jcoffey-dev
3e8b1ebb38
Three medium advisories land on hono before 4.13.5: a toSSG() path escape, a query parser that reads parameters past the URL fragment, and unbounded dot-notation nesting in parseBody(). Only the second one touches this server -- c.req.query() is read in imageproxy, icsproxy and app -- and even there safeFetch validates the value it actually fetches rather than a separate pre-check, so there was nothing to desync. toSSG and parseBody are never called. The bump is still worth taking on its own: it is a patch release with no API change. The declared range moves with it, from ^4.7.4 to ^4.13.7, so the security floor is recorded in server/package.json and not only in the lockfile. The dependabot.yml is the actual fix for how these were found. There was no config, so nothing opened a PR and the alerts sat on a dashboard until someone thought to look. Routine updates now group into one PR a week; majors stay separate, because they are migrations.
45 lines
1.4 KiB
YAML
45 lines
1.4 KiB
YAML
version: 2
|
|
updates:
|
|
# The npm entry sits at the root because that is where the single lockfile
|
|
# is: root, server and web are one npm workspace, so one entry covers all
|
|
# three. Pointing entries at server/ or web/ would find package.json files
|
|
# with no lockfile beside them and update nothing.
|
|
- package-ecosystem: npm
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
# Everything routine arrives as one PR a week, so the dashboard is not
|
|
# the only place these get noticed. Majors are deliberately left out of
|
|
# the group: they are migrations, not bumps -- vitest 3 to 4 is one --
|
|
# and each deserves its own PR and its own CI run.
|
|
minor-and-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
groups:
|
|
actions:
|
|
patterns:
|
|
- "*"
|
|
# The runtime and build stages both pin node:22-alpine, so this is what
|
|
# keeps the published container images off a stale base between the weekly
|
|
# releases.
|
|
- package-ecosystem: docker
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|