fix(deps): patch Hono and ip-address advisories and align qs by lidge-jun · Pull Request #7647 · lidge-jun/opencodex

lidge-jun · 2026-10-24T01:56:47Z

Summary

Raise the root overrides to hono: 4.13.13, ip-address: ^10.7.4, and qs: ^6.16.1; refresh only those three lockfile resolutions.
Preserve SDK 1.32.1, every other override/resolution, lifecycle trust and the existing audit threshold. No shared registration or source files change.

Closes #7641
Closes #7640
Closes #7639

Security summary

Hono 4.13.8 falls within GHSA-5r4p-p66f-jhc7, patched at 4.13.11. Selected 4.13.13 as the newest stable 4.13.x in the npm registry; reviewed 4.13.11, 4.13.12, and 4.13.13 release notes. SDK 1.32.1 requests Hono ^4.11.4, and node-server peers on ^4, so the pin stays within both contracts (SDK registry metadata).
ip-address 10.7.1 is affected by GHSA-rxp7-6hxx-x8q5; 10.7.4 is the first patched version and satisfies express-rate-limit's ^10.2.0 range.
qs 6.16.0 violates body-parser 2.4.0's ^6.16.1 requirement; move the floor and resolution to 6.16.1. This is a dependency-range correction; the two named GHSAs apply to Hono and ip-address. Primary metadata checked 2026-10-24.
Decision: keep pre-existing fast-uri low/moderate audit findings outside this three-package unit and disclose them. Do not claim a clean plain audit. No secrets, credential logic, auth policy, install scripts or trustedDependencies change.

Verification

Pre-fix scratch regression: 1 pass / 4 fail, exit 1 (old override floors and qs/body-parser mismatch); post-fix regression and HTTP smoke: 9 pass / 0 fail, exit 0. Scratch fixtures stay untracked to honor the two-file lane scope. These demonstrate resolution-policy red/green and runtime compatibility, not exploit-level red/green.
bun install --lockfile-only: exit 0; parsed lock comparison confirms exactly hono, ip-address, and qs changed. No broad update.
bun install --frozen-lockfile in a fresh archive of this commit with no node_modules: exit 0, 108 packages installed; package.json and bun.lock hashes unchanged.
bun test ./tests/providers/qoder-mcp-server.test.ts ./tests/providers/codebuddy-mcp-server.test.ts ./tests/providers/cursor/cursor-mcp-manager.test.ts ./tests/providers/cursor/cursor-mcp-stdio.test.ts ./tests/server/server-live.test.ts: exit 0, 83 pass / 0 fail.
Scratch HTTP smoke uses a real SDK client over Hono HTTP to initialize/list/call; checks unacceptable protocol headers, SDK Host rejection, extended nested form parsing, depth 400/parameter 413 rejection, and the default SDK rate-limit key generator with IPv6 addresses in the same subnet (200 then 429).
bun run typecheck: exit 0.
bun audit --json: exit 1; Hono/ip-address/qs have no findings, and the four pre-existing fast-uri findings (two moderate, two low) are byte-for-byte unchanged from the baseline. This is an audit limitation, not a passing plain audit.
Primary GitHub advisory ranges were also checked against the selected versions: none of 56 Hono, 10 ip-address, or 10 qs advisory records affect the selected versions.
Final integration head: 9d11593878320c2bcf9deef756d06fbbf4ed5402, after merging current dev at ceef4889e4666dc0492a375d272eafa5b785361e. PR diff remains exactly the two dependency files. bun run typecheck, bun run privacy:scan, and bun run structure:check all passed again on this head.
bun run test:changed on the exact final head, through the cxc receipt runner with the documented private trusted-fixture setting: exit 0, 29,787 pass / 46 skip / 0 fail, 1,319 files, successful current-head test receipt. The pre-merge changed run also passed with the same counts. Root and GUI bun run audit:high: exit 0 (root 144 packages, four below threshold; GUI 82 packages).
bun run test on the final head (through the cxc receipt runner): exit 1, aggregate 52,117 pass / 167 skip / 20 fail across the main and serial batches. Nineteen failures are trusted-Bun fixture placement (bun-runtime, ocx-launcher-fixture-trust, ocx-launcher-runtime); the other is Desktop catalog ordering at tests/claude-integration/claude-desktop-remote-hub.test.ts:249. No successful receipt was produced.
Baseline comparison: fresh archive of unmodified dev at ceef4889, old dependency resolutions, frozen install, then the same four failing files: exit 1, 84 pass / 2 skip / 20 fail, with the same twenty failure names. These failures predate this patch. The documented OPENCODEX_TEST_TRUSTED_FIXTURE_DIR setting can select a private trusted scratch directory without relaxing the product trust rule; the four-file diagnostic with that setting exits 1 with 103 pass / 2 skip / 1 fail, leaving only the Desktop ordering failure. This is not substituted for the failed full run.
Fresh independent gpt-6.1-sol / high security review of the exact final head: PASS, zero actionable tracked-diff/integration findings. It independently checked the merge, advisory floors, npm integrities and unchanged dependency contracts. Maintainers retain the merge/security decision.
Final-head cross-platform dispatch 40052385616, attempt 1, workflow_dispatch with lane=all: confirmed headSha=9d11593878320c2bcf9deef756d06fbbf4ed5402; currently queued, no conclusion. PR workflow 40052389994 is also pending on this head. Older-head CI is not passing evidence for this head.
Decision: keep this PR draft while the inherited full-suite failures and required CI evidence remain unresolved. Preserve the two-file scope; do not alter unrelated fixtures/catalog behavior or weaken checks.
NOT RUN: a second full-suite attempt after the diagnostic fixture setting. Final-head test:changed completed successfully with the supported fixture setting. No merge performed.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed (dependency-only correction; no user-facing workflow changes).
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

