Update all packages requiring security patches - #193
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughThe package override configuration now pins ChangesDependency overrides
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)package.jsonTraceback (most recent call last): Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 54-55: Update the dependency entries for sharp and
`@hono/node-server` in package.json to use exact locked versions, removing the
caret ranges and preserving the intended versions. Regenerate the lockfile so it
reflects these pinned overrides.
- Line 55: Review the `@hono/node-server` dependency override in package.json for
compatibility with `@modelcontextprotocol/sdk` and existing imports, especially
`@hono/node-server/vercel`. If v1 APIs are required, replace the ^2.0.5 constraint
with a patched v1-compatible release; otherwise verify the Node 20 requirement
and removed export are supported.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9732b8ae-b4fe-431f-8af8-f4c20efa07e9
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json
| "sharp": "^0.35.3", | ||
| "@hono/node-server": "^2.0.5" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## package.json relevant sections"
python3 - <<'PY'
import json
from pathlib import Path
p=Path('package.json')
data=json.loads(p.read_text())
for section in ['dependencies','devDependencies','overrides']:
if section in data:
print(f'[{section}]')
for k,v in sorted(data[section].items()):
if k in ('sharp','`@hono/node-server`') or (section=='overrides' and k in ('sharp','`@hono/node-server`')):
print(f'{k}: {v}')
PY
echo
echo "## lockfile resolution entries"
python3 - <<'PY'
import json
from pathlib import Path
p=Path('package-lock.json')
data=json.loads(p.read_text())
for sec in ['packages','overrides']:
if sec in data:
print(f'[{sec}]')
for k in ['node_modules/sharp','node_modules/@hono/node-server']:
if k in data[sec]:
print(f'{k}:')
for kk in ['version','resolved','dev','dependencies','peerDependencies','dependenciesMeta']:
if kk in data[sec][k]:
print(f' {kk}: {data[sec][k][kk]}')
PY
echo
echo "## changed lines with git"
git diff -- package.json | sed -n '1,120p'Repository: spree/storefront
Length of output: 700
Use exact versions for pinned overrides.
^0.35.3 and ^2.0.5 allow dependency updates beyond the versions currently locked (0.35.3 and 2.0.11). If these overrides are meant to lock patched versions, remove the carets and regenerate the lockfile.
Proposed fix
- "sharp": "^0.35.3",
- "`@hono/node-server`": "^2.0.5"
+ "sharp": "0.35.3",
+ "`@hono/node-server`": "2.0.11"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "sharp": "^0.35.3", | |
| "@hono/node-server": "^2.0.5" | |
| "sharp": "0.35.3", | |
| "`@hono/node-server`": "2.0.11" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 54 - 55, Update the dependency entries for sharp
and `@hono/node-server` in package.json to use exact locked versions, removing the
caret ranges and preserving the intended versions. Regenerate the lockfile so it
reflects these pinned overrides.
| "mute-stream": "^3.0.0" | ||
| "mute-stream": "^3.0.0", | ||
| "sharp": "^0.35.3", | ||
| "@hono/node-server": "^2.0.5" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== package files =="
git ls-files | rg '(^|/)(package.json|package-lock.json|pnpm-lock.yaml|yarn.lock)$' || true
echo "== relevant package.json snippets =="
if [ -f package.json ]; then
sed -n '1,120p' package.json | nl -ba | sed -n '45,65p'
rg -n '"`@hono/node-server`"|"`@modelcontextprotocol/sdk`"|overrides|pnpm|version' package.json
fi
echo "== lockfile snippet for hono/node-server if present =="
for lock in package-lock.json pnpm-lock.yaml yarn.lock bun.lockb; do
if [ -f "$lock" ]; then
echo "--- $lock ---"
python3 - <<'PY' "$lock"
import sys, re
p=sys.argv[1]
txt=open(p, encoding='utf-8', errors='replace').read()
needle='`@hono/node-server`'
for m in re.finditer(re.escape(needle), txt):
