deps: bump hono to ^4.13.3 to clear the CI audit gate - #42
Merged
Conversation
`npm audit --omit=dev --audit-level=high` started failing on every PR: a 16-advisory batch landed against `hono <=4.12.33`, and we were on ^4.12.18. main's last green run was 2026-06-13, before these published, so CI was red on all branches and no PR could get a preview URL. htmlbin's actual exposure to that batch appears to be nil — src/ imports only `Hono` and the `Context` type. No CORS middleware (deliberately unset), no JWT, no hono/jsx, no serve-static, no app.mount, and we're on Workers rather than Lambda, which is what most of the advisories target. Even the Set-Cookie injection one doesn't reach us: getCookie in src/index.ts:764 is hand-rolled, not hono's helper. So this is unblocking a blunt gate rather than patching a live hole. Kept as its own commit so it's reviewable on its own and doesn't ride along in an unrelated PR. 4.12 -> 4.13 is a minor bump; nothing in src/ touches the changed surfaces. Verified: - `npm audit --omit=dev --audit-level=high` (the exact CI command) exits 0 - `npx tsc --noEmit` clean - `npm run test:e2e` — all 126 checks pass The 6 advisories `npm audit` still reports without --omit=dev are all dev-only (wrangler -> esbuild, miniflare -> sharp/undici/ws) and don't ship to the Worker, which is why the workflow excludes them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
🚀 Cloudflare previewURL: https://6ce3447c-htmlbin.utkarsh2012.workers.dev Built from commit
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
npm audit --omit=dev --audit-level=high(the CI gate) started failing on every PR. A 16-advisory batch published againsthono <=4.12.33and we were pinned^4.12.18.main's last green run was 2026-06-13, before these advisories landed — so CI has been red on all branches since, and no PR can produce a Cloudflare preview URL. That's currently blocking #41.Exposure: as far as I can tell, none of it reaches us
Worth stating plainly, because this is unblocking a blunt gate rather than patching a live hole.
src/imports onlyHonoand theContexttype — no middleware packages at all:src/auth.tshono/jsx,memo(),cx()serve-staticpath traversalapp.mount()MAX_HTML_BYTEScheckSet-CookieinjectiongetCookieatsrc/index.ts:764is hand-rolled, not hono's helperScope
Two lines:
package.json+package-lock.json. Deliberately its own PR so it's reviewable on its own merits and doesn't ride along inside an unrelated content PR.4.12 → 4.13 is a minor bump, and nothing in
src/touches the changed surfaces.Verification
npm audit --omit=dev --audit-level=high— exits 0 (ran the exact CI command)npx tsc --noEmit— cleannpm run test:e2e— all 126 checks pass on hono 4.13.3Note on the other 6 advisories
A bare
npm auditstill reports 6 (wrangler → esbuild, miniflare → sharp/undici/ws). All dev-only — they don't ship to the Worker, which is exactly why the workflow passes--omit=dev. Left alone.🤖 Generated with Claude Code