[objectstack-fleet]

Requested by Elon · project thread

Refs #33211 (landed as #33225)

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：只改 fix(deps)!: hono ^4.13.16 and @hono/node-server ^2.1.6 clear seven public advisories; a request path holding a backslash is answered 400 #33225 留下的那个待发布 changeset 里的两句话，不动任何代码。
• 为什么改：review#1 对 fix(deps)!: hono ^4.13.16 and @hono/node-server ^2.1.6 clear seven public advisories; a request path holding a backslash is answered 400 #33225 的两条可选意见（PASS 时提出）当时 PR 已进合并队列，没法补进去：一是 node-server 还有一处行为变化（响应流前两次读取出错时，原来发截断的 200，现在是 500 并断开连接），二是“HTTP 库都会把反斜杠变成 /”说得太宽，curl 会原样发送。
• 风险与回滚：只是发布说明文字。回滚 = revert。
• 先看：.changeset/33211-hono-security-bump.md。
• 两分钟验证：看本 PR 的 diff，两句话的改动。
• 需要你做的：无，A5 自审落地。

What changes

DELIBERATE CORRECTION of the pending note .changeset/33211-hono-security-bump.md (from #33225), before a release consumes it:

1. The Clause-②: paragraph now also names the second edge that moves in @hono/node-server: a streamed response whose body stream errors within its first two reads was sent as a truncated 200 and is now a 500 (text/plain) with the socket closed; of ours, only the raw AI/MCP stream passthrough can meet it.
2. The BREAKING paragraph no longer says every HTTP library rewrites a backslash: browsers and WHATWG-URL clients (fetch, undici) do; curl sends it as written.

Both are review#1's optional notes on #33225 at head 56fd8aeb, which could not be folded in because that PR was already in the merge queue. Check Changeset stays red by design on this class (route 0: a PR that only corrects a pending note); it is not a required context. No skip-changeset label.

Verification

Text only: one file, 2 lines changed. No code, no test.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#5 · os-elon-musk · session_016WV4cykhsWAtSL6Sr4VWFG

ACCEPT · area A5 · head e03dece · 2026-11-14T15:46Z

• Cards: Refs fix(deps): hono 4.13.12 → 4.13.16 and @hono/node-server 2.1.5 → 2.1.6 — seven public advisories fail the scheduled OSV audit on main #33211 (closed by fix(deps)!: hono ^4.13.16 and @hono/node-server ^2.1.6 clear seven public advisories; a request path holding a backslash is answered 400 #33225); this PR only corrects that pending changeset note.
• Self-review: PASS · text-only, 1 file, +2/-2, Clause-② no new answer (the changeset text corrects the existing declaration with the streamed-body 500 edge and the curl wording, review#1 optional notes on fix(deps)!: hono ^4.13.16 and @hono/node-server ^2.1.6 clear seven public advisories; a request path holding a backslash is answered 400 #33225).
• Governed: check-governed-merges --pr 33269 NOT governed, 4 changed lines.
• Checks on this head: 22 success, 20 skipped; Check Changeset red by design (route 0, correction-only PR, not a required context).
• Landing: ready + auto-merge (Elon, A5 thread 15:21Z).