fix(deps): bump hono, astro, and docs-site overrides to resolve audit CVEs

[agentHits]

Summary

Resolves 10 vulnerability advisories (1 Critical, 5 High, 4 Moderate) reported by bun audit across root and docs-site:

1. Root proxy runtime (package.json / bun.lock)

• hono: bumped in overrides from 4.13.1 to ^4.13.8 (resolves advisories for <4.13.5):
  • GHSA-gqvv-2mrq-wpjv (Moderate): Incomplete fix for CVE-2026-39408: toSSG() directory traversal outside output directory.
  • GHSA-g6gw-c38x-mqfc (Moderate): Unbounded dot-notation nesting in parseBody() causing memory exhaustion / DoS.
  • GHSA-crvj-82cr-hjcx (Moderate): Query parser reads parameters after URL fragment (#), causing cache-key and proxy interpretation differentials.

2. Docs site (docs-site/package.json / docs-site/bun.lock)

• astro: bumped from ^7.2.2 to ^7.3.3 (resolves advisories for <7.2.8):
  • GHSA-26w7-cxv4-gfx2 (Critical): Remote code execution through AVIF image optimization.
  • GHSA-376h-93r7-7g6f (Moderate): Authorization bypass from missing path-segment boundary check when stripping base.
• sharp: bumped from ^0.35.3 to ^0.35.4 (resolves <0.35.4 libheif vulnerabilities GHSA-rgj7-g3m4-5g8c, GHSA-2jg2-4ch7-h545).
• svgo: bumped in overrides from 4.0.2 to 4.1.0 (resolves GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r executable script sanitization bypasses).
• smol-toml: added override ^1.8.0 (resolves GHSA-7w5x-hrqm-74c2 DoS via malformed TOML documents).
• js-yaml: added override ^4.3.2 (resolves GHSA-2883-xcg3-v3hh CPU exhaustion on empty merge sources).

Verification

• bun audit in root: 0 vulnerabilities (No vulnerabilities found).
• bun audit in docs-site: 0 vulnerabilities (No vulnerabilities found).
• bun audit in gui: 0 vulnerabilities (No vulnerabilities found).
• bun run typecheck in root: passed (bun x tsc --noEmit).
• astro build in docs-site: passed (449 pages built cleanly).
• bun run privacy:scan and bun run structure:check: passed.
• Focused CI tests in root (tests/ci-workflows/package-tree-integrity.test.ts, repo-hygiene.test.ts, structure-ssot.test.ts): 62 passed, 0 failed.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Chores
  • Updated internal package versions and compatibility overrides across the project.
  • Refreshed documentation-site tooling versions, including Astro, Sharp, SVGO, Smol-TOML, and js-yaml.
  • Updated the Hono compatibility override to version 4.13.8.
  • These updates keep project tooling aligned with newer supported versions and maintain consistent package compatibility across the documentation site and main project.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1ac52780-1d29-4f7c-b7b7-acb0292accaa

📥 Commits

Reviewing files that changed from the base of the PR and between 7c9479b and 329b458.

⛔ Files ignored due to path filters (2)

• bun.lock is excluded by !**/*.lock
• docs-site/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• docs-site/package.json
• package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates dependency and override versions in docs-site/package.json and package.json. It changes Astro, Sharp, SVGO, smol-toml, js-yaml, and Hono specifications.

Changes

Dependency updates

Layer / File(s)	Summary
Manifest version updates docs-site/package.json, package.json	docs-site/package.json:16-27 updates astro, sharp, and svgo, and adds smol-toml and js-yaml overrides. package.json:89 updates the hono override from 4.13.1 to 4.13.8.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 329b4

The dependency updates introduce no evidenced functional, security, or availability risk requiring resolution before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: dependency and override updates for Hono, Astro, and the docs site to address security advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

리뷰 · 우선순위 73 / 80

이 PR은 agentHits의 Draft 의존성 보안 패치다. 제목대로 bun audit가 잡은 취약점 10개(Critical 1, High 5, Moderate 4)를 없애려고, 루트 프록시 쪽 hono override와 docs-site의 astro / sharp / svgo / smol-toml / js-yaml을 올린다. 건드리는 파일은 딱 네 개다. package.json, bun.lock, docs-site/package.json, docs-site/bun.lock. 애플리케이션 소스 코드는 안 바꾼다.

현재 dev HEAD는 7868f5df5(tip #4867, web-search connect deadline을 가상 시계로 돌리는 테스트)이고 패키지는 2.58.0이다. 이 PR 베이스도 그 tip이라 재기반은 필요 없다. 지금 dev의 루트 overrides에는 이미 hono: "4.13.1"과 @hono/node-server: "2.1.0"이 박혀 있다. hono는 직접 의존성이 아니라 @modelcontextprotocol/sdk가 끌어오는 간접 의존성이다. docs-site는 지금 astro ^7.2.2, sharp ^0.35.3, override svgo 4.0.2다.

