mirror of
https://github.com/vercel/workflow.git
synced 2026-09-14 19:59:43 +08:00
Pranay Prakash
d0472511ca
hono <4.12.25 is vulnerable to CVE-2026-54290 (GHSA-88fw-hqm2-52qc): the CORS middleware reflects any request Origin with Access-Control-Allow-Credentials: true when credentials are enabled and origin is left at the default wildcard, exposing cookie-authenticated endpoints to arbitrary origins. - packages/world-testing: hono 4.12.21 -> 4.12.25 (the flagged manifest) - workbench/hono: ^4.12.8 -> ^4.12.25, clearing the also-vulnerable 4.12.9 from the lockfile Neither app uses hono's CORS middleware, so neither was exploitable, but the bump clears the vulnerable code from the dependency tree. Only the core Hono class is imported in world-testing; build and typecheck pass. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Workflows with Hono (Nitro v3)
- Learn more about Hono: https://hono.dev
- Learn more about Nitro: https://v3.nitro.build/
Commands
Local development:
npm run dev
Production build (Vercel):
NITRO_PRESET=vercel npm run build
npx vercel --prebuilt
Production build (Node.js):
npm run build
node .output/server/index.mjs