fix: hono/@hono-node-server dependabot alerts, docs freshness pass - #251
Merged
Conversation
#249) Six dependabot alerts (five hono, one @hono/node-server) all had compatible fixes — hono ^4.6.0 → ^4.12.34 stays within its major, @hono/node-server ^1.13.0 → ^2.0.5 needed a major bump (no fix landed on 1.x) but its only two breaking changes don't touch us: Node ≥20 (CI already pins 24) and the removed Vercel adapter (never imported). Reasoning and the alert table are recorded as a comment on #248. Docs freshness: example-argo-estate/README.md's logical-lens bullet still described the control-plane-alone view as the headline from before behold#224 taught the composed estate to draw the projection — reworded to lead with the composed picture. example-flux-estate/README.md and AGENTS.md were checked against current src/server.ts behavior and are already accurate (fixed by #241 and #244 respectively, no change needed). Root README's painter section gained three paragraphs — lexicon-native icons (#227), hand layout (#228), the identity pass (#229) — the only features among the four named in #249 with zero prior README coverage; doctor (#236) already has one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Aug 10, 2026
dependabot: 6 advisories on the default branch (5 moderate, 1 low) — audit, upgrade, or justify
#248
Closed
lex00
added a commit
that referenced
this pull request
Aug 12, 2026
…299) postcss 8.5.18 sat in the <= 8.5.22 range of GHSA-6g55-p6wh-862q (dependabot #8); esbuild 0.27.7 sat in the dev-server advisory range. Both are transitive (vite, chant) so only the lockfile moves. The push should also re-evaluate the four stale hono alerts — the lockfile has carried 4.13.1 since #251. Claude-Session: https://claude.ai/code/session_018eEeu6fsvSMcCD6emFWxbt Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #248, closes #249.
#248 — dependabot alerts
All 6 alerts had a compatible fix; none needed a justification.
honoAccess-Control-Request-Headers)^4.6.0→^4.12.34honohonoConnectionheader leak)honomemo()cross-user SSR disclosure)@hono/node-serverserve-static)^1.13.0→^2.0.5, major@hono/node-serverhonostayed within its declared major (^4.6.0already allowed4.12.34; the lockfile was one patch shy).@hono/node-serverneeded a major bump — no fix landed on the 1.x line, the advisory's vulnerable range is< 2.0.5outright. Checked the v2.0.0 release notes' two documented breaking changes against our usage: drops Node 18 (CI already pins Node 24) and removes the@hono/node-server/verceladapter (we only importserveandserve-static, both API-unchanged in v2).src/server.ts'sserve({...})/serveStatic({...})calls needed no code change.Full reasoning also posted as a comment on #248.
npm auditseparately flagsesbuild/nanoid/postcssas transitive dev-dep issues — confirmed via thedependabot/alertsAPI these are not among GitHub's 6 alerts (open, dismissed, or fixed), so out of scope here.#249 — docs freshness
example-argo-estate/README.md: the logical-lens bullet led with "control plane alone," predating behold#224 (composed estates now draw the logical projection). Reworded to headline the composed cluster ⊃ namespace view, with the control-plane-alone case now the secondary note it should be — pinned bysrc/argo-estate.test.ts'sbyContainerexpectations andsrc/logical-k8s.ts's "a namespace the estate names, including ones holding no card" behavior.example-flux-estate/README.md: already accurate — feat: the composed estate applies the runtime and logical lenses (#224) #241 (already onmain) rewrote both the logical-lens and runtime-tier bullets to describe the composed estate. No change needed.AGENTS.md: already accurate — the read loop's step 0 already documentsbehold doctor(added by feat:behold doctor— the read-only first-touch diagnosis (#236) #244), and step 1's/api/graph//api/overlayparam descriptions already matchsrc/server.ts's route table verbatim. No change needed.README.md: of the four features named in the issue, onlydoctor(behold doctor — the first-touch diagnosis: why won't this project serve well #236) already had README coverage (added by its own PR). Icons (Lexicon-native icons — k8s, Flux, Argo, Helm and AWS marks on the graph, licensed right #227), hand layout (Draggable and resizable nodes, persisted to a sidecar — no database #228), and the identity pass (UI identity pass — stop looking like every generated app #229) had none — added one paragraph each to the "The painter" section, verified againstsrc/icon-packs.ts,web/layout-store.js, andsrc/theme.ts.Gates
just check(tsc + vitest + esbuild) — greennpm run smoke:ui— green (all checks passed)🤖 Generated with Claude Code