Drop redundant @hono/node-server override, document SSE keep-alive - #67
Merged
Conversation
MCP SDK 1.30.0 widened its own @hono/node-server range to ^1.19.9 || ^2.0.5, so the override no longer changes resolution (package-lock.json is byte-identical without it). Assisted-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>
Each of these overrides pinned to a version that has since become the vulnerable ceiling of an advisory: - fast-uri ^3.1.4 -> ^3.1.5 (GHSA-7p8r-x3mc-p8w7, affects 3.0.0-3.1.4). Kept on 3.x: ajv requires ^3.0.1, so a 4.x override would be out of range. - hono ^4.12.27 -> ^4.12.34 (four advisories affecting <=4.12.33). - brace-expansion ^5.0.8 -> ^5.0.9 (GHSA-rgw5-rvv9-x895, affects 4.0.0-5.0.8). npm audit is now clean. fmt:check, lint and build pass. Assisted-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>
main #66 fixed the same three advisories independently. Conflict was on the hono override only: kept ^4.12.34 over main's ^4.12.27 so the pin encodes the advisory floor (<=4.12.33 is vulnerable) rather than relying on resolution alone. Lockfile regenerated; npm audit clean. Assisted-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MCP SDK 1.30.0 widened its own
@hono/node-serverrange to^1.19.9 || ^2.0.5, which is what our override was working around. Regenerating the lockfile without the override produces a byte-identicalpackage-lock.json(still resolves 2.0.12), so removing it changes nothing today and stops us silently pinning the dependency if upstream moves again.The same SDK release turned on SSE keep-alive comment frames (15s) and started setting
X-Accel-Buffering: no/Cache-Control: no-transformon SSE responses. We get both for free, but only becausehttp-bridge.tsis byte- and header-transparent, so I documented them in CLAUDE.md as constraints on that file rather than as trivia:readableStreamToBufferGeneratormay only drop zero-length chunks, andfromWebResponsemust keep copying the full header set. This matters most for the long-idle streams —create_backupon a large database, and therestore_backupelicitation round-trip that idles until a human answers.Also noted that request Content-Type is now validated by parsed media type instead of substring match.
The second commit clears
npm audit. Three of our overrides had drifted into pinning the vulnerable ceiling of an advisory rather than protecting against it:fast-uri^3.1.4 -> ^3.1.5 (GHSA-7p8r-x3mc-p8w7 covers 3.0.0-3.1.4),hono^4.12.27 -> ^4.12.34 (four advisories cover <=4.12.33), andbrace-expansion^5.0.8 -> ^5.0.9 (GHSA-rgw5-rvv9-x895 covers 4.0.0-5.0.8).fast-uristays on 3.x deliberately — ajv requires ^3.0.1, so a 4.x override would be out of range. Audit is now clean, and fmt:check, lint and build all pass against the reinstalled tree.