start=max(0,m.start()-200); end=min(len(txt), m.stop()+600)
print(txt[start:end])
print("-"*80)
PY
fi
done
echo "== `@modelcontextprotocol/sdk` lock/resolution snippets =="
for lock in package-lock.json pnpm-lock.yaml yarn.lock bun.lockb; do
if [ -f "$lock" ]; then
echo "--- $lock ---"
python3 - <<'PY' "$lock"
import sys, re
p=sys.argv[1]
txt=open(p, encoding='utf-8', errors='replace').read()
needle='`@modelcontextprotocol/sdk`'
for m in re.finditer(re.escape(needle), txt):
start=max(0,m.start()-300); end=min(len(txt), m.stop()+800)
print(txt[start:end])
print("-"*80)
PY
fi
done
echo "== lockfile exact versions for model SDK and adapter =="
python3 - <<'PY' package-lock.json pnpm-lock.yaml yarn.lock bun.lockb 2>/dev/null | while read -r lock ver; do
[ -z "$lock" ] && continue
echo "--- $lock: $ver ---"
doneRepository: spree/storefront
Length of output: 282
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== package.json relevant lines =="
python3 - <<'PY'
from pathlib import Path
p=Path('package.json')
lines=p.read_text(encoding='utf-8').splitlines()
for i in range(max(0,55-25), min(len(lines),55+25)+1):
print(f"{i+1:4}: {lines[i]}")
PY
echo "== package-lock resolver facts for hono adapter and sdk deps =="
python3 - <<'PY'
import json
from pathlib import Path
lock=json.loads(Path('package-lock.json').read_text(encoding='utf-8'))
packages=lock.get('packages', {})
for name in ['node_modules/@hono/node-server','node_modules/@modelcontextprotocol/sdk','node_modules','`@hono/node-server`','`@modelcontextprotocol/sdk`']:
entry=packages.get(name)
if entry:
print(name)
for k in ['version','resolved','integrity','license','dependencies','peerDependencies','devDependencies']:
v=entry.get(k)
if v:
print(f" {k}: {v}")
print()
print("dependency graph for `@hono/node-server`:")
for name, entry in packages.items():
if not name.startswith('node_modules/@hono/node-server/node_modules/'):
continue
rel=name[len('node_modules/'):]
print(f"{rel}: {entry.get('version')}")
print()
print("reverse deps mentioning `@hono/node-server`:")
for name, entry in packages.items():
if not name.startswith('node_modules/'):
continue
deps={**entry.get('dependencies',{}), **entry.get('optionalDependencies',{}), **entry.get('peerDependencies',{}), **entry.get('devDependencies',{})}
if '`@hono/node-server`' in deps:
print(f"{name}@{entry.get('version','?')} -> {deps.get('`@hono/node-server`')}")
PY
echo "== public package registry versions for `@modelcontextprotocol/sdk` and adapter =="
npm view `@modelcontextprotocol/sdk` version --json || true
npm view "npm:mcp@^1.0.0" version --json || true
cd /tmp
mkdir -p nptest && cd nptest
npm view registry://@modelcontextprotocol/sdk@1.22.4 peerDependencies dependencies `@hono/node-server` --json || true
npm view registry://@modelcontextprotocol/sdk@1.21.0 peerDependencies dependencies `@hono/node-server` --json || true
npm view registry://@hono/node-server@2.0.5 version --json || true
npm view registry://@hono/node-server@1.19.9 version --json || trueRepository: spree/storefront
Length of output: 1873
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Node/npm availability =="
node -v || true
npm -v || true
echo "== lock package metadata =="
python3 - <<'PY'
import json
from pathlib import Path
lock=json.loads(Path('package-lock.json').read_text(encoding='utf-8'))
for name in ['node_modules/@hono/node-server','node_modules/@modelcontextprotocol/sdk']:
entry=lock['packages'].get(name)
print(f'--- {name} ---')
if not entry:
print('MISSING')
continue
for k in ['version','resolved','dependencies','optionalDependencies','peerDependencies','engines','script','files']:
print(f'{k}: {entry.get(k)}')
PY
echo "== package metadata from registry =="
tmpdir="$(mktemp -d)"
cd "$tmpdir"
npm pack registry://@hono/node-server@2.0.5 --silent --pack-destination "$PWD"
tar -xzf `@hono/node-server-2.0.5.tgz`
cat package/package.json
echo "--- `@modelcontextprotocol/sdk` imports requiring node-server ---"
