Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates - #386

Merged
simongdavies merged 1 commit into
mainfrom
dependabot/npm_and_yarn/src/js-host-api/examples/mcp-server/npm_and_yarn-63fdef2d7d
Nov 3, 2026
Merged

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates#386
simongdavies merged 1 commit into
mainfrom
dependabot/npm_and_yarn/src/js-host-api/examples/mcp-server/npm_and_yarn-63fdef2d7d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 3 updates in the /src/js-host-api/examples/mcp-server directory: @hono/node-server, body-parser and qs.

Updates @hono/node-server from 2.1.1 to 2.1.6

Release notes

Sourced from @​hono/node-server's releases.

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

... (truncated)

Commits
  • 123f782 2.1.6
  • cfaa79f Merge commit from fork
  • 61cc026 Merge commit from fork
  • a152a45 test: wait for the first chunk before sending the second in the readable-stre...
  • fb97395 Merge commit from fork
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • d57ed9b 2.1.4
  • 92b014c chore: allow hono v5 as a peer dependency (#406)
  • Additional commits viewable in compare view

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

  • Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)
  • feat: add zstd content-encoding support (#586)
    • Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies
  • fix: avoid mutating the parser options and the request object while reading the body (#742, #750)
  • perf(json): avoid first-char regex for direct JSON bodies (#744)
  • deps:
    • content-type@^2.1.0
    • iconv-lite^0.7.3
    • qs@^6.16.1
Commits
  • b4744d7 2.4.0 (#777)
  • f7075ea fix: prevent process crash from trailing bytes after a compressed body
  • 185ff1d chore: update dependencies (#778)
  • 73713f7 docs: fix depth error description (#776)
  • 2dcc826 docs: improve readability (#756)
  • 402dbdc docs: note that req.body may be undefined in v2 (#752)
  • 9883a1e perf: inline content stream setup (#750)
  • 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
  • 822a0fd build(deps): bump the github-actions group with 3 updates (#771)
  • aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Updates qs from 6.16.0 to 6.17.1

Changelog

Sourced from qs's changelog.

6.17.1

  • [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
  • [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
  • [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
  • [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
  • [Refactor] parse: extract wrapping-bracket stripping helper
  • [readme] document that depth: 0 and depth: false keep keys flat
  • [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

  • [New] stringify: add WHATWG format (#623)
  • [Fix] stringify: do not sort the caller's filter array in place (#637)
  • [Fix] parse: copy an own __proto__ key as data (#636)
  • [Fix] parse: decode percent-encoded dots case-insensitively (#635)
  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
  • [Fix] parse: allow scalar fields with a zero array limit (#627)
  • [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
  • [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
  • [eslint] fix indentation
  • [readme] document the encoder's format argument
  • [meta] add changelog acknowledgement
  • [meta] fix changelog indents
  • [Dev Deps] update eslint, evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
  • [Tests] stringify: pin sort order for nested keys selected by an array filter
  • [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
  • [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
  • [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
  • [Tests] parse: pin the behavior of a zero or negative arrayLimit
  • [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [meta] use double quotes for better OS support
  • [Dev Deps] update evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

  • [Fix] parse: do not mutate an object input
  • [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
  • [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
  • [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
  • [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
  • [Fix] stringify: ignore inherited array format names (#622)
  • [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
  • [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
  • [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
  • [Fix] parse: only treat [] as array syntax when it ends the key
  • [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits
  • 43baea4 v6.17.1
  • 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
  • 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
  • 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
  • 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
  • 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
  • ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
  • 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
  • cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
  • 136912a v6.16.2
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the kind/dependencies Dependency updates label Nov 2, 2026
@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 3 up…
c15483a 
…dates

Bumps the npm_and_yarn group with 3 updates in the /src/js-host-api/examples/mcp-server directory: [@hono/node-server](https://github.com/honojs/node-server), [body-parser](https://github.com/expressjs/body-parser) and [qs](https://github.com/ljharb/qs).


Updates `@hono/node-server` from 2.1.1 to 2.1.6
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.6)

Updates `body-parser` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.3.0...v2.4.0)

Updates `qs` from 6.16.0 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.16.0...v6.17.1)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.6
  dependency-type: indirect
- dependency-name: body-parser
  dependency-version: 2.4.0
  dependency-type: indirect
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/src/js-host-api/examples/mcp-server/npm_and_yarn-63fdef2d7d branch from e154fa6 to c15483a Compare November 3, 2026 11:18
@simongdavies
simongdavies enabled auto-merge (squash) November 3, 2026 15:47
@simongdavies
simongdavies merged commit 906aa44 into main Nov 3, 2026
47 of 52 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@simongdavies simongdavies simongdavies approved these changes

Assignees

No one assigned

Labels

kind/dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@simongdavies