fix(security): upgrade Hono past 2026 CVEs

[seonghobae]

Security defect

Fresh Trivy evidence on protected develop@74a5e99d53b57aa9bc5fcfeab9a9447cf4cc2cf9 rejected hono@4.12.32 with:

• CVE-2026-69207 (MEDIUM, security-severity 5.3);
• CVE-2026-71848 (MEDIUM, security-severity 5.3);
• CVE-2026-71850 (MEDIUM, security-severity 4.8).

The first protected-base run proving the shared failure was Security Scan 31462377860, Trivy job 93688339747.

Narrow remediation

• upgrade the direct Hono range from ^4.12.32 to ^4.13.1;
• regenerate the npm 10.9.2 lock, resolving hono@4.13.1 and @hono/node-server@2.1.0;
• change only package.json and package-lock.json.

This extracts the shared security remediation from broader PRs #432 and #467 so open feature branches can inherit one minimal protected-base fix without unrelated product or workflow changes. Commit 24c8648 removed the accidental CodeQL action update (owned by #474) and unrelated pure-rand lock drift.

Exact-head evidence

Exact contributor head: 24c86489800ef4405e737a8e3d5bc3d54d7628dd
Live PR base snapshot: develop@74a5e99d53b57aa9bc5fcfeab9a9447cf4cc2cf9
Diff: 2 files, 8 additions, 8 deletions.

All six repository-native workflows are terminal success on this exact head:

• OSV Scanner 31495502351;
• Dependency Review 31495501714;
• Fuzz 31495501681;
• Security Scan 31495501601;
• Server Tests 31495501682;
• SAST Semgrep 31495501708.

There are zero review threads. Organization review and protected-branch policy remain separate gates. No administrator merge, bypass, or self-approval.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 118 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 40e0cbc9-9c33-41e0-88f4-cf17c46dc836

📥 Commits

Reviewing files that changed from the base of the PR and between 9186df5 and 4c96777.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

📝 Walkthrough

Walkthrough

이 PR은 CodeQL 액션을 v4.37.6으로 업데이트하고 hono 의존성 범위를 ^4.13.1로 변경합니다.

Changes

CodeQL 액션 업데이트

Layer / File(s)	Summary
CodeQL 분석 액션 갱신 .github/workflows/codeql.yml	CodeQL 초기화 및 분석 단계의 액션을 v4.36.2에서 v4.37.6으로 변경합니다.

Hono 의존성 업데이트

Layer / File(s)	Summary
Hono 런타임 의존성 갱신 package.json	hono 버전 범위를 ^4.12.32에서 ^4.13.1로 변경합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/scopeweave#432: package.json의 hono 의존성을 업데이트합니다.
• ContextualWisdomLab/scopeweave#474: .github/workflows/codeql.yml의 CodeQL 액션을 동일하게 업데이트합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Hono 의존성 업데이트와 2026년 CVE 해결이라는 주요 변경 사항을 명확하게 설명합니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/hono-cves-2026-69207-71848-71850

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Integrated the security changes from #474 into this PR at exact head 9186df5: Hono is upgraded past the four 2026 advisories and CodeQL init/analyze are pinned immutably to v4.37.6. Local evidence on this head: npm audit --omit=dev reports 0 vulnerabilities; unit and API suites pass. Please perform an independent formal review of exact head 9186df5; merge only after all required Checks are terminal-success and approval is recorded.

[seonghobae]

@opencode-agent review

Please submit an independent formal review for exact current head 9186df5b1f42a5c9aa5dd77f421a3b84207e8c84. Dependency Review, Security Scan, SAST, server tests, OSV, and fuzz are all terminal-success; CodeRabbit reported no actionable comments and there are no inline threads. Do not mutate, merge, or transfer predecessor-head evidence.

[seonghobae]

@opencode-agent review

Please submit an independent formal review for exact current head 24c86489800ef4405e737a8e3d5bc3d54d7628dd. The PR now changes only package.json and package-lock.json: Hono 4.13.1 plus the lock-selected @hono/node-server 2.1.0. All six repository-native test/security/SAST/dependency/fuzz/OSV workflows are terminal-success and there are no review threads. Do not mutate, merge, or transfer the predecessor-head request.

[seonghobae]

@coderabbitai review

Please review exact current head 24c86489800ef4405e737a8e3d5bc3d54d7628dd. The effective diff is exactly package.json and package-lock.json: Hono 4.13.1 with lock-selected @hono/node-server 2.1.0; accidental CodeQL and pure-rand drift were removed. All six native workflows are terminal-success and there are zero review threads. Do not transfer predecessor-head evidence.

[coderabbitai]

@seonghobae I will review the current PR head 24c86489800ef4405e737a8e3d5bc3d54d7628dd. I will evaluate only the current diff and current-head evidence.

⚠️ Action not completed

No files to review.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Closing this PR as superseded by merged PR #432.

Current protected develop@b88e66e81e9701404d29a0f5de4f58573ceee14f already resolves Hono to 4.13.0. GitHub's reviewed advisories list 4.12.34 as the first patched version for CVE-2026-69207, CVE-2026-71848, and CVE-2026-71850, so the protected branch is no longer on the vulnerable range.

The current PR head also carries an unrelated Playwright 1.61.1 → 1.62.1 update, which makes this no longer the two-file narrow CVE remediation described in the PR body. Keeping it open would duplicate the already-integrated security fix and preserve a stale stack base.

Next action: dependent PRs should be restacked directly onto current develop, retaining only their own product changes, then revalidated on their new exact heads.