fix: upgrade hono to 4.12.25 (CVE-2026-54290)#11023
Conversation
|
This does not appear to fully remove the vulnerable Hono version yet: bun.lock still contains @modelcontextprotocol/sdk/hono resolved to hono@4.12.8, while the PR adds a separate top-level hono@4.12.25. If the CVE is reachable through the MCP SDK path, the old copy remains shipped. Please update or override the transitive dependency and verify the lockfile contains no vulnerable Hono instance before merge. @mudler |
addressed. pls review. |
localai-org-maint-bot
left a comment
localai-org-maint-bot
left a comment
There was a problem hiding this comment.
The dependency issue from my prior comment is addressed: the override now forces Hono 4.12.25 and the lockfile no longer contains 4.12.8. The remaining merge blocker is the failing DCO check; please sign off/amend the contributor commit and force-push.
Automated dependency upgrade by OrbisAI Security Signed-off-by: orbisai0security <mediratta@gmail.com> Signed-off-by: Anupam Mediratta <mediratta@gmail.com>
Add package.json `overrides` field to force hono@4.12.25 across the entire dependency graph, including the transitive copy pulled in by @modelcontextprotocol/sdk. Previously bun.lock retained a scoped `@modelcontextprotocol/sdk/hono` entry resolved to the vulnerable hono@4.12.8; the override removes that entry so only the patched version ships. Assisted-by: Claude Code:claude-sonnet-4-6 Signed-off-by: Anupam Mediratta <mediratta@gmail.com>
0c1e31e to
afb7f67
Compare
addressed. pls review. |
localai-org-maint-bot
left a comment
localai-org-maint-bot
left a comment
There was a problem hiding this comment.
Re-reviewed at afb7f67 after the DCO correction. The override now resolves the entire lockfile to the patched Hono 4.12.25; no 4.12.8 entry remains. The DOMPurify and React Router lock movement matches dependency versions already present on current master, rather than expanding this PR’s intended source change. The branch is mergeable and DCO is green. @mudler this is good to merge.
2 participants
Summary
Upgrade hono from 4.12.8 to 4.12.25 to fix CVE-2026-54290.
Vulnerability
CVE-2026-54290core/http/react-ui/bun.lockDescription: hono: CORS Middleware reflects any Origin with credentials when
origindefaults to the wildcardEvidence
Scanner confirmation: trivy rule
CVE-2026-54290flagged this pattern.Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a Go service - vulnerabilities in HTTP handlers are remotely exploitable.
Changes
core/http/react-ui/bun.lockcore/http/react-ui/package.jsonVerification
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security