From d87aa6ea5b073db69bd6364e519af38595701827 Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Mon, 17 Aug 2026 08:33:12 +0000 Subject: [PATCH 1/4] chore: upgrade hono to ^4.13.2 to address CVE-2026-71848, CVE-2026-71849, CVE-2026-71850 Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 729066911..b599363de 100644 --- a/yarn.lock +++ b/yarn.lock @@ -16147,9 +16147,9 @@ __metadata: linkType: hard "hono@npm:^4.11.4": - version: 4.12.25 - resolution: "hono@npm:4.12.25" - checksum: 10c0/9216d647fe2f39b17855b0e74913688b837e3fa9519d367c7beeec399265b36608a820928cc33ab926eee58fe2daf7e33296235b52e56dbfac0fbcd51a5e818e + version: 4.13.2 + resolution: "hono@npm:4.13.2" + checksum: 10c0/063daaa596bfb1ed3a4dc523a9f47725cf8d56e0918c21a241161f6f1996229f5525bf0f70d6b15cc28912720ddde519584eeb06fb92730a66f01e39faba8131 languageName: node linkType: hard From 40b45cac301e7c3334632a346e1dfe06577a50cf Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Mon, 17 Aug 2026 08:33:31 +0000 Subject: [PATCH 2/4] chore: add CHANGELOG entry for hono upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cd9633879..a71dd5303 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Upgraded Next.js to 16.3.1 to bound memory retained by high-cardinality dynamic route cache entries. [#1594](https://github.com/sourcebot-dev/sourcebot/pull/1594) - Fixed memory leak attributed to CodeMirror allocating objects on heap that were never freed. [#1580](https://github.com/sourcebot-dev/sourcebot/pull/1580) - Kept Git provider credentials out of subprocess arguments and on-disk configuration by using isolated in-memory credential caches. [#1584](https://github.com/sourcebot-dev/sourcebot/pull/1584) +- Upgraded `hono` to `^4.13.2`. [#1597](https://github.com/sourcebot-dev/sourcebot/pull/1597) ## [5.1.7] - 2026-08-13 From f301d747693572483fd58fe7bd14fe1384e89758 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 12:35:56 +0000 Subject: [PATCH 3/4] chore: upgrade hono to 4.13.7 Refreshes the yarn.lock entry for hono from 4.13.0 to 4.13.7. hono is a transitive dependency of @modelcontextprotocol/sdk, whose `^4.11.4` range already admitted the patched version, so no manifest change or resolution override is needed. Addresses CVE-2026-84363, CVE-2026-84364 and CVE-2026-84365. Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 0a6a1934e..1dcf487d6 100644 --- a/yarn.lock +++ b/yarn.lock @@ -15619,9 +15619,9 @@ __metadata: linkType: hard "hono@npm:^4.11.4": - version: 4.13.0 - resolution: "hono@npm:4.13.0" - checksum: 10c0/d7cfb4d1063be19bea1982ea2a6b3cfa1840e8403a03203e86d17278e76fed11e7483974738345257543e183a935ea73ffc6d4a1e6ad7f0008451f55cdf8be7b + version: 4.13.7 + resolution: "hono@npm:4.13.7" + checksum: 10c0/29672a94a4f2be7f3f4d959ad69808dd3bbc220909ca4f9660997022ff45d48ae71e42a460e417d808809d68110196f19359aaab2b14ae6a750331d789601b5a languageName: node linkType: hard From b7529f609c7e0c7595fdb71457c1b636386a35c2 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 12:35:56 +0000 Subject: [PATCH 4/4] Update changelog Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e091548b4..9d14b6349 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Fixed +- Upgraded `hono` to `4.13.7`. [#1643](https://github.com/sourcebot-dev/sourcebot/pull/1643) + ## [5.1.11] - 2026-09-10 ### Added