npm pack registry://@modelcontextprotocol/sdk@1.22.4 --silent --pack-destination "$PWD"
tar -xzf `@modelcontextprotocol/sdk-1.22.4.tgz`
rg -n "`@hono/node-server`|hono/node-server|from '`@hono/node-server`'|from 'node:net'|process.nextTick|createServer" package/dist package/server package -g '!package.tar.gz' || trueRepository: spree/storefront
Length of output: 1435
🌐 Web query:
@modelcontextprotocol/sdk 1.29.0 @hono/node-server source imports
💡 Result:
The Model Context Protocol (MCP) TypeScript SDK version 1.29.0 was published on March 30, 2026 [1][2][3]. Regarding the use of @hono/node-server with the MCP SDK: The SDK ecosystem provides dedicated integration packages for frameworks like Hono rather than requiring manual imports from @hono/node-server in most application code [4][5][6]. 1. Integration Strategy: Instead of manually wiring MCP transports through @hono/node-server, the recommended approach is to use the @modelcontextprotocol/hono package [4][6]. This package provides thin adapters—specifically createMcpHonoApp()—that pre-configure the Hono application with necessary MCP defaults, such as DNS rebinding protection and JSON body parsing [7][8][6]. 2. Handling Node.js: When running a Hono-based MCP server on Node.js, you utilize @hono/node-server to serve the Hono application [5][9]. For example: import { serve } from '@hono/node-server'; import { createMcpHonoApp } from '@modelcontextprotocol/hono'; //... configure server... const app = createMcpHonoApp; //... register routes... serve({ fetch: app.fetch, port: 8787 }); 3. Source Imports: In the SDK's internal architecture, @hono/node-server is used for runtime compatibility (converting between Node.js HTTP IncomingMessage/ServerResponse and Web Standard APIs) [10][11]. Recent updates to the SDK have moved HTTP-related dependencies—including @hono/node-server—to optional peer dependencies to reduce the installation footprint for users who only require standard input/output (stdio) transports [12][11]. As a result, if you implement a custom HTTP transport or middleware, you may need to explicitly install @hono/node-server as a dependency in your project [12].
Citations:
- 1: https://www.npmjs.com/package/@modelcontextprotocol/sdk
- 2: https://newreleases.io/project/npm/@modelcontextprotocol/sdk/release/1.29.0
- 3: chore: bump version to 1.29.0 modelcontextprotocol/typescript-sdk#1820
- 4: https://github.com/modelcontextprotocol/typescript-sdk
- 5: https://ts.sdk.modelcontextprotocol.io/v2/serving/hono.html
- 6: https://ts.sdk.modelcontextprotocol.io/v2/api/@modelcontextprotocol/hono/
- 7: https://github.com/modelcontextprotocol/typescript-sdk/blob/e4227d13/packages/middleware/hono/README.md
- 8: https://ts.sdk.modelcontextprotocol.io/v2/api/@modelcontextprotocol/hono/hono.html
- 9: https://docs.agentic.so/publishing/guides/ts-mcp-hono
- 10: https://github.com/modelcontextprotocol/typescript-sdk/blob/2c0c481c/packages/middleware/node/src/streamableHttp.ts
- 11: fix(node): make hono an optional peer dependency modelcontextprotocol/typescript-sdk#1896
- 12: feat(deps): make HTTP/SSE transport deps optional for stdio-only consumers modelcontextprotocol/typescript-sdk#1964
🌐 Web query:
@hono/node-server 2.0.11 exports main peerDependency hono NodeHttpHandler
💡 Result:
The @hono/node-server package (including version 2.0.11) does not export a module or class named NodeHttpHandler [1][2][3]. The core functionality of this adapter is provided through exports such as serve, getRequestListener, and various type definitions like HttpBindings [4][1][3]. Regarding peer dependencies, @hono/node-server depends on the hono package [4][2]. It is a standard practice for Hono adapters to include hono as a dependency to ensure compatibility with the Hono framework [1][5]. If you are looking for Node.js HTTP request handling, @hono/node-server provides the getRequestListener function, which bridges Node.js HTTP server requests with Hono's fetch-based API [3].
