Skip to content

fix(security): bump hono to >=4.12.2 to address GHSA-xh87-mx6m-69f3#144

Merged
cswkim merged 2 commits intomainfrom
fix/GHSA-xh87-mx6m-69f3
Feb 27, 2026
Merged

fix(security): bump hono to >=4.12.2 to address GHSA-xh87-mx6m-69f3#144
cswkim merged 2 commits intomainfrom
fix/GHSA-xh87-mx6m-69f3

Conversation

@cswkim
Copy link
Owner

@cswkim cswkim commented Feb 27, 2026

Description

This PR updates hono to a patched version (>= 4.12.2) so that applications using the AWS Lambda ALB adapter no longer trust attacker-controlled X-Forwarded-For values, preventing the IP-based authentication bypass described in GHSA-xh87-mx6m-69f3.

Checklist

  • It's useful if your PR references an issue where it is discussed ahead of time
  • Adhere to semantic messaging and prefix your PR title with feat:, fix:, chore:, docs:, etc.
  • I’ve added tests if needed
  • I’ve updated documentation if applicable
  • I’ve tested this locally
  • Add a changeset (pnpm changeset) if necessary

Tests and linting

  • Run the tests with pnpm test.
  • Run the lint check with pnpm lint.
  • Run the code formatting (prettier) check with pnpm format.

@changeset-bot
Copy link

changeset-bot bot commented Feb 27, 2026

🦋 Changeset detected

Latest commit: f0aea47

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
discogs-mcp-server Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@cswkim cswkim merged commit 67e768f into main Feb 27, 2026
1 check passed
@cswkim cswkim deleted the fix/GHSA-xh87-mx6m-69f3 branch February 27, 2026 15:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant