From a8f460499b9ccafc0e5f0d201678381402b44416 Mon Sep 17 00:00:00 2001 From: DrSmoothl <1787882683@qq.com> Date: Tue, 3 Nov 2026 09:41:20 +0800 Subject: [PATCH] fix(deps): update vulnerable transitive dependencies --- packages/core/package.json | 3 +- .../core/tests/webui-static-frontend.test.ts | 33 +++- pnpm-lock.yaml | 156 ++++-------------- pnpm-workspace.yaml | 7 +- 4 files changed, 69 insertions(+), 130 deletions(-) diff --git a/packages/core/package.json b/packages/core/package.json index c1b212da..fca46271 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -53,8 +53,7 @@ "tar": "^7.5.22" }, "devDependencies": { - "@hono/node-server": "^1.19.15", - "@rollup/plugin-node-resolve": "^16.0.3", + "@hono/node-server": "^2.1.4", "@types/node": "catalog:", "cross-env": "^10.1.0", "hono": "^4.13.11", diff --git a/packages/core/tests/webui-static-frontend.test.ts b/packages/core/tests/webui-static-frontend.test.ts index 79fc522f..a319ce4d 100644 --- a/packages/core/tests/webui-static-frontend.test.ts +++ b/packages/core/tests/webui-static-frontend.test.ts @@ -1,6 +1,6 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'; import { Hono } from 'hono'; -import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'; +import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; import { tmpdir } from 'node:os'; import path from 'node:path'; import { registerStaticFrontend } from '../src/webui/static-frontend'; @@ -44,4 +44,35 @@ describe('runtime target document delivery', () => { expect((await app.request(url)).status).toBe(404); } }); + + it('does not serve a protected static path through a second percent decode', async () => { + mkdirSync(path.join(root, 'admin')); + writeFileSync(path.join(root, 'admin', 'private.txt'), 'protected fixture'); + const app = new Hono(); + app.use('/admin/*', async (c) => c.text('unauthorized', 401)); + registerStaticFrontend(app, root, null); + + for (const url of ['/admin/private.txt', '/%61dmin/private.txt']) { + const response = await app.request(url); + expect(response.status).toBe(401); + expect(await response.text()).toBe('unauthorized'); + } + + // The router sees /%61dmin; decoding again would reach /admin + // after the middleware for that prefix has already been skipped. + const response = await app.request('/%%36%31dmin/private.txt'); + expect(await response.text()).toBe(html); + }); + + it.each(['hello world.js', '图标.js'])( + 'still serves ordinarily encoded asset names: %s', + async (filename) => { + writeFileSync(path.join(root, filename), 'window.encodedAsset = true;'); + const app = new Hono(); + registerStaticFrontend(app, root, null); + const response = await app.request(`/${encodeURIComponent(filename)}`); + expect(response.status).toBe(200); + expect(await response.text()).toBe('window.encodedAsset = true;'); + }, + ); }); diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b44df689..8d74facb 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -20,9 +20,9 @@ overrides: tar: ^7.5.13 esbuild@<0.28.1: ^0.28.1 '@babel/core@<7.29.6': ^7.29.6 - qs@<=6.15.3: ^6.16.0 + qs@<=6.16.0: ^6.16.1 fast-uri@<3.1.8: ^3.1.8 - '@hono/node-server@<1.19.15': ^1.19.15 + '@hono/node-server@<2.1.4': ^2.1.4 hono: ~4.13.11 postcss@<=8.5.22: ^8.5.23 ip-address@<10.7.1: ^10.7.1 @@ -33,7 +33,8 @@ overrides: '@humanfs/node@<0.16.8': 0.16.8 baseline-browser-mapping@<2.11.0: 2.11.0 figlet@<1.11.3: 1.11.3 - seroval@<1.6.3: 1.6.3 + seroval@<1.6.11: 1.6.11 + minimatch@<11.0.3: 11.0.3 source-map-js@<1.2.2: 1.2.2 proxy-addr@<2.0.8: 2.0.8 zod@>=4.0.0 <4.6.6: ^4.6.6 @@ -169,11 +170,8 @@ importers: version: 7.5.22 devDependencies: '@hono/node-server': - specifier: ^1.19.15 - version: 1.19.17(hono@4.13.13) - '@rollup/plugin-node-resolve': - specifier: ^16.0.3 - version: 16.0.3(rollup@4.60.4) + specifier: ^2.1.4 + version: 2.1.5(hono@4.13.13) '@snowluma/sqlite': specifier: workspace:* version: link:../sqlite @@ -894,9 +892,9 @@ packages: '@floating-ui/utils@0.2.11': resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==} - '@hono/node-server@1.19.17': - resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==} - engines: {node: '>=18.14.1'} + '@hono/node-server@2.1.5': + resolution: {integrity: sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==} + engines: {node: '>=20'} peerDependencies: hono: ~4.13.11 @@ -924,6 +922,9 @@ packages: resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==} engines: {node: '>=18.0.0'} + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} + '@istanbuljs/schema@0.1.6': resolution: {integrity: sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==} engines: {node: '>=8'} @@ -1742,24 +1743,6 @@ packages: '@rolldown/pluginutils@1.0.1': resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==} - '@rollup/plugin-node-resolve@16.0.3': - resolution: {integrity: sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==} - engines: {node: '>=14.0.0'} - peerDependencies: - rollup: ^2.78.0||^3.0.0||^4.0.0 - peerDependenciesMeta: - rollup: - optional: true - - '@rollup/pluginutils@5.3.0': - resolution: {integrity: sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==} - engines: {node: '>=14.0.0'} - peerDependencies: - rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0 - peerDependenciesMeta: - rollup: - optional: true - '@rollup/rollup-android-arm-eabi@4.60.4': resolution: {integrity: sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ==} cpu: [arm] @@ -2075,9 +2058,6 @@ packages: '@types/react@19.2.14': resolution: {integrity: sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==} - '@types/resolve@1.20.2': - resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==} - '@types/semver@7.7.1': resolution: {integrity: sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==} @@ -2406,10 +2386,6 @@ packages: deep-is@0.1.4: resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} - deepmerge@4.3.1: - resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==} - engines: {node: '>=0.10.0'} - depd@2.0.0: resolution: {integrity: sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==} engines: {node: '>= 0.8'} @@ -2557,9 +2533,6 @@ packages: resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==} engines: {node: '>=4.0'} - estree-walker@2.0.2: - resolution: {integrity: sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==} - estree-walker@3.0.3: resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==} @@ -2788,10 +2761,6 @@ packages: resolution: {integrity: sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==} engines: {node: '>= 0.10'} - is-core-module@2.16.1: - resolution: {integrity: sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==} - engines: {node: '>= 0.4'} - is-extglob@2.1.1: resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==} engines: {node: '>=0.10.0'} @@ -2800,9 +2769,6 @@ packages: resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==} engines: {node: '>=0.10.0'} - is-module@1.0.0: - resolution: {integrity: sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==} - is-promise@4.0.0: resolution: {integrity: sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==} @@ -3010,8 +2976,8 @@ packages: resolution: {integrity: sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==} engines: {node: '>=18'} - minimatch@10.2.5: - resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==} + minimatch@11.0.3: + resolution: {integrity: sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==} engines: {node: 18 || 20 || >=22} minipass@7.1.3: @@ -3130,9 +3096,6 @@ packages: resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==} engines: {node: '>=8'} - path-parse@1.0.7: - resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==} - path-to-regexp@8.4.2: resolution: {integrity: sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==} @@ -3203,10 +3166,6 @@ packages: resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==} engines: {node: '>=6'} - qs@6.16.0: - resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} - engines: {node: '>=0.6'} - qs@6.16.1: resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} engines: {node: '>=0.6'} @@ -3273,10 +3232,6 @@ packages: resolve-pkg-maps@1.0.0: resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==} - resolve@1.22.12: - resolution: {integrity: sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==} - engines: {node: '>= 0.4'} - rolldown@1.1.5: resolution: {integrity: sha512-t9z29cJjXf/vxQ8dyhCSpt6H6aSwHTk8cT5I3iy6SMXuFpk5mB6PL6XfC8PCwrPTx93udwKUm9HRteAlTGBLiA==} engines: {node: ^20.19.0 || >=22.12.0} @@ -3317,10 +3272,10 @@ packages: resolution: {integrity: sha512-S0xQPhUTefAhNvNWFg0c1J8qJArHt5KdtJ/cFAofo06KD1MVSeFWyl4iiu+ApDIuw0WhjpOfCdgConOfAnLgkw==} engines: {node: '>=10'} peerDependencies: - seroval: 1.6.3 + seroval: 1.6.11 - seroval@1.6.3: - resolution: {integrity: sha512-5PwLbVPpT4DEki1hYVSSsoxWY6xCNMVucAVLK/CH0mXSDfp/I4KaAex72q80GNt5hpn7CCMGdSpIg4YGqH/wXQ==} + seroval@1.6.11: + resolution: {integrity: sha512-hpb6XnMCGN/A+79Uf8V7/iTGkyyyazNn5X0CoCAp7Uy9vT3RT8jZ9GLcnxGoVjg3P8AArbe4ZVHq6C8oT2a0kA==} engines: {node: '>=10'} serve-static@2.2.1: @@ -3389,10 +3344,6 @@ packages: resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==} engines: {node: '>=8'} - supports-preserve-symlinks-flag@1.0.0: - resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==} - engines: {node: '>= 0.4'} - tailwind-merge@3.5.0: resolution: {integrity: sha512-I8K9wewnVDkL1NTGoqWmVEIlUcB9gFriAEkXkfCjX5ib8ezGxtR3xD7iZIxrfArjEsH7F1CHD4RFUtxefdqV/A==} @@ -3939,7 +3890,7 @@ snapshots: dependencies: '@eslint/object-schema': 3.0.5 debug: 4.4.3(supports-color@7.2.0) - minimatch: 10.2.5 + minimatch: 11.0.3 transitivePeerDependencies: - supports-color @@ -3979,7 +3930,7 @@ snapshots: '@floating-ui/utils@0.2.11': {} - '@hono/node-server@1.19.17(hono@4.13.13)': + '@hono/node-server@2.1.5(hono@4.13.13)': dependencies: hono: 4.13.13 @@ -4003,6 +3954,8 @@ snapshots: dependencies: minipass: 7.1.3 + '@isaacs/nonrecursive-glob-match@1.0.3': {} + '@istanbuljs/schema@0.1.6': {} '@jridgewell/gen-mapping@0.3.13': @@ -4051,7 +4004,7 @@ snapshots: '@modelcontextprotocol/sdk@1.32.1(supports-color@7.2.0)(zod@4.6.7)': dependencies: - '@hono/node-server': 1.19.17(hono@4.13.13) + '@hono/node-server': 2.1.5(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -4726,24 +4679,6 @@ snapshots: '@rolldown/pluginutils@1.0.1': {} - '@rollup/plugin-node-resolve@16.0.3(rollup@4.60.4)': - dependencies: - '@rollup/pluginutils': 5.3.0(rollup@4.60.4) - '@types/resolve': 1.20.2 - deepmerge: 4.3.1 - is-module: 1.0.0 - resolve: 1.22.12 - optionalDependencies: - rollup: 4.60.4 - - '@rollup/pluginutils@5.3.0(rollup@4.60.4)': - dependencies: - '@types/estree': 1.0.8 - estree-walker: 2.0.2 - picomatch: 4.0.4 - optionalDependencies: - rollup: 4.60.4 - '@rollup/rollup-android-arm-eabi@4.60.4': optional: true @@ -4927,8 +4862,8 @@ snapshots: dependencies: '@tanstack/history': 1.161.6 cookie-es: 3.1.1 - seroval: 1.6.3 - seroval-plugins: 1.5.4(seroval@1.6.3) + seroval: 1.6.11 + seroval-plugins: 1.5.4(seroval@1.6.11) '@tanstack/store@0.9.3': {} @@ -4979,8 +4914,6 @@ snapshots: dependencies: csstype: 3.2.3 - '@types/resolve@1.20.2': {} - '@types/semver@7.7.1': {} '@types/ws@8.18.2': @@ -5054,7 +4987,7 @@ snapshots: '@typescript-eslint/types': 8.58.2 '@typescript-eslint/visitor-keys': 8.58.2 debug: 4.4.3(supports-color@7.2.0) - minimatch: 10.2.5 + minimatch: 11.0.3 semver: 7.7.4 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@6.0.2) @@ -5351,8 +5284,6 @@ snapshots: deep-is@0.1.4: {} - deepmerge@4.3.1: {} - depd@2.0.0: {} detect-libc@2.1.2: {} @@ -5507,7 +5438,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 - minimatch: 10.2.5 + minimatch: 11.0.3 natural-compare: 1.4.0 optionator: 0.9.4 optionalDependencies: @@ -5537,8 +5468,6 @@ snapshots: estraverse@5.3.0: {} - estree-walker@2.0.2: {} - estree-walker@3.0.3: dependencies: '@types/estree': 1.0.8 @@ -5585,7 +5514,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.8 - qs: 6.16.0 + qs: 6.16.1 range-parser: 1.2.1 router: 2.2.0(supports-color@7.2.0) send: 1.2.1(supports-color@7.2.0) @@ -5771,18 +5700,12 @@ snapshots: ipaddr.js@1.9.1: {} - is-core-module@2.16.1: - dependencies: - hasown: 2.0.2 - is-extglob@2.1.1: {} is-glob@4.0.3: dependencies: is-extglob: 2.1.1 - is-module@1.0.0: {} - is-promise@4.0.0: {} is-what-type@1.1.4: {} @@ -5939,8 +5862,9 @@ snapshots: dependencies: mime-db: 1.54.0 - minimatch@10.2.5: + minimatch@11.0.3: dependencies: + '@isaacs/nonrecursive-glob-match': 1.0.3 brace-expansion: 5.0.12 minipass@7.1.3: {} @@ -6053,8 +5977,6 @@ snapshots: path-key@3.1.1: {} - path-parse@1.0.7: {} - path-to-regexp@8.4.2: {} pathe@2.0.3: {} @@ -6103,11 +6025,6 @@ snapshots: punycode@2.3.1: {} - qs@6.16.0: - dependencies: - es-define-property: 1.0.1 - side-channel: 1.1.1 - qs@6.16.1: dependencies: es-define-property: 1.0.1 @@ -6164,13 +6081,6 @@ snapshots: resolve-pkg-maps@1.0.0: {} - resolve@1.22.12: - dependencies: - es-errors: 1.3.0 - is-core-module: 2.16.1 - path-parse: 1.0.7 - supports-preserve-symlinks-flag: 1.0.0 - rolldown@1.1.5: dependencies: '@oxc-project/types': 0.139.0 @@ -6266,11 +6176,11 @@ snapshots: transitivePeerDependencies: - supports-color - seroval-plugins@1.5.4(seroval@1.6.3): + seroval-plugins@1.5.4(seroval@1.6.11): dependencies: - seroval: 1.6.3 + seroval: 1.6.11 - seroval@1.6.3: {} + seroval@1.6.11: {} serve-static@2.2.1(supports-color@7.2.0): dependencies: @@ -6348,8 +6258,6 @@ snapshots: dependencies: has-flag: 4.0.0 - supports-preserve-symlinks-flag@1.0.0: {} - tailwind-merge@3.5.0: {} tailwindcss@4.2.2: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ed16b927..b4784467 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -10,9 +10,9 @@ overrides: 'tar': ^7.5.13 'esbuild@<0.28.1': ^0.28.1 '@babel/core@<7.29.6': ^7.29.6 - 'qs@<=6.15.3': ^6.16.0 + 'qs@<=6.16.0': ^6.16.1 'fast-uri@<3.1.8': ^3.1.8 - '@hono/node-server@<1.19.15': ^1.19.15 + '@hono/node-server@<2.1.4': ^2.1.4 'hono': ~4.13.11 'postcss@<=8.5.22': ^8.5.23 'ip-address@<10.7.1': ^10.7.1 @@ -23,7 +23,8 @@ overrides: '@humanfs/node@<0.16.8': 0.16.8 'baseline-browser-mapping@<2.11.0': 2.11.0 'figlet@<1.11.3': 1.11.3 - 'seroval@<1.6.3': 1.6.3 + 'seroval@<1.6.11': 1.6.11 + 'minimatch@<11.0.3': 11.0.3 'source-map-js@<1.2.2': 1.2.2 'proxy-addr@<2.0.8': 2.0.8 'zod@>=4.0.0 <4.6.6': ^4.6.6