coderabbitai · 2026-10-24T01:56:56Z

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-24T02:15:45Z

✅ Deterministic PR hygiene checks passed.

lidge-jun · 2026-10-24T10:30:02Z

Local CI-equivalent (Linux) at `69f189e`

Overall: PASS (temporary rule; raw base-identical test failures retained) under the temporary local-verification rule. This is local Linux evidence, not hosted CI.

Host: lidge-AI-AI; Ubuntu 24.04.4 LTS; x86_64; kernel 7.0.0-30-generic.
Bun test runner/gates: 1.4.3 (scratch-installed official binary, first on PATH); runtime pin: 1.4.4 (used for structure/docs roles).
Exact detached head: 69f189e4575ceb7e55d6e8a845a90440d6891418; expected brief: 69f189e4575ceb7e55d6e8a845a90440d6891418; moved: False.
Base comparison: 47316142fe06171a94de02d63f1727dbed4c0382; git merge-base origin/dev HEAD: 47316142fe06171a94de02d63f1727dbed4c0382.
Workflow authority: origin/dev at 8066099651f8ed356bb73a67d9c99978ea65447c, .github/workflows/ci.yml and .github/actions/setup-project-bun/action.yml.
Tests ran outside hooks, explicitly without GIT_DIR, GIT_INDEX_FILE, or GIT_WORK_TREE. CI=true; no shard/batch/parallel/timeout overrides. Original check failures were retained; no head-check retries.
Scratch artifacts: /home/lidgeai/ocx-linux-ci.p2R3NT. Each command has its original recorded output and exit code.

