · Tests 6 failed | 3932 passed | 31 skipped (3969) · failing file test/print-service-render.dogfood.test.ts (6/8, 'print page did not finish rendering within 30 s'); runs only where a built Console + Chromium exist (CI builds no Console, so CI skips it). Same 6 fail identically with hono/node-server swapped back to main's 4.13.12/2.1.5 (restored, tree hashes equal): not this change.",
 "mcp_calls": "5 — read only: get_job_logs x1, issue_read x3, list_pull_requests x1; 0 write tools",
 "api_writes": "2 — relay pr_create (PR #33225, run 43564145980); post-stamped os-dev-report comment on #33211. Plus git push x2 (not REST).",
 "open_questions": [],
 "security_findings": "none",
 "out_of_scope_findings": [
  "class: observation · print-service-render.dogfood.test.ts fails 6/8 locally with a built Console + Playwright Chromium, on main's hono versions too · carrier: none (noted for the seat; CI never runs it because no Console is built there) · dedupe words: print render console dogfood timeout data-print-page"
 ]
}

Generated by Claude Code

domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx

Release: session_01L9qibzuZJBQY4wUQFJbkfx · seat domain:server#7 signs off on the maintainer's word 「所有座位当前任务处理完，合并后就下班」 (2026-11-14T04:35Z, project chat) and 「各座位自己的契约复审也暂停，等新的 review agent 上线后复审」 (2026-11-14T04:37Z) · back to pm:queue for the next claimant · 2026-11-14T06:12Z
Resume-from: claude/project-thread-dsyzlu@56fd8aeb553d8c7af1d89f3bf943da206e7463a5

Open: draft PR fix(deps)!: hono ^4.13.16 and @hono/node-server ^2.1.6 clear seven public advisories; a request path holding a backslash is answered 400 #33225 at head 56fd8ae, os-dev-report 6872781983. It owes a contract review at CONTRACT_REVIEW_TIER (Clause-②: yes (narrowing): node-server answers 400 to a backslash in the path) from the new review agent, then ACCEPT and land.
The lock moves only hono 4.13.12 to 4.13.18 and @hono/node-server 2.1.5 to 2.1.8. The two override targets in pnpm-workspace.yaml are lifted (claim amendment 6871660942). Read the OSV result from the PR's Validate Dependencies run.

domain:server#5 · os-elon-musk · session_016WV4cykhsWAtSL6Sr4VWFG

Claim: area-lease pilot #33059, area A5 thread · 2026-11-14T14:36Z · p1, adopting the released draft work as is
Session: session_016WV4cykhsWAtSL6Sr4VWFG
Account: os-elon-musk
Branch: claude/project-thread-dsyzlu (PR #33225, Resume-from 6872921604 @56fd8aeb; no new code unless review asks)
Worktree: objectstack-issue-33211
Domain: domain:server
Seat: domain:server#5 (area A5)
File surface: as claim 6871633430 with amendment 6871660942 (the hono and @hono/node-server pins, the two pnpm-workspace.yaml override targets, pnpm-lock.yaml, one root changeset, the backslash pin test).
Clause-②: yes (narrowing) — @hono/node-server 2.1.6+ answers 400 to a request path holding a backslash
Metadata-protocol: none
Premise: PR #33225 head 56fd8ae is green on every check and mergeable clean at 2026-11-14T14:36Z; it owes the contract review at CONTRACT_REVIEW_TIER, which goes to review#1.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: note carried from duplicate #33241 · 2026-11-14T14:44Z

⛔ Not a claim.

The cloud lane filed the same bump as #33241 on the maintainer's 「没必要走安全流程，直接升级卡」 and 「定位 p1」. Its one extra point: cloud's images run the framework-bundled hono, so the fix reaches hosted only after a framework release carries #33225 and cloud moves its pin (cloud PR #4479 has already bumped cloud's own copy). Acceptance adds "the OSV scan no longer reports these two packages" on main.

Navigation Menu

Repository navigation

fix(deps): hono 4.13.12 → 4.13.16 and @hono/node-server 2.1.5 → 2.1.6 — seven public advisories fail the scheduled OSV audit on main #33211

What the scanner reports (public advisories, `pnpm-lock.yaml`)

Why it matters

Do

Reader

Triage: grade · `domain:server` · p1 · `pm:queue` · 2026-11-14T03:46Z

Triage: note carried from duplicate #33241 · 2026-11-14T14:44Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

fix(deps): hono 4.13.12 → 4.13.16 and @hono/node-server 2.1.5 → 2.1.6 — seven public advisories fail the scheduled OSV audit on main #33211

Description

What the scanner reports (public advisories, pnpm-lock.yaml)

Why it matters

Do

Reader

Activity

objectstack-fleet commented on Nov 14, 2026

Triage: grade · domain:server · p1 · pm:queue · 2026-11-14T03:46Z

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Triage: note carried from duplicate #33241 · 2026-11-14T14:44Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What the scanner reports (public advisories, `pnpm-lock.yaml`)

Triage: grade · `domain:server` · p1 · `pm:queue` · 2026-11-14T03:46Z