dependabot: 6 advisories on the default branch (5 moderate, 1 low) — audit, upgrade, or justify

[lex00]

GitHub is flagging 6 vulnerabilities on main (5 moderate, 1 low) — surfaced on every push banner. Enumerate via gh api repos/INTENTIUS/behold/dependabot/alerts --jq '.[] | {number, state, dependency: .dependency.package.name, severity: .security_advisory.severity, summary: .security_advisory.summary}', then for each: upgrade if a compatible fix exists (dev-only trees included — the UI smoke's Chrome tooling is a likely nest), or record why it doesn't bite (parser never sees untrusted input, dev-only, etc.) in the issue. chant#1622 is the sibling exercise there. Acceptance: alert count at zero or every remaining alert has a written justification here; just check green; no major-version rides along without its own reasoning.

[lex00]

All 6 alerts fixed on this branch (PR incoming) — no unfixable ones to justify here.

Alert	Package	Severity	Fix
#3, #4, #5, #6	hono	medium/medium/low/medium	^4.6.0 → ^4.12.34 (compatible, same major; lockfile was resolving 4.12.30, one patch shy of the fix)
#1, #2	@hono/node-server	medium/medium	^1.13.0 → ^2.0.5 (major bump — reasoning below)

Major-bump reasoning for @hono/node-server 1→2: no fix landed on the 1.x line (advisory's vulnerable range is < 2.0.5 outright), so the compatible fix requires the major. Checked the two documented breaking changes in the v2.0.0 release notes against our usage:

• Drops Node 18 support, requires Node ≥ 20 — CI (ci.yml, release.yml, docs.yml) already pins Node 24, so this is a no-op for us.
• Removes the @hono/node-server/vercel adapter — we don't import it (only serve and serveStatic from the root and /serve-static, both unchanged in v2).

No other API changes; src/server.ts's serve({...}) and serveStatic({...}) calls are untouched. just check (tsc + vitest + esbuild) and npm run smoke:ui both green after the bump.

Separately, npm audit also surfaces esbuild (low), nanoid (high), and postcss (moderate) as transitive dev-dependency issues — these are not among GitHub's 6 dependabot alerts (confirmed via the dependabot/alerts API across open/dismissed/fixed states, all 6 are hono-family) and predate this change, so they're out of scope for this issue.

[lex00]

Reopening: a NEW batch of 6 hono-family advisories (5 moderate, 1 low) published against the versions #251 upgraded to — 2× @hono/node-server serve-static path traversal, hono CORS ReDoS / language-middleware DoS / memo() SSR retention / proxy-helper header passthrough. Same treatment: compatible upgrades where fixes exist, written justification here where they don't (note: behold uses serve-static for web/ only, no user-supplied paths; no SSR memo; check which actually bite).

[lex00]

Checked all 6 currently-open alerts (dependabot/alerts API, state=open). Result: no PR this round — all 6 are already satisfied by the pins #251 landed, no unfixed ones to justify.

Alert	Package	Severity	Advisory	Vulnerable range	First patched	Current pin	Resolved
#1	@hono/node-server	medium	GHSA-frvp-7c67-39w9 — serve-static path traversal via encoded \ on Windows	< 2.0.5	2.0.5	^2.0.5	2.1.0
#2	@hono/node-server	medium	GHSA-frvp-7c67-39w9 (same, lockfile manifest)	< 2.0.5	2.0.5	^2.0.5	2.1.0
#3	hono	medium	GHSA-8j4g-w8fx-2239 — ReDoS in CORS middleware via Access-Control-Request-Headers	< 4.12.34	4.12.34	^4.12.34	4.13.1
#4	hono	medium	GHSA-54fx-42gc-7vw4 — algorithmic complexity DoS in language-detector middleware	>= 4.12.0, < 4.12.34	4.12.34	^4.12.34	4.13.1
#5	hono	low	GHSA-79qm-7rj5-m7r9 — proxy helper doesn't strip headers named in Connection	>= 4.7.0, < 4.12.34	4.12.34	^4.12.34	4.13.1
#6	hono	medium	GHSA-f23p-vx2j-j53r — memo() retains SSR output across requests	>= 3.8.0, < 4.12.34	4.12.34	^4.12.34	4.13.1

Every one of these six advisories has first_patched_version 4.12.34 (hono) or 2.0.5 (@hono/node-server) — exactly the floors #251 already pinned (^4.12.34, ^2.0.5). npm install on current main (0.9.0) resolves hono@4.13.1 and @hono/node-server@2.1.0, both above every patched version, and npm view/registry confirm those are the latest published releases for each package — there's no newer fix to move to and no npm install diff to commit (verified: git diff origin/main --stat is empty after a fresh install). npm ls shows single, non-duplicated resolutions for both packages in the lockfile, so there's no shadow/transitive copy still on an old version either.

Applies-to-behold check on top of that (per the reopening comment, since 4 of these are middleware-specific):

• serve-static path traversal (dev: justfile + local e2e (example project + runner) #1, dev: one serve target (it's one server/SPA) #2) — src/server.ts mounts it as app.use("/*", serveStatic({ root: rel })) and app.get("/", serveStatic({ path: join(rel, "index.html") })), both registered last, after /api and /healthz. rel is relative(process.cwd(), webRoot) — the bundled web/ dir, computed at startup, never from a request. No user-supplied path segment reaches the root/path options either way.
• CORS ReDoS (watch: SSE refresh on served-project source edits (dev loop) #3) — grep -rn "cors" src/ finds nothing. Behold never imports hono/cors; the middleware isn't wired up at all, so the vulnerable code path isn't reachable regardless of version.
• language-detector DoS (watch: poll the live overlay for continuous drift (--poll) #4) — same result: no languageDetector import anywhere in src/.
• proxy-helper header passthrough (lanes: deployment-lanes temporal viz v0 (per-substrate filmstrips + playhead) #5) — no hono/proxy import; behold doesn't use the proxy helper.
• memo() SSR retention (lanes: lanes↔graph coupling (two cursors, shared dials, offset, frame-diff) #6) — no hono/jsx usage, no memo() calls anywhere in src/. Behold's UI is a static bundled SPA (web/) served via serveStatic, not server-rendered JSX.

So beyond the version floor already covering all six, none of the four middleware-specific advisories touch code paths behold actually exercises.

Gates run clean on this state: just check (tsc + 982 vitest tests + esbuild) and npm run smoke:ui (67 UI smoke checks) both green, unchanged from main.

No PR is being opened for this round — there's nothing to diff. The alerts are still showing state: open / fixed_at: null via the API as of this check; that's GitHub's dependency-graph rescan not having caught up to the fact that #251 already satisfies them, not a real gap in the pins. Expect them to auto-resolve on the next scan; if they don't clear on their own, they'll need a manual admin dismissal since the API can't be told to mark an alert fixed (only dismissed, and none of the dismissal reasons fit "already shipped").

[lex00]

Round 2 resolution: all 6 alerts' first_patched_version floors (hono 4.12.34, @hono/node-server 2.0.5) were already met by #251's pins on main — fresh install resolves 4.13.1 / 2.1.0, single lockfile resolutions, empty diff, so no PR exists to open. Middleware applicability checked and none of the four advisory paths is reachable in behold (analysis in the comment above). The open alerts are the dependency-graph rescan lagging main; they should self-clear — if they linger, dismiss with reference to this comment.