Command (repository root unless noted)	Bun	Exit	Pass / fail / skip
`bun install --frozen-lockfile`	1.4.3	0	N/A
`cd gui && bun install --frozen-lockfile`	1.4.3	0	N/A
`cd gui && bun run build`	1.4.3	0	N/A
`bash scripts/ci/run-bun-test-batches.sh 1/4`	1.4.3	0	13577 / 0 / 35
`bash scripts/ci/run-bun-test-batches.sh 2/4`	1.4.3	0	12304 / 0 / 50
`bash scripts/ci/run-bun-test-batches.sh 3/4`	1.4.3	1	2566 / 0 / 3
`bash scripts/ci/run-bun-test-batches.sh 4/4`	1.4.3	1	1887 / 1 / 0
`cd gui && bun run lint`	1.4.3	0	N/A
`bun x tsc --noEmit`	1.4.3	0	N/A
`bun x tsc --noEmit -p tests/tsconfig.doctor-service-memory-contract.json`	1.4.3	0	N/A
`bun x tsc --ignoreConfig --noEmit --strict --target ESNext --module ESNext --moduleResolution bundler --types bun-types --skipLibCheck scripts/ci/docker-smoke.ts`	1.4.3	0	N/A
`cd gui && bun test --isolate tests`	1.4.3	0	3493 / 0 / 0
`bun run privacy:scan`	1.4.3	0	N/A
`bun run skill:surface:check`	1.4.3	0	N/A
`bun build scripts/release.ts --target=bun --outdir=/home/lidgeai/ocx-linux-ci.p2R3NT/evidence-7647/release-build`	1.4.3	0	N/A
`bun run src/cli/index.ts help`	1.4.3	0	N/A
`bun run structure:check`	1.4.4	0	N/A
`bun test --isolate ./tests/storage/api-storage-policy-already-running.test.ts ./tests/storage/api-storage-policy-mutation-busy.test.ts ./tests/storage/api-storage-policy-put-race.test.ts ./tests/storage/api-storage-policy-run.test.ts ./tests/storage/api-storage-policy.test.ts ./tests/storage/api-storage.test.ts`	1.4.3	0	9 / 0 / 0
`bun test --isolate ./tests/server/api-usage.test.ts`	1.4.3	0	34 / 0 / 0

Failure classification (failed commands remain failed):

BASE-IDENTICAL — test-3-of-4 shard 3/4 batch 14/64 (12 files): process exit 1 with batch counts {'pass': 336, 'fail': 0, 'skip': 0}. Exact 12-file base batch exit 1, counts {'pass': 336, 'fail': 0, 'skip': 0, 'todo': 0}. Root cause unattributed; failed process status retained.
BASE-IDENTICAL — tests/claude-integration/claude-desktop-remote-hub.test.ts:249 — connected Desktop uses hub IDs across a cold restart (stored profile=false). Base exit 1, 1/1/0 pass/fail/skip; same failing label reproduced.

Base comparisons (same Bun/environment; once per distinct failing file, reused where recorded):

bun test --isolate --timeout 60000 tests/cli/cli-link-enrollment.test.ts tests/cli/cli-link-force.test.ts tests/cli/cli-logs-request-id.test.ts tests/cli/cli-models-display-name.test.ts tests/cli/cli-models-local-result.test.ts tests/cli/cli-models-order.test.ts tests/cli/cli-models-prompt-length-pricing.test.ts tests/cli/cli-models-reasoning.test.ts tests/cli/cli-native-profile.test.ts tests/cli/cli-observe-snapshot.test.ts tests/cli/cli-provider-sync-result.test.ts tests/cli/cli-resolve.test.ts (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe, Bun 1.4.3): exit 1; 336 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/batch-a122bb89d34e55.log; cached once per distinct file/batch.
bun test --isolate --timeout 60000 ./tests/claude-integration/claude-desktop-remote-hub.test.ts (cwd /tmp/ocx-linux-ci.MlWNCd/base-47316142fe, Bun 1.4.3): exit 1; 1 pass / 1 fail / 0 skip. Log /tmp/ocx-linux-ci.MlWNCd/base-evidence/tests__claude-integration__claude-desktop-remote-hub.test.ts.log; cached once per distinct file/batch.
bun install --frozen-lockfile (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe, Bun 1.4.3): exit 0; 0 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/install-root.log; cached once per distinct file/batch.
bun install --frozen-lockfile (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe/gui, Bun 1.4.3): exit 0; 0 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/install-gui.log; cached once per distinct file/batch.
bun run build (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe/gui, Bun 1.4.3): exit 0; 0 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/build-gui.log; cached once per distinct file/batch.

