From 3ae1e28b1a21dc19af23057bceee7b0bb04c5dca Mon Sep 17 00:00:00 2001 From: Utkarsh Sengar Date: Sat, 22 Aug 2026 12:27:06 -0700 Subject: [PATCH] deps: bump hono to ^4.13.3 to clear the CI audit gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm audit --omit=dev --audit-level=high` started failing on every PR: a 16-advisory batch landed against `hono <=4.12.33`, and we were on ^4.12.18. main's last green run was 2026-06-13, before these published, so CI was red on all branches and no PR could get a preview URL. htmlbin's actual exposure to that batch appears to be nil — src/ imports only `Hono` and the `Context` type. No CORS middleware (deliberately unset), no JWT, no hono/jsx, no serve-static, no app.mount, and we're on Workers rather than Lambda, which is what most of the advisories target. Even the Set-Cookie injection one doesn't reach us: getCookie in src/index.ts:764 is hand-rolled, not hono's helper. So this is unblocking a blunt gate rather than patching a live hole. Kept as its own commit so it's reviewable on its own and doesn't ride along in an unrelated PR. 4.12 -> 4.13 is a minor bump; nothing in src/ touches the changed surfaces. Verified: - `npm audit --omit=dev --audit-level=high` (the exact CI command) exits 0 - `npx tsc --noEmit` clean - `npm run test:e2e` — all 126 checks pass The 6 advisories `npm audit` still reports without --omit=dev are all dev-only (wrangler -> esbuild, miniflare -> sharp/undici/ws) and don't ship to the Worker, which is why the workflow excludes them. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index ac89c9b..8d30e20 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,7 +10,7 @@ "dependencies": { "@resvg/resvg-wasm": "^2.6.2", "@sentry/cloudflare": "^10.53.1", - "hono": "^4.12.18", + "hono": "^4.13.3", "satori": "^0.26.0", "satori-html": "^0.3.2" }, @@ -1432,9 +1432,9 @@ } }, "node_modules/hono": { - "version": "4.12.18", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.18.tgz", - "integrity": "sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==", + "version": "4.13.3", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.3.tgz", + "integrity": "sha512-r8AO2mYHoLxSHkgafNeC/BXyb2vWRxD3jem4Ts+ptav8oTG5FIRifAjuJEmZI4bSvvc2ns0GxmIYiZnHqN3mMw==", "license": "MIT", "engines": { "node": ">=16.9.0" diff --git a/package.json b/package.json index aad82e1..bd27938 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "dependencies": { "@resvg/resvg-wasm": "^2.6.2", "@sentry/cloudflare": "^10.53.1", - "hono": "^4.12.18", + "hono": "^4.13.3", "satori": "^0.26.0", "satori-html": "^0.3.2" },