Citations:
- 1: https://github.com/honojs/node-server/
- 2: https://registry.npmjs.org/@hono/node-server
- 3: https://deepwiki.com/honojs/node-server/4-api-reference
- 4: https://www.npmjs.com/package/@hono/node-server
- 5: https://github.com/honojs/node-server/releases/tag/v2.0.0
🏁 Script executed:
#!/bin/bash
set -euo pipefail
tmpdir="$(mktemp -d)"
cd "$tmpdir"
for pkg_ver in '`@hono/node-server`@2.0.11' '`@hono/node-server`@1.19.9' '`@modelcontextprotocol/sdk`@1.22.4' '`@modelcontextprotocol/sdk`@1.29.0'; do
echo "===== $pkg_ver ====="
npm pack "$pkg_ver" --silent --pack-destination "$PWD"
# package tarball name is package-name-version.tgz after unparsed shell quote is removed by npm; here npm is ok
done
echo "== node-server package.json and source exports =="
tar -xzf node-server-2.0.11.tgz package.tar.gz 2>/dev/null || tar -xzf package.tar.gz
cat package/package.json
rg -n "function serve|getRequestListener|NodeHttpHandler|from '`@hono`|hono" package -g '!package.tar.gz' || true
cd "$tmpdir"
rm -rf package package.tar.gz node-server-2.0.11.tgz
tar -xzf package.tar.gz
cat package/package.json
rg -n "`@hono/node-server`|hono/node-server|NodeHttpHandler|serve\(|getRequestListener|createServer|StreamableHTTPServerTransport|JSONRPCServer|send" package -g '!package.tar.gz' || trueRepository: spree/storefront
Length of output: 146
🌐 Web query:
@hono/node-server 2.0.0 breaking changes serve getRequestListener package.json version
💡 Result:
The release of @hono/node-server version 2.0.0, published on April 21, 2026, introduced two primary breaking changes [1][2]: 1. Dropped support for Node.js v18: Version 2.0.0 requires Node.js v20 or later, as Node.js v18 has reached its end-of-life [1][3]. 2. Removed the Vercel adapter: The specialized adapter previously available at @hono/node-server/vercel has been removed [1][4]. It is no longer necessary for modern Vercel runtimes [2]. If you were previously using the Vercel adapter, you can implement the equivalent functionality yourself using the getRequestListener function [1][3]. The removed adapter was essentially a wrapper around getRequestListener, and you can create a similar handler within your own project [1][4]. Regarding getRequestListener and serve, these core APIs remain the primary methods for bridging Hono applications to Node.js servers, and their fundamental usage remains stable in v2.0.0 [5]. The release focuses heavily on performance optimizations, such as fast-path body parsing and URL construction, which are applied internally within these existing APIs [5]. For version management, the package.json dependency should be updated to ^2.0.0 (or a specific version like 2.0.0) to adopt these changes [6]. Sources: [1] https://github.com/honojs/node-server/releases/tag/v2.0.0 [2] https://newreleases.io/project/npm/@hono/node-server/release/2.0.0 [3] https://npmx.dev/package-changelog/@hono/node-server/v/2.0.4 [5] https://zenn.dev/yusukebe/articles/9dce6cf7dc6e41?locale=en [6] https://npmx.dev/package/@hono/node-server/v/2.0.0 [4] https://npmx.dev/package-changelog/@hono/node-server/v/2.0.1
Citations:
- 1: https://github.com/honojs/node-server/releases/tag/v2.0.0
- 2: https://newreleases.io/project/npm/@hono/node-server/release/2.0.0
- 3: https://npmx.dev/package-changelog/@hono/node-server/v/2.0.4
- 4: https://npmx.dev/package-changelog/@hono/node-server/v/2.0.1
- 5: https://zenn.dev/yusukebe/articles/9dce6cf7dc6e41?locale=en
- 6: https://npmx.dev/package/@hono/node-server/v/2.0.0
Verify the cross-major @hono/node-server override.
@modelcontextprotocol/sdk still declares @hono/node-server as ^1.19.9, while this override forces 2.0.x; 2.0.11 requires Node 20+ and removed @hono/node-server/vercel. If the SDK or existing code depends on the v1 API, replace the override with a patched v1-compatible release.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 55, Review the `@hono/node-server` dependency override in
package.json for compatibility with `@modelcontextprotocol/sdk` and existing
imports, especially `@hono/node-server/vercel`. If v1 APIs are required, replace
the ^2.0.5 constraint with a patched v1-compatible release; otherwise verify the
Node 20 requirement and removed export are supported.
1 participant
Summary by CodeRabbit