NOT RUN: test-3-of-4 batches 15–64 (original script fail-fast); test-4-of-4 batches 11–66 (original script fail-fast); Hosted CI and platforms/jobs outside the requested Linux scope

All original check statuses are retained. No head checks were retried. Overall disposition uses the explicit base-identical exception; this does not claim the fail-fast shard remainders passed. Diagnostic attribution counts (separate from primary evidence where applicable): {'pass': 0, 'fail': 0, 'skip': 0}.

Head re-fetched before posting: 69f189e4575ceb7e55d6e8a845a90440d6891418. Source status: clean (git status --short empty); HEAD unchanged.

Recorded UTC: 2026-10-24T10:30:01.231257+00:00

lidge-jun · 2026-10-24T11:32:22Z

Local CI-equivalent (Linux) coverage addendum at `69f189e`

Final verdict: PASS (temporary rule; raw base-identical test failures retained). This supersedes the earlier verdict’s incomplete coverage: #7647 (comment)

Host lidge-AI-AI, Ubuntu 24.04.4 LTS x86_64, kernel 7.0.0-30-generic. Bun runner/gates 1.4.3; runtime pin 1.4.4. Detached exact head 69f189e4575ceb7e55d6e8a845a90440d6891418; brief head 69f189e4575ceb7e55d6e8a845a90440d6891418; moved from brief False. Base 47316142fe06171a94de02d63f1727dbed4c0382; observed merge-base with origin/dev 47316142fe06171a94de02d63f1727dbed4c0382.

All new suite/base invocations use documented OPENCODEX_TEST_TRUSTED_FIXTURE_DIR=/home/lidgeai/ocx-linux-ci.p2R3NT/trusted-fixtures (new private directory, mode 0700 under trusted ownership). Original results remain unchanged; no completed head batch was retried. GIT_DIR, GIT_INDEX_FILE, and GIT_WORK_TREE are explicitly absent. CI=true; shard scope general, batch size at most 12, no parallel override, per-test timeout 60000 ms, batch process deadline 120 s, TERM/KILL grace 15 s.

Batch file lists are generated by the exact head’s original planner. Only its script-directory anchors point back to the original location; its test command/deadlines are unchanged. Every previously executed batch file list was checked against the reconstructed manifest. Remaining batches ran serially; any new failure stayed failed and did not suppress later missing batches.

Shard	Original batches executed	Remaining batches executed	Required total	Coverage
1/4	63	0	63	COMPLETE
2/4	58	0	58	COMPLETE
3/4	14	50	64	COMPLETE
4/4	10	56	66	COMPLETE

Remaining primary batches — each command is timeout --signal=TERM --kill-after=15s 120s bun test --isolate --timeout 60000 <exact manifest files>:

