From c502674654a887bbdb7c7efa2a07a6fa7ed36161 Mon Sep 17 00:00:00 2001 From: 1bcMax Date: Wed, 9 Sep 2026 23:53:29 -0400 Subject: [PATCH] chore(deps): patch hono, and drop two overrides that pinned nothing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audited all 13 root overrides against what the lockfile actually resolves, after finding that the Desktop runtime had never had any of them (#376). Three results. `hono` was pinned `^4.13.0` and resolving to 4.13.1, which is inside the advisory range for both the `toSSG()` write and the query-parser issue (fixed in 4.13.5). Pinned `^4.13.5`; it resolves to 4.13.7. Three lines of lockfile. `basic-ftp` and `jayson > uuid` pin nothing — none of `basic-ftp`, `jayson` or `uuid` is in the tree at all. They are leftovers from dependencies that have since gone, and an override that matches nothing is worse than no override: it reads as protection. Removed, with no change to any resolution. The other nine are doing their job: axios 1.19.0, undici 8.10.0, ws 8.21.3, postcss 8.5.26, esbuild 0.28.1, brace-expansion 5.0.9, fast-uri 3.1.5, tar 7.5.22, ip-address 10.4.0 — one copy each. NOT bumped: vitest `^4.1.3` (resolves 4.1.10) against the @vitest/mocker path-traversal advisory, fixed in 4.1.11. Every route to it — `vitest@^4.1.11`, `vitest@4.1.11` exact — crashes Arborist in `#loadPeerSet` with "Cannot read properties of null (reading 'edgesOut')", the same failure as #373, and retrying does not clear it; unmodified main resolves fine. vitest declares exact-version peers on a dozen optional `@vitest/*` packages, which is the likely trigger. It is development scope and not shipped, so it is not worth a hand-edited lockfile on a package that publishes real-money code. Left for when npm or vitest moves. Verified by clean `npm ci` from this lockfile in a scratch tree: hono 4.13.7, tsc clean, 1088 tests pass. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015mUab3xrLHNpYqVHJLgJHL --- package-lock.json | 6 +++--- package.json | 8 ++------ 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 866359be..ffb226c0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6562,9 +6562,9 @@ } }, "node_modules/hono": { - "version": "4.13.1", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.1.tgz", - "integrity": "sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==", + "version": "4.13.7", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz", + "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 7af82027..19c84a95 100644 --- a/package.json +++ b/package.json @@ -129,19 +129,15 @@ "overrides": { "axios": "$axios", "undici": "$undici", - "basic-ftp": "^5.3.1", "ws": "^8.21.2", "postcss": "^8.5.25", "esbuild": "^0.28.1", "brace-expansion": "^5.0.9", "fast-uri": "^3.1.5", "tar": "^7.5.22", - "hono": "^4.13.0", + "hono": "^4.13.5", "@hono/node-server": "^2.1.0", - "ip-address": "^10.4.0", - "jayson": { - "uuid": "^11.1.1" - } + "ip-address": "^10.4.0" }, "engines": { "node": ">=22"