mirror of https://github.com/vercel/workflow.git synced 2026-09-14 19:59:43 +08:00

Files

T

History

Pranay Prakash d0472511ca fix(deps): upgrade hono to 4.12.25 to resolve CVE-2026-54290 (#2462 )

hono <4.12.25 is vulnerable to CVE-2026-54290 (GHSA-88fw-hqm2-52qc):
the CORS middleware reflects any request Origin with
Access-Control-Allow-Credentials: true when credentials are enabled and
origin is left at the default wildcard, exposing cookie-authenticated
endpoints to arbitrary origins.

- packages/world-testing: hono 4.12.21 -> 4.12.25 (the flagged manifest)
- workbench/hono: ^4.12.8 -> ^4.12.25, clearing the also-vulnerable
  4.12.9 from the lockfile

Neither app uses hono's CORS middleware, so neither was exploitable, but
the bump clears the vulnerable code from the dependency tree. Only the
core Hono class is imported in world-testing; build and typecheck pass.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-16 16:18:30 -07:00

astro

fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457 )

2026-06-16 14:18:36 -07:00

example

test: e2e coverage for run-idempotency conflict-handling strategies (#2387 )

2026-06-12 23:08:43 -07:00

express

chore: bump express and fastify in workbenches (#1499 )

2026-03-23 19:57:08 -07:00

fastify

[nitro] Use nitro v3 functionRules for workflow routes (#1575 )