Shard / batch	Pass	Skip
3/4, 15/64	302	0
3/4, 16/64	183	30
3/4, 17/64	163	2
3/4, 18/64	127	2
3/4, 19/64	133	0
3/4, 20/64	151	1
3/4, 21/64	302	1
3/4, 22/64	384	0
3/4, 23/64	436	0
3/4, 24/64	81	0
3/4, 25/64	81	23
3/4, 26/64	278	1
3/4, 27/64	356	0
3/4, 28/64	300	1
3/4, 29/64	190	0
3/4, 30/64	188	1
3/4, 31/64	135	0
3/4, 32/64	158	0
3/4, 33/64	186	0
3/4, 34/64	188	0
3/4, 35/64	186	0
3/4, 36/64	49	0
3/4, 37/64	18	0
3/4, 38/64	170	0
3/4, 39/64	202	0
3/4, 40/64	157	0
3/4, 41/64	226	0
3/4, 42/64	292	0
3/4, 43/64	104	0
3/4, 44/64	311	0
3/4, 45/64	324	0
3/4, 46/64	497	0
3/4, 47/64	245	0
3/4, 48/64	266	0
3/4, 49/64	522	1
3/4, 50/64	193	0
3/4, 51/64	328	2
3/4, 52/64	236	0
3/4, 53/64	118	0
3/4, 54/64	275	0
3/4, 55/64	158	0
3/4, 56/64	7	0
3/4, 57/64	55	0
3/4, 58/64	130	0
3/4, 59/64	102	0
3/4, 60/64	46	0
3/4, 61/64	217	0
3/4, 62/64	339	0
3/4, 63/64	200	0
3/4, 64/64	209	1
4/4, 11/66	275	0
4/4, 12/66	344	0
4/4, 13/66	291	0
4/4, 14/66	484	0
4/4, 15/66	347	0
4/4, 16/66	177	0
4/4, 17/66	237	2
4/4, 18/66	223	0
4/4, 19/66	231	1
4/4, 20/66	216	0
4/4, 21/66	321	1
4/4, 22/66	180	2
4/4, 23/66	299	1
4/4, 24/66	213	0
4/4, 25/66	39	0
4/4, 26/66	17	0
4/4, 27/66	299	0
4/4, 28/66	221	1
4/4, 29/66	149	0
4/4, 30/66	113	0
4/4, 31/66	152	0
4/4, 32/66	251	0
4/4, 33/66	155	0
4/4, 34/66	141	0
4/4, 35/66	281	0
4/4, 36/66	300	0
4/4, 37/66	403	0
4/4, 38/66	214	0
4/4, 39/66	209	0
4/4, 40/66	160	0
4/4, 41/66	275	0
4/4, 42/66	187	0
4/4, 43/66	138	0
4/4, 44/66	330	0
4/4, 45/66	246	0
4/4, 46/66	172	0
4/4, 47/66	83	0
4/4, 48/66	506	1
4/4, 49/66	301	0
4/4, 50/66	10	0
4/4, 51/66	26	0
4/4, 52/66	175	0
4/4, 53/66	157	0
4/4, 54/66	294	0
4/4, 55/66	218	1
4/4, 56/66	332	1
4/4, 57/66	337	0
4/4, 58/66	10	0
4/4, 59/66	8	0
4/4, 60/66	166	0
4/4, 61/66	4	0
4/4, 62/66	86	0
4/4, 63/66	26	0
4/4, 64/66	142	2
4/4, 65/66	79	0
4/4, 66/66	9	0

Remainder totals: 21763 pass / 0 fail / 79 skip. Combined original + remainder command counts: 55633 pass / 1 fail / 167 skip. Failed checks remain failed; final disposition uses only the explicit BASE-IDENTICAL exception.

Failure classification across original and remainder evidence:

BASE-IDENTICAL — test-3-of-4 shard 3/4 batch 14/64 (12 files): process exit 1 with batch counts {'pass': 336, 'fail': 0, 'skip': 0}. Exact 12-file base batch exit 1, counts {'pass': 336, 'fail': 0, 'skip': 0, 'todo': 0}. Root cause unattributed; failed process status retained.
BASE-IDENTICAL — tests/claude-integration/claude-desktop-remote-hub.test.ts:249 — connected Desktop uses hub IDs across a cold restart (stored profile=false). Base exit 1, 1/1/0 pass/fail/skip; same failing label reproduced.

