[Snyk] Security upgrade hono from 4.11.4 to 4.11.7#60
Conversation
…ilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-HONO-15123484 - https://snyk.io/vuln/SNYK-JS-HONO-15123483 - https://snyk.io/vuln/SNYK-JS-HONO-15123868 - https://snyk.io/vuln/SNYK-JS-HONO-15123927
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
✅ Deploy Preview for express-mcp-server canceled.
|
✅ Deploy Preview for mcp-example-oauth canceled.
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
remote-mcp-server-bearer-auth | 6d3e565 | Jan 31 2026, 09:48 AM |
There was a problem hiding this comment.
Pull request overview
This PR upgrades the hono dependency from version 4.11.4 to 4.11.7 in the brave-search-mcp-server example to address 4 medium-severity security vulnerabilities: cache containing sensitive information, incorrect regular expression, incorrect authorization, and cross-site scripting (XSS).
Changes:
- Bumped hono version from ^4.11.4 to ^4.11.7 in package.json to patch security vulnerabilities
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@modelcontextprotocol/sdk": "^1.7.0", | ||
| "agents": "^0.0.43", | ||
| "hono": "^4.11.4", | ||
| "hono": "^4.11.7", |
There was a problem hiding this comment.
The package.json dependency version has been updated to 4.11.7, but the corresponding pnpm-lock.yaml file still references hono@4.11.4 (lines 873 and 2048). This means the actual installed version will remain at 4.11.4, leaving the security vulnerabilities unfixed. The lock file must be regenerated by running pnpm install before this PR can be merged to ensure the security fixes are actually applied.
| "hono": "^4.11.7", | |
| "hono": "^4.11.4", |
2 participants
Snyk has created this PR to fix 4 vulnerabilities in the pnpm dependencies of this project.
Snyk changed the following file(s):
examples/brave-search-mcp-server/package.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-HONO-15123484
SNYK-JS-HONO-15123483
SNYK-JS-HONO-15123868
SNYK-JS-HONO-15123927
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Incorrect Regular Expression
🦉 Incorrect Authorization
🦉 Cross-site Scripting (XSS)