chore(deps): 剩余中低危清零 —— hono / ip-address / fast-uri 抬到修复版
上一轮把 3 个 high 压掉后，复扫仍余 6 条（2 low / 4 moderate），全部经 @modelcontextprotocol/sdk 传递： - hono <4.13.11（serveStatic 二次解码绕过中间件）→ ^4.13.14； - ip-address <=10.7.3（zone 标识符二次方耗时 DoS）→ ^10.7.5； - fast-uri <3.1.9（scheme 伪造 / host 混淆 / 路径等价）→ ^3.1.9。 与 dependabot #3/#6/#7 同源，覆盖后那三个 PR 无增量，随本提交关闭。 当前 pnpm audit：No known vulnerabilities found。
This commit is contained in:
jkooe committed
1 parent
5e32d7fa55
commit
a769479a2a
2 files changed
+24
-16
No files matched your search
Generated
+19
-16
@@ -7,6 +7,9 @@ settings:
|
||||
overrides:
|
||||
zod: ^4.6.6
|
||||
body-parser: ^2.4.0
|
||||
hono: ^4.13.14
|
||||
ip-address: ^10.7.5
|
||||
fast-uri: ^3.1.9
|
||||
|
||||
importers:
|
||||
|
||||
@@ -325,7 +328,7 @@ packages:
|
||||
resolution: {integrity: sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==}
|
||||
engines: {node: '>=20'}
|
||||
peerDependencies:
|
||||
hono: ^4
|
||||
hono: ^4.13.14
|
||||
|
||||
'@jridgewell/gen-mapping@0.3.13':
|
||||
resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
|
||||
@@ -979,8 +982,8 @@ packages:
|
||||
fast-deep-equal@3.1.3:
|
||||
resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
|
||||
|
||||
fast-uri@3.1.8:
|
||||
resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
|
||||
fast-uri@3.1.9:
|
||||
resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==}
|
||||
|
||||
fdir@6.5.0:
|
||||
resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
|
||||
@@ -1035,8 +1038,8 @@ packages:
|
||||
resolution: {integrity: sha512-nbfWpyRMcMrPMmDwJB+dhX/eiaPKtc2RB+0QZskqJ3WjRA/FDS0e9hZrx8EC/lbEv8gXy98FcDbNa/dspAaJMg==}
|
||||
engines: {node: '>=12.0.0'}
|
||||
|
||||
hono@4.13.9:
|
||||
resolution: {integrity: sha512-7dMkQmZoC4E6F7AtaQSPhlWAdnBti+j7rreMZl8QB4jFiEhP9TWbGWUMi8WYzBCgmgulxuvLQupKqo+Co6Omyg==}
|
||||
hono@4.13.14:
|
||||
resolution: {integrity: sha512-yhRLQ21U6qa9Hsu2N7Qcbh8tE+WKEcoErjIo56LeSGiGXGp9sA7UpE86Ui9uexb61KakiGwuHMn2QdV7w6i6kQ==}
|
||||
engines: {node: '>=16.9.0'}
|
||||
|
||||
hookable@5.5.3:
|
||||
@@ -1053,8 +1056,8 @@ packages:
|
||||
inherits@2.0.4:
|
||||
resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
|
||||
|
||||
ip-address@10.7.2:
|
||||
resolution: {integrity: sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==}
|
||||
ip-address@10.7.5:
|
||||
resolution: {integrity: sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==}
|
||||
engines: {node: '>= 12'}
|
||||
|
||||
ipaddr.js@1.9.1:
|
||||
@@ -1721,9 +1724,9 @@ snapshots:
|
||||
'@esbuild/win32-x64@0.28.2':
|
||||
optional: true
|
||||
|
||||
'@hono/node-server@2.1.1(hono@4.13.9)':
|
||||
'@hono/node-server@2.1.1(hono@4.13.14)':
|
||||
dependencies:
|
||||
hono: 4.13.9
|
||||
hono: 4.13.14
|
||||
|
||||
'@jridgewell/gen-mapping@0.3.13':
|
||||
dependencies:
|
||||
@@ -1748,7 +1751,7 @@ snapshots:
|
||||
|
||||
'@modelcontextprotocol/sdk@1.32.1(zod@4.6.7)':
|
||||
dependencies:
|
||||
'@hono/node-server': 2.1.1(hono@4.13.9)
|
||||
'@hono/node-server': 2.1.1(hono@4.13.14)
|
||||
ajv: 8.20.0
|
||||
ajv-formats: 3.0.1(ajv@8.20.0)
|
||||
content-type: 1.0.5
|
||||
@@ -1758,7 +1761,7 @@ snapshots:
|
||||
eventsource-parser: 3.1.1
|
||||
express: 5.2.1
|
||||
express-rate-limit: 8.7.0(express@5.2.1)
|
||||
hono: 4.13.9
|
||||
hono: 4.13.14
|
||||
jose: 6.2.12
|
||||
json-schema-typed: 8.0.2
|
||||
pkce-challenge: 5.0.1
|
||||
@@ -2149,7 +2152,7 @@ snapshots:
|
||||
ajv@8.20.0:
|
||||
dependencies:
|
||||
fast-deep-equal: 3.1.3
|
||||
fast-uri: 3.1.8
|
||||
fast-uri: 3.1.9
|
||||
json-schema-traverse: 1.0.0
|
||||
require-from-string: 2.0.2
|
||||
|
||||
@@ -2330,7 +2333,7 @@ snapshots:
|
||||
dependencies:
|
||||
debug: 4.4.3
|
||||
express: 5.2.1
|
||||
ip-address: 10.7.2
|
||||
ip-address: 10.7.5
|
||||
transitivePeerDependencies:
|
||||
- supports-color
|
||||
|
||||
@@ -2371,7 +2374,7 @@ snapshots:
|
||||
|
||||
fast-deep-equal@3.1.3: {}
|
||||
|
||||
fast-uri@3.1.8: {}
|
||||
fast-uri@3.1.9: {}
|
||||
|
||||
fdir@6.5.0(picomatch@4.0.7):
|
||||
optionalDependencies:
|
||||
@@ -2425,7 +2428,7 @@ snapshots:
|
||||
|
||||
highlight.js@11.12.0: {}
|
||||
|
||||
hono@4.13.9: {}
|
||||
hono@4.13.14: {}
|
||||
|
||||
hookable@5.5.3: {}
|
||||
|
||||
@@ -2443,7 +2446,7 @@ snapshots:
|
||||
|
||||
inherits@2.0.4: {}
|
||||
|
||||
ip-address@10.7.2: {}
|
||||
ip-address@10.7.5: {}
|
||||
|
||||
ipaddr.js@1.9.1: {}
|
||||
|
||||
|
||||
@@ -16,3 +16,8 @@ allowBuilds:
|
||||
overrides:
|
||||
zod: ^4.6.6
|
||||
body-parser: ^2.4.0
|
||||
# 2026-10-27：MCP SDK 传递链的剩余中低危，一并抬到修复版（同 major）。
|
||||
# 对应 dependabot #3/#6/#7，覆盖后那三个 PR 已无增量，随同一提交关停。
|
||||
hono: ^4.13.14
|
||||
ip-address: ^10.7.5
|
||||
fast-uri: ^3.1.9
|
||||
Reference in new issue
Block a user