From 5af244307b4902c09115c55bfba40efda7d4cae7 Mon Sep 17 00:00:00 2001 From: Gustavo Valverde Date: Thu, 11 Jun 2026 16:48:02 -0700 Subject: [PATCH] fix(deps): clear hono and shell-quote security advisories Both are dev/test/transitive deps, not shipped runtime code, so bump them through pnpm override floors rather than touching manifests we don't own: hono >=4.12.21 (four advisories), shell-quote >=1.8.4 (one critical). Applied to the root workspace and the standalone nextjs and expo demo workspaces, each of which carries its own lockfile. --- demo/expo/pnpm-lock.yaml | 9 ++++--- demo/expo/pnpm-workspace.yaml | 1 + demo/nextjs/pnpm-lock.yaml | 18 ++++++------- demo/nextjs/pnpm-workspace.yaml | 2 +- pnpm-lock.yaml | 45 +++++++++++++++++---------------- pnpm-workspace.yaml | 3 ++- 6 files changed, 41 insertions(+), 37 deletions(-) diff --git a/demo/expo/pnpm-lock.yaml b/demo/expo/pnpm-lock.yaml index 0e341a33bb..16b4788fe8 100644 --- a/demo/expo/pnpm-lock.yaml +++ b/demo/expo/pnpm-lock.yaml @@ -14,6 +14,7 @@ overrides: postcss@<8.5.10: ^8.5.14 yaml@>=2.0.0 <2.8.3: 2.8.3 '@xmldom/xmldom': ^0.8.12 + shell-quote@<1.8.4: '>=1.8.4 <2' uuid@<11.1.1: '>=11.1.1 <12' ws@>=8 <8.20.1: '>=8.20.1 <9' @@ -3672,8 +3673,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.3: - resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==} + shell-quote@1.8.4: + resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} engines: {node: '>= 0.4'} signal-exit@3.0.7: @@ -7944,7 +7945,7 @@ snapshots: react-devtools-core@6.1.5: dependencies: - shell-quote: 1.8.3 + shell-quote: 1.8.4 ws: 7.5.10 transitivePeerDependencies: - bufferutil @@ -8262,7 +8263,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.3: {} + shell-quote@1.8.4: {} signal-exit@3.0.7: {} diff --git a/demo/expo/pnpm-workspace.yaml b/demo/expo/pnpm-workspace.yaml index bcc2db93da..30c9d497b4 100644 --- a/demo/expo/pnpm-workspace.yaml +++ b/demo/expo/pnpm-workspace.yaml @@ -11,5 +11,6 @@ overrides: postcss@<8.5.10: ^8.5.14 'yaml@>=2.0.0 <2.8.3': 2.8.3 '@xmldom/xmldom': ^0.8.12 + shell-quote@<1.8.4: '>=1.8.4 <2' uuid@<11.1.1: '>=11.1.1 <12' 'ws@>=8 <8.20.1': '>=8.20.1 <9' diff --git a/demo/nextjs/pnpm-lock.yaml b/demo/nextjs/pnpm-lock.yaml index 8d8ea4a42a..2fa2397dff 100644 --- a/demo/nextjs/pnpm-lock.yaml +++ b/demo/nextjs/pnpm-lock.yaml @@ -7,7 +7,7 @@ settings: overrides: path-to-regexp@>=8: ^8.4.0 fast-uri@<=3.1.1: 3.1.2 - hono: ^4.12.18 + hono: ^4.12.21 '@hono/node-server': ^1.19.10 ip-address@<=10.1.0: ^10.2.0 postcss@<8.5.10: ^8.5.14 @@ -341,7 +341,7 @@ packages: resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} engines: {node: '>=18.14.1'} peerDependencies: - hono: ^4.12.18 + hono: ^4.12.21 '@hookform/resolvers@5.2.2': resolution: {integrity: sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA==} @@ -2106,8 +2106,8 @@ packages: resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==} engines: {node: '>= 0.4'} - hono@4.12.19: - resolution: {integrity: sha512-xa3eYXYXx68XTT4hZ7dRzsXBhaq85ToSrlUJNoR0gwz/1Ap/CNwX47wfvV7pc/xWhjKVVkLT7zBJy8chhNguqQ==} + hono@4.12.25: + resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==} engines: {node: '>=16.9.0'} html-to-text@9.0.5: @@ -2876,9 +2876,9 @@ snapshots: '@floating-ui/utils@0.2.10': {} - '@hono/node-server@1.19.14(hono@4.12.19)': + '@hono/node-server@1.19.14(hono@4.12.25)': dependencies: - hono: 4.12.19 + hono: 4.12.25 '@hookform/resolvers@5.2.2(react-hook-form@7.71.2(react@19.2.4))': dependencies: @@ -3067,7 +3067,7 @@ snapshots: '@modelcontextprotocol/sdk@1.27.1(zod@4.3.6)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.19) + '@hono/node-server': 1.19.14(hono@4.12.25) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -3077,7 +3077,7 @@ snapshots: eventsource-parser: 3.0.6 express: 5.2.1 express-rate-limit: 8.3.2(express@5.2.1) - hono: 4.12.19 + hono: 4.12.25 jose: 6.1.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -4509,7 +4509,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.12.19: {} + hono@4.12.25: {} html-to-text@9.0.5: dependencies: diff --git a/demo/nextjs/pnpm-workspace.yaml b/demo/nextjs/pnpm-workspace.yaml index 473e1e64b6..07392fb1ae 100644 --- a/demo/nextjs/pnpm-workspace.yaml +++ b/demo/nextjs/pnpm-workspace.yaml @@ -4,7 +4,7 @@ allowBuilds: overrides: path-to-regexp@>=8: ^8.4.0 fast-uri@<=3.1.1: 3.1.2 - hono: ^4.12.18 + hono: ^4.12.21 '@hono/node-server': ^1.19.10 ip-address@<=10.1.0: ^10.2.0 postcss@<8.5.10: ^8.5.14 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3ceea8f5cc..c3a6d1ae57 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -86,10 +86,11 @@ overrides: minimatch@>=9 <9.0.7: '>=9.0.7 <10' flatted@<3.4.2: '>=3.4.2 <4' serialize-javascript@<7.0.3: '>=7.0.3 <8' + shell-quote@<1.8.4: '>=1.8.4 <2' '@remix-run/router@<1.23.2': '>=1.23.2 <2' '@remix-run/react@<2.17.3': '>=2.17.3 <3' '@hono/node-server@<1.19.10': '>=1.19.10 <2' - hono@<4.12.18: '>=4.12.18 <5' + hono@<4.12.21: '>=4.12.21 <5' nitropack@<2.13.4: '>=2.13.4 <3' postcss@<8.5.10: '>=8.5.14 <9' smol-toml@<1.6.1: '>=1.6.1 <2' @@ -733,8 +734,8 @@ importers: specifier: ^0.45.2 version: 0.45.2(@cloudflare/workers-types@4.20260226.1)(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.0)(@prisma/client@7.4.1(prisma@7.4.1(@types/react@19.2.14)(better-sqlite3@12.6.2)(magicast@0.5.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(typescript@5.9.3))(typescript@5.9.3))(@types/better-sqlite3@7.6.13)(@types/pg@8.16.0)(@upstash/redis@1.36.4)(better-sqlite3@12.6.2)(bun-types@1.3.9)(kysely@0.29.2)(mysql2@3.18.2(@types/node@25.9.1))(pg@8.19.0)(postgres@3.4.8)(prisma@7.4.1(@types/react@19.2.14)(better-sqlite3@12.6.2)(magicast@0.5.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(typescript@5.9.3)) hono: - specifier: ^4.12.18 - version: 4.12.19 + specifier: '>=4.12.21 <5' + version: 4.12.25 devDependencies: '@cloudflare/vitest-pool-workers': specifier: ^0.12.18 @@ -763,13 +764,13 @@ importers: dependencies: '@hono/node-server': specifier: ^1.19.14 - version: 1.19.14(hono@4.12.19) + version: 1.19.14(hono@4.12.25) better-auth: specifier: workspace:* version: link:../../../../../packages/better-auth hono: - specifier: ^4.12.18 - version: 4.12.19 + specifier: '>=4.12.21 <5' + version: 4.12.25 e2e/smoke/test/fixtures/tsconfig-declaration: dependencies: @@ -3799,7 +3800,7 @@ packages: resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} engines: {node: '>=18.14.1'} peerDependencies: - hono: '>=4.12.18 <5' + hono: '>=4.12.21 <5' '@hookform/resolvers@5.2.2': resolution: {integrity: sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA==} @@ -9808,8 +9809,8 @@ packages: resolution: {integrity: sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==} engines: {node: '>=12.0.0'} - hono@4.12.19: - resolution: {integrity: sha512-xa3eYXYXx68XTT4hZ7dRzsXBhaq85ToSrlUJNoR0gwz/1Ap/CNwX47wfvV7pc/xWhjKVVkLT7zBJy8chhNguqQ==} + hono@4.12.25: + resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==} engines: {node: '>=16.9.0'} hookable@5.5.3: @@ -12768,8 +12769,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.3: - resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==} + shell-quote@1.8.4: + resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} engines: {node: '>= 0.4'} shiki@1.29.2: @@ -16755,9 +16756,9 @@ snapshots: '@hongzhiyuan/preact@10.28.0-fc4af453': {} - '@hono/node-server@1.19.14(hono@4.12.19)': + '@hono/node-server@1.19.14(hono@4.12.25)': dependencies: - hono: 4.12.19 + hono: 4.12.25 '@hookform/resolvers@5.2.2(react-hook-form@7.71.2(react@19.2.4))': dependencies: @@ -17254,7 +17255,7 @@ snapshots: '@modelcontextprotocol/sdk@1.27.1(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.19) + '@hono/node-server': 1.19.14(hono@4.12.25) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -17264,7 +17265,7 @@ snapshots: eventsource-parser: 3.0.6 express: 5.2.1 express-rate-limit: 8.3.2(express@5.2.1) - hono: 4.12.19 + hono: 4.12.25 jose: 6.1.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -17276,7 +17277,7 @@ snapshots: '@modelcontextprotocol/sdk@1.27.1(zod@4.3.6)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.19) + '@hono/node-server': 1.19.14(hono@4.12.25) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -17286,7 +17287,7 @@ snapshots: eventsource-parser: 3.0.6 express: 5.2.1 express-rate-limit: 8.3.2(express@5.2.1) - hono: 4.12.19 + hono: 4.12.25 jose: 6.1.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -17808,13 +17809,13 @@ snapshots: '@electric-sql/pglite': 0.3.15 '@electric-sql/pglite-socket': 0.0.20(@electric-sql/pglite@0.3.15) '@electric-sql/pglite-tools': 0.2.20(@electric-sql/pglite@0.3.15) - '@hono/node-server': 1.19.14(hono@4.12.19) + '@hono/node-server': 1.19.14(hono@4.12.25) '@mrleebo/prisma-ast': 0.13.1 '@prisma/get-platform': 7.2.0 '@prisma/query-plan-executor': 7.2.0 foreground-child: 3.3.1 get-port-please: 3.2.0 - hono: 4.12.19 + hono: 4.12.25 http-status-codes: 2.3.0 pathe: 2.0.3 proper-lockfile: 4.1.2 @@ -23498,7 +23499,7 @@ snapshots: highlight.js@11.11.1: {} - hono@4.12.19: {} + hono@4.12.25: {} hookable@5.5.3: {} @@ -26489,7 +26490,7 @@ snapshots: react-devtools-core@6.1.5: dependencies: - shell-quote: 1.8.3 + shell-quote: 1.8.4 ws: 7.5.10 transitivePeerDependencies: - bufferutil @@ -27578,7 +27579,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.3: {} + shell-quote@1.8.4: {} shiki@1.29.2: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 7137a7706b..b2a7a1bcda 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -32,10 +32,11 @@ overrides: minimatch@>=9 <9.0.7: '>=9.0.7 <10' flatted@<3.4.2: '>=3.4.2 <4' serialize-javascript@<7.0.3: '>=7.0.3 <8' + shell-quote@<1.8.4: '>=1.8.4 <2' '@remix-run/router@<1.23.2': '>=1.23.2 <2' '@remix-run/react@<2.17.3': '>=2.17.3 <3' '@hono/node-server@<1.19.10': '>=1.19.10 <2' - hono@<4.12.18: '>=4.12.18 <5' + hono@<4.12.21: '>=4.12.21 <5' nitropack@<2.13.4: '>=2.13.4 <3' postcss@<8.5.10: '>=8.5.14 <9' smol-toml@<1.6.1: '>=1.6.1 <2'