루트 쪽 핵심은 hono를 4.13.1에서 ^4.13.8로 올리는 것이다. lock은 hono@4.13.8로 풀린다. 저자가 적은 Moderate 세 개(toSSG 경로 탈출, parseBody 중첩 DoS, fragment 뒤 쿼리 파서)는 <4.13.5 계열이다. 다만 opencodex 런타임이 toSSG()를 쓰는지는 이 저장소 소스에 hono import가 없어서, MCP SDK가 실제로 쓰는 표면(파서/서버)에만 실질 위험이 있다. 그래도 audit을 0으로 만들고 override 핀을 최신 패치선으로 올리는 방향은 #3346(fast-uri/qs CVE override)과 같은 계열이다.

docs-site 쪽이 더 무겁다. astro를 ^7.2.2 → ^7.3.3으로 올리고, Critical인 AVIF 이미지 최적화 RCE(GHSA-26w7-cxv4-gfx2, <7.2.8)와 base strip 권한 우회를 막는다. sharp ^0.35.4, svgo 4.1.0, 그리고 smol-toml / js-yaml override를 추가한다. lock에는 @astrojs/compiler-binding 0.3.2→0.4.1 같은 플랫폼 바이너리 갱신이 많이 따라온다. 저자는 로컬에서 bun audit(root/docs-site/gui) 0, root typecheck, astro build 449페이지, privacy/structure 스캔, 집중 CI 테스트 62개를 통과했다고 적었다.

지금 CI는 hygiene / enforce-target이 unsponsored_surface로 실패했고, 라벨 intake: hygiene-blocked가 붙어 있다. MAINTAINERS.md가 의존성 설치·보안 경계 변경에 명시 보안 리뷰를 요구해서, 메인테이너가 maintainer-sponsored를 달기 전에는 게이트가 Draft로 붙잡아 둔다. 체크리스트 네 칸은 저자가 이미 채웠지만, 그 상태만으로 Ready가 되지 않는다. 봇이 자동 Draft로 내린 상태다.

types.ts/config.ts 대분할로 바로 무효화되는 PR은 아니다. 오히려 릴리스 레인과 직교하는 감사(audit) 위생이다. Critical astro는 문서 사이트 빌드 도구 표면이고, 프록시 런타임 패킷 경로와는 분리해서 보면 된다. 그래도 docs 빌드에 RCE가 있으면 기여/배포 머신 위험이니 무시하면 안 된다.

package.json overrides.hono - 예전에 정확 핀 4.13.1이었는데 이번엔 ^4.13.8로 느슨해졌다. 옆자리 @hono/node-server는 여전히 정확 핀 2.1.0이다. 보안 override는 가능하면 정확 버전(4.13.8)으로 고정하는 편이 재현·감사에 더 안전하다. lock은 이미 4.13.8이다.
intake: hygiene-blocked / unsponsored_surface - 의존성 표면이라 예상된 차단이다. 메인테이너 보안 리뷰 후 maintainer-sponsored가 필요하다.
Draft(게이트 자동) - 후원 라벨과 exact-head CI가 그린이 되기 전에는 Ready로 올리면 안 된다.
docs-site/bun.lock compiler-binding 0.3.2→0.4.1 - astro 마이너 범프에 따른 정상 잠금 갱신으로 보이지만, CI의 docs 빌드 잡이 exact-head에서 한 번 더 확인돼야 한다. 로컬 449페이지 성공만으로는 게이트를 못 넘는다.
hono advisory 중 toSSG - 이 저장소에 직접 hono 사용처가 없어 실질 공격면은 MCP SDK 경로에 한정될 수 있다. audit 0은 맞지만, “프록시 런타임 Critical”로 과장하면 안 된다. Critical은 docs-site astro 쪽이다.
bug 라벨 - deps CVE bump인데 bug로 달려 있다. 동작 회귀가 아니라 감사 위생이면 chore/security에 더 가깝다. 라벨은 바꾸지 말라는 규칙이라 참고만 한다.

메인테이너의 판단이 필요한 지점

• 보안 리뷰 후 maintainer-sponsored를 달고 이 PR을 바로 탈 Draft할지.
• 루트 hono override를 ^4.13.8로 둘지, 예전처럼 정확 핀 4.13.8로 되돌릴지.
• docs-site astro 7.3 마이너와 sharp/svgo/toml/yaml override를 한 PR에 묶을지, 루트 hono만 먼저 분리할지(지금은 한 묶음이 합리적이다).
• gui는 audit 0이라 변경 없음이 맞는지, gui overrides도 같은 패치선으로 맞출지.

