mirror of
https://github.com/vercel/workflow.git
synced 2026-09-14 19:59:43 +08:00
github-actions[bot]
e3771083e0
hono <4.12.25 is vulnerable to CVE-2026-54290 (GHSA-88fw-hqm2-52qc): the CORS middleware reflects any request Origin with Access-Control-Allow-Credentials: true when credentials are enabled and origin is left at the default wildcard, exposing cookie-authenticated endpoints to arbitrary origins. - packages/world-testing: hono 4.12.21 -> 4.12.25 (the flagged manifest) - workbench/hono: ^4.12.8 -> ^4.12.25, clearing the also-vulnerable 4.12.9 from the lockfile Neither app uses hono's CORS middleware, so neither was exploitable, but the bump clears the vulnerable code from the dependency tree. Only the core Hono class is imported in world-testing; build and typecheck pass. Signed-off-by: Pranay Prakash <pranay.gp@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
692 B
JSON
27 lines
692 B
JSON
{
|
|
"name": "@workflow/example-hono",
|
|
"private": true,
|
|
"type": "module",
|
|
"version": "0.0.0",
|
|
"license": "Apache-2.0",
|
|
"scripts": {
|
|
"generate:workflows": "node ../scripts/generate-workflows-registry.js",
|
|
"predev": "pnpm generate:workflows",
|
|
"prebuild": "pnpm generate:workflows",
|
|
"dev": "nitro dev",
|
|
"build": "nitro build",
|
|
"start": "node .output/server/index.mjs"
|
|
},
|
|
"devDependencies": {
|
|
"@workflow/world-postgres": "workspace:*",
|
|
"workflow": "workspace:*",
|
|
"@workflow/ai": "workspace:*",
|
|
"ai": "catalog:",
|
|
"hono": "^4.12.25",
|
|
"lodash.chunk": "^4.2.0",
|
|
"nitro": "catalog:",
|
|
"openai": "^6.6.0",
|
|
"zod": "catalog:"
|
|
}
|
|
}
|