Skip to content

Fix Dependabot security update failure for @hono/node-server - #1885

Merged
stephenegriffin merged 4 commits into
mainfrom
copilot/fix-dependabot-job-failure
Jul 24, 2026
Merged

Fix Dependabot security update failure for @hono/node-server#1885
stephenegriffin merged 4 commits into
mainfrom
copilot/fix-dependabot-job-failure

Conversation

Copilot AI commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Dependabot was failing with security_update_not_possible for @hono/node-server (CVE GHSA-frvp-7c67-39w9, path traversal on Windows). The fix requires >=2.0.5, but @modelcontextprotocol/sdk@1.29.0 — pulled in as a peer dep via office-addin-dev-settings@microsoft/m365agentstoolkit-cli@microsoft/teamsfx-core — constrains @hono/node-server to ^1.19.9, making the update unresolvable.

Changes

  • Added @hono/node-server to the existing npm overrides in package.json, forcing ^2.0.11 across the dependency tree regardless of the conflicting transitive constraint
"overrides": {
  "tmp": "^0.2.5",
  "@hono/node-server": "^2.0.11"
}
  • Updated package-lock.json@hono/node-server now resolves to 2.0.11

Add npm override for @hono/node-server to ^2.0.11 to fix CVE
GHSA-frvp-7c67-39w9 (path traversal in serve-static on Windows).

The vulnerability required updating to >=2.0.5 but
@modelcontextprotocol/sdk@1.29.0 (via office-addin-dev-settings peer
dep chain) required ^1.x, creating an unresolvable conflict for
Dependabot. The override forces the patched version regardless.
Copilot AI changed the title [WIP] Fix failing GitHub Actions job Dependabot Fix Dependabot security update failure for @hono/node-server Jul 24, 2026
Copilot AI requested a review from stephenegriffin July 24, 2026 15:12
@stephenegriffin

Copy link
Copy Markdown
Member

@copilot resolve the merge conflicts in this pull request

Copilot AI commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in d8515cc. The overrides section now includes all four entries: tmp, @babel/core, js-yaml (from main), and @hono/node-server (from this PR).

@stephenegriffin
stephenegriffin marked this pull request as ready for review July 24, 2026 18:38
@stephenegriffin
stephenegriffin enabled auto-merge (squash) July 24, 2026 18:38
@stephenegriffin
stephenegriffin merged commit d410750 into main Jul 24, 2026
7 checks passed
@stephenegriffin
stephenegriffin deleted the copilot/fix-dependabot-job-failure branch July 24, 2026 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants