From c16df362135ce186504a5bc1f3bd19e1ac83af4f Mon Sep 17 00:00:00 2001 From: Vasanthdev2004 Date: Wed, 21 Oct 2026 16:08:37 +0530 Subject: [PATCH] fix(deps): refresh the lockfile to hono 4.13.13 GHSA-5r4p-p66f-jhc7 (moderate): hono's serveStatic decodes the request path a second time, so middleware on static paths can be bypassed. Versions 4.12.4 to 4.13.10 are affected and main pins 4.13.9 through tuistory, which release packaging installs as a local-control helper. npm update takes hono to 4.13.13, inside every range that asks for it. package.json is unchanged and nothing else in the lock moves. --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 18e4089b4..d49eb4ec7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -452,9 +452,9 @@ } }, "node_modules/hono": { - "version": "4.13.9", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.9.tgz", - "integrity": "sha512-7dMkQmZoC4E6F7AtaQSPhlWAdnBti+j7rreMZl8QB4jFiEhP9TWbGWUMi8WYzBCgmgulxuvLQupKqo+Co6Omyg==", + "version": "4.13.13", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz", + "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==", "license": "MIT", "engines": { "node": ">=16.9.0"