Base comparisons (cached once per distinct file/exact failed batch):

bun test --isolate --timeout 60000 tests/cli/cli-link-enrollment.test.ts tests/cli/cli-link-force.test.ts tests/cli/cli-logs-request-id.test.ts tests/cli/cli-models-display-name.test.ts tests/cli/cli-models-local-result.test.ts tests/cli/cli-models-order.test.ts tests/cli/cli-models-prompt-length-pricing.test.ts tests/cli/cli-models-reasoning.test.ts tests/cli/cli-native-profile.test.ts tests/cli/cli-observe-snapshot.test.ts tests/cli/cli-provider-sync-result.test.ts tests/cli/cli-resolve.test.ts (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe, Bun 1.4.3): exit 1; 336 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/batch-a122bb89d34e55.log; cached once per distinct file/batch.
bun test --isolate --timeout 60000 ./tests/claude-integration/claude-desktop-remote-hub.test.ts (cwd /tmp/ocx-linux-ci.MlWNCd/base-47316142fe, Bun 1.4.3): exit 1; 1 pass / 1 fail / 0 skip. Log /tmp/ocx-linux-ci.MlWNCd/base-evidence/tests__claude-integration__claude-desktop-remote-hub.test.ts.log; cached once per distinct file/batch.
bun install --frozen-lockfile (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe, Bun 1.4.3): exit 0; 0 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/install-root.log; cached once per distinct file/batch.
bun install --frozen-lockfile (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe/gui, Bun 1.4.3): exit 0; 0 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/install-gui.log; cached once per distinct file/batch.
bun run build (cwd /home/lidgeai/ocx-linux-ci.p2R3NT/base-47316142fe/gui, Bun 1.4.3): exit 0; 0 pass / 0 fail / 0 skip. Log /home/lidgeai/ocx-linux-ci.p2R3NT/base-evidence/build-gui.log; cached once per distinct file/batch.

Every original non-test gate result is retained in #7647 (comment). No source edits, pushes, approvals or merges were performed. Source status: clean (git status --short empty); HEAD unchanged. Final fetched head 69f189e4575ceb7e55d6e8a845a90440d6891418.

NOT RUN: Hosted CI and platforms/jobs outside the requested Linux scope

Exact manifests and raw logs (retained on the named Linux host):

Shard 3: /home/lidgeai/ocx-linux-ci.p2R3NT/evidence-7647/remainder-3-manifest.tsv, SHA-256 67a06d3eaf96faede124c4129dde93eaa4abef726f1e50bc7c92bf0b5237f811; planner validation True.
Shard 4: /home/lidgeai/ocx-linux-ci.p2R3NT/evidence-7647/remainder-4-manifest.tsv, SHA-256 eef290af4ed4e4c2b68ec95d4d3e49ba19aa1f3d59d9421503863221e37fb1a1; planner validation True.
Per-batch argv/exits/counts: /home/lidgeai/ocx-linux-ci.p2R3NT/evidence-7647/remainder-results.json; all original commands: /home/lidgeai/ocx-linux-ci.p2R3NT/evidence-7647/results.json; final evidence: /home/lidgeai/ocx-linux-ci.p2R3NT/evidence-7647/coverage-analysis.json.

UTC: 2026-10-24T11:32:01.161432+00:00

lidge-jun · 2026-10-24T12:47:44Z

Integration evidence for exact head 69f189e (lane L6; dependency change, Security summary in the description):

Independent review: fresh gpt-6.1-sol security + integration review PASS, 0 actionable findings.
Lane verification: only hono 4.13.13 (exact), ip-address ^10.7.4 and qs ^6.16.1 resolutions changed; clean-archive frozen install exit 0; policy regressions red (1/4 failing) before and green after; real MCP SDK HTTP initialize/list/call, IPv6 rate-limit subnet and qs depth/parameter limits verified; MCP/server suites 83/0; test:changed 29787/0; audit:high exit 0; bun audit shows none of the three advisories.
Local CI-equivalent: Linux (lidge-ts) 251/251 primary batches, 55633 pass / 1 base-identical fail / 167 skip, all gates exit 0. macOS and Windows legs were not run (owner stopped the suites); package.json/bun.lock are marked Windows-sensitive by ci.yml, so the Windows leg is NOT RUN and will be covered by dev push CI.
Merged tree (this Mac): frozen install exit 0; bun run audit:high: no vulnerabilities.
Closes [Bug]: qs override keeps 6.16.0 under body-parser 2.4.0's ^6.16.1 #7641, [Bug]: ip-address 10.7.1 is inside GHSA-rxp7-6hxx-x8q5 (moderate) #7640, [Bug]: hono 4.13.8 override is inside GHSA-5r4p-p66f-jhc7 (moderate) #7639.