너의 추천
KEEP Draft. 방향은 #3346류 CVE override와 같고, tip도 현재 dev와 맞다. 메인테이너가 보안 리뷰하고 maintainer-sponsored를 단 뒤, exact-head CI(특히 docs 빌드)가 그린이면 머지하면 된다. 가능하면 hono override를 4.13.8 정확 핀으로 맞추는 한 줄 수정만 받고 가도 좋다. types/config 분할 close-don't-rebase 대상은 아니다.

이 댓글은 grok-bot이 작성했습니다

[agentHits]

Thanks for the review @lidge-jun!

Following your recommendation:

1. Exact pin for hono: Updated package.json overrides to exact-pin "hono": "4.13.8" (removed the caret). bun.lock and package manifest are synchronized.
2. Verification: Verified that bun audit reports 0 vulnerabilities on root and docs-site, bun run typecheck passes cleanly, and docs-site builds all 449 pages with 0 errors.
3. Checklist: All 4 items in the Review readiness checklist remain checked against the updated HEAD (7c9479b57).

Ready for security review, maintainer-sponsored labeling, and merge!

[lidge-jun]

Maintainer security review — head 7c9479b5722e3f0af56a73410ca6a74fd18905b8

MAINTAINERS.md requires explicit security review for dependency-installation surfaces, which is what unsponsored_surface is holding this PR on. This is that review. It was done by reading the manifests, the lockfiles, and this repository's import graph; no install was run.

The follow-up commit is correct

Head 7c9479b57 has "hono": "4.13.8" in root overrides with the caret removed, matching the exact pin already on the neighbouring @hono/node-server. Root bun.lock carries the same 4.13.8 in its overrides block and resolves hono@4.13.8. Manifest and lock agree.

Impact is narrower than the description implies

The hono advisories are filed here under "Root proxy runtime". That is accurate about which manifest changed and it should not be read as the proxy runtime being attackable.

hono is not a direct dependency. It arrives only through @modelcontextprotocol/sdk@1.30.0, which declares hono: ^4.11.4. This repository imports that SDK in exactly one file, src/adapters/cursor/mcp-manager.ts, and only its client entrypoints: client/index.js, client/stdio.js, and client/streamableHttp.js. Nothing under src/, gui/src/, or scripts/ imports @modelcontextprotocol/sdk/server/* or @hono/node-server.

All three hono advisories require the application to run hono as a server. toSSG() is the static-site generation helper, parseBody() parses an inbound request body, and the query-parser differential concerns inbound request URLs. The proxy serves its own HTTP through Bun.serve. No proxy request path reaches the vulnerable code, so this half of the PR is dependency-graph hygiene that brings bun audit to zero rather than a fix for a reachable proxy vulnerability.

The Critical is in the other half, and it is real. GHSA-26w7-cxv4-gfx2 is remote code execution through Astro's AVIF image optimization, which runs during astro build and astro dev. The exposed parties are contributor machines and the docs deploy runner, and the input is images committed to this repository, so exploitation needs a malicious image landed first. Bounded, and worth fixing.

Lockfile audit

Every added docs-site/bun.lock entry is a registry package with a sha512 integrity hash. No git+, http(s):, file:, workspace:, or link: source appears in any added line. The additions are what an Astro 7.2.2 → 7.3.3 minor bump plus the sharp, svgo, smol-toml, and js-yaml overrides produce: refreshed @astrojs/compiler-binding-* and @img/sharp-* platform binaries plus the transitive dependencies those versions declare.

Two things that look like new supply chain and are not. @astrojs/markdown-satteri and the @bruits/satteri-* binaries are already in dev's lockfile and only change version. find-proc replacing find-process — dropping ansi-styles, chalk, color-convert, color-name, and loglevel — is declared by astro@7.3.3 itself, not introduced here.

No concerns. Sponsoring.

The docs build has no PR gate, and that does not resolve in this PR's favour

Worth separating from the rest. .github/workflows/ci.yml contains no docs-site reference and builds no docs. deploy-docs.yml triggers only on push to main under docs-site/**.

So the Astro minor bump has no pull-request build gate anywhere. A fully green exact-head run on this PR is not evidence that the docs site still builds, and the local "449 pages" result is the only build evidence there is. The residual exposure is a broken docs build surfacing at promotion to main rather than at review, which fails the deploy instead of shipping a broken site. That is a delay rather than an outage, but it should be an explicit acceptance rather than an assumption. Adding a docs-build job is out of scope here.

What CI does cover: package.json and bun.lock are both in the changes job's ci allowlist, so the cross-platform suite is in scope for this head.

Gates

Two, both maintainer-side:

1. unsponsored_surface on hygiene and enforce-target. Cleared by this review and the maintainer-sponsored label.
2. Cross-platform CI, React Doctor, and Service lifecycle are all at action_required for this head under the all_external_contributors approval policy. For a pull_request event select-windows-runner marks the run untrusted and pins GitHub-hosted runners, so approving does not expose a self-hosted runner. It does run the resolved packages' install hooks, which is why the lockfile audit above came first.

Approving the runs now. Merge remains a separate decision.