Anupam Mediratta 3698361510 fix: upgrade hono to 4.12.25 (CVE-2026-54290) (#11023) ...

* fix: CVE-2026-54290 security vulnerability

Automated dependency upgrade by OrbisAI Security

Signed-off-by: orbisai0security <mediratta@gmail.com>
Signed-off-by: Anupam Mediratta <mediratta@gmail.com>

* fix(deps): override hono transitive dep to eliminate CVE-2026-54290

Add package.json `overrides` field to force hono@4.12.25 across the
entire dependency graph, including the transitive copy pulled in by
@modelcontextprotocol/sdk. Previously bun.lock retained a scoped
`@modelcontextprotocol/sdk/hono` entry resolved to the vulnerable
hono@4.12.8; the override removes that entry so only the patched
version ships.

Assisted-by: Claude Code:claude-sonnet-4-6
Signed-off-by: Anupam Mediratta <mediratta@gmail.com>

---------

Signed-off-by: orbisai0security <mediratta@gmail.com>
Signed-off-by: Anupam Mediratta <mediratta@gmail.com>

2026-07-27 19:02:37 +02:00

..

e2e

perf(http): gzip responses, cache hashed assets, bound the trace endpoints (#11056)

2026-07-22 22:51:25 +02:00

public/locales

fix(nodes): never schedule a model onto a node that cannot store it (#11054)

2026-07-23 00:03:21 +02:00

scripts

feat(react-ui): add Indonesian language support (#10266)

2026-06-12 10:08:58 +02:00

src

feat(distributed): cache staged-artifact hashes and publish the model load lifecycle (#11121)

2026-07-25 16:05:44 +02:00

.nycrc.json

test: add Go + React UI coverage gates and fill test gaps (#9989)

2026-05-26 22:06:10 +02:00

bun.lock

fix: upgrade hono to 4.12.25 (CVE-2026-54290) (#11023)

2026-07-27 19:02:37 +02:00

coverage-baseline.txt

test(react-ui): add page render-smoke specs, reset the coverage gate (#10122)

2026-06-01 14:24:36 +02:00

eslint.config.js

feat(ui): move to React for frontend (#8772)

2026-03-05 21:47:12 +01:00

i18next-parser.config.js

feat(react-ui): add Indonesian language support (#10266)

2026-06-12 10:08:58 +02:00

index.html

chore: Security hardening (#9719)

2026-05-08 16:25:45 +02:00

package-lock.json

chore(deps): bump postcss from 8.5.15 to 8.5.23 in /core/http/react-ui in the npm_and_yarn group across 1 directory (#11106)

2026-07-26 23:13:42 +02:00

package.json

fix: upgrade hono to 4.12.25 (CVE-2026-54290) (#11023)

2026-07-27 19:02:37 +02:00

playwright.config.js

fix(router): production-ready request router + auto-size batch for embedding/rerank (#10104)

2026-06-12 16:21:15 +02:00

vite.config.js

fix(webui): use relative asset base so fonts and lazy chunks honor X-Forwarded-Prefix (#10889) (#10904)

2026-07-18 08:38:26 +02:00