Static merge simulation on current dev 047c5dc (this Mac): dev=047c5dc60695351657e1f6ea7b85e12015cb67e4 base=47316142fe06171a94de02d63f1727dbed4c0382 pr_files= 2 overlap=[]; merge clean; install exit=0; gui install exit=0; tsc exit=0; tsc doctor exit=0; structure:check exit=0; privacy:scan exit=0; layout+ratchet guards exit=0 52 pass 0 fail ;

Merged by the triage manager as maintainer integration (MAINTAINERS.md, dev only) under the owner's static-judgment rule while GitHub Actions is degraded; dev push CI will be checked when Actions recovers.

chatgpt-codex-connector · 2026-10-24T12:48:00Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-24T12:47:55.118751Z	`69f189e`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

fix(deps): patch Hono and ip-address advisories and align qs

dd157a6

Merge remote-tracking branch 'origin/dev' into lane/l6-deps-advisories

9d11593

github-actions Bot added the bug Something isn't working label Oct 24, 2026

lidge-jun added 2 commits October 24, 2026 14:32

Merge branch 'dev' into lane/l6-deps-advisories

db30643

Merge branch 'dev' into lane/l6-deps-advisories

69f189e

lidge-jun marked this pull request as ready for review October 24, 2026 12:47

lidge-jun requested a review from Ingwannu as a code owner October 24, 2026 12:47

lidge-jun merged commit 4e2940e into dev Oct 24, 2026
53 of 65 checks passed

lidge-jun deleted the lane/l6-deps-advisories branch October 24, 2026 12:47

This was referenced Oct 24, 2026

[Bug]: qs override keeps 6.16.0 under body-parser 2.4.0's ^6.16.1 #7641

Closed

[Bug]: ip-address 10.7.1 is inside GHSA-rxp7-6hxx-x8q5 (moderate) #7640

Closed

This was referenced Oct 24, 2026

[Bug]: hono 4.13.8 override is inside GHSA-5r4p-p66f-jhc7 (moderate) #7639

Closed

chore(test): align Bun runner with the 1.4.4 security baseline #7627

Merged

Navigation Menu

Repository navigation

fix(deps): patch Hono and ip-address advisories and align qs - #7647

fix(deps): patch Hono and ip-address advisories and align qs#7647
lidge-jun merged 4 commits into
devfrom
lane/l6-deps-advisories

lidge-jun commented Oct 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Review failed

Uh oh!

github-actions Bot commented Oct 24, 2026

Uh oh!

lidge-jun commented Oct 24, 2026

Uh oh!

lidge-jun commented Oct 24, 2026

Uh oh!

lidge-jun commented Oct 24, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lidge-jun commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security summary

Verification

Checklist

Uh oh!

coderabbitai Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Uh oh!

github-actions Bot commented Oct 24, 2026

Uh oh!

lidge-jun commented Oct 24, 2026

Local CI-equivalent (Linux) at 69f189e

Uh oh!

lidge-jun commented Oct 24, 2026

Local CI-equivalent (Linux) coverage addendum at 69f189e

Uh oh!

lidge-jun commented Oct 24, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026

Codex Review Summary

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lidge-jun commented Oct 24, 2026 •

edited

Loading

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Local CI-equivalent (Linux) at `69f189e`

Local CI-equivalent (Linux) coverage addendum at `69f189e`