stacklok / toolhive-cloud-ui / 24260411837

79%

push

github

chore: fix security vulnerabilities in dependencies (#488)

* chore: fix security vulnerabilities in dependencies

- Bump next 16.2.1 -> 16.2.3 (DoS via Server Components, GHSA-q4gf-8mx6-v5v3)
- Bump better-auth 1.5.6 -> 1.6.2 (prototype pollution in defu, removes vitest prod dep)
- Bump vite ^8.0.0 -> ^8.0.5 (fs.deny bypass, arbitrary file read, path traversal)
- Override hono >=4.12.12 (cookie validation, IP matching, path traversal, middleware bypass)
- Override @hono/node-server >=1.19.13 (middleware bypass via repeated slashes)
- Override defu >=6.1.5 (prototype pollution via __proto__ key)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update pnpm-lock.yaml for security fixes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: use caret ranges for security overrides

Constrain hono, @hono/node-server, and defu overrides to their
current major version to prevent unexpected major bumps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

244 of 323 branches covered (75.54%)

470 of 598 relevant lines covered (78.6%)

13.4 hits per line