supabase / supabase / 41618267511

87%

push

github

chore(deps): bump @hono/node-server to 2.1.5 (#52687)

## Problem

`pnpm audit` reports a moderate advisory for `@hono/node-server`
(patched in `>=2.1.3`). The lockfile resolves it to `1.19.17`, a
transitive dependency of `@modelcontextprotocol/sdk` and
`@modelcontextprotocol/node` (used by Studio).

## Solution

Ran `pnpm tsx scripts/fix-audit-vulnerability.ts @hono/node-server
--json`, which resolved the advisory without a permanent override.
Lockfile only:

- `@hono/node-server` `1.19.17` -> `2.1.5`. Both parents already declare
ranges that allow 2.x (`^1.19.9 || ^2.0.5` and `^1.19.9 || ^2.1.3`).
- pnpm also re-pointed two `@aws-sdk` entries from `@smithy/core`
`3.23.17` to `3.31.1`, a version already in the lockfile.

## Review instructions

1. `pnpm install --frozen-lockfile` succeeds.
2. `pnpm audit` no longer reports `@hono/node-server`.

Checked locally: frozen install, `pnpm audit`, `pnpm turbo run typecheck
--filter='...[origin/master]'` (studio, library, vue-blocks), `pnpm
turbo run lint --filter='[origin/master]'`, and Prettier on
`pnpm-lock.yaml` all pass. No source files changed, so no unit tests
apply.

## Checklist

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
- [ ] If I wrote a new docs topic or edited an existing topic, I used
the `/write-the-docs` or `/edit-the-docs` skill, which applies the docs
[style
guide](https://github.com/supabase/supabase/tree/master/apps/docs/style-guide)


[FE-4845](https://linear.app/supabase/issue/FE-4845/bump-a-single-vulnerable-dependency)

Co-authored-by: supabase-vercel-tedd[bot] <336548405+supabase-vercel-tedd[bot]@users.noreply.github.com>

1986 of 2356 branches covered (84.3%)

Branch coverage included in aggregate %.

2794 of 3152 relevant lines covered (88.64%)

195.9 hits per line