Skip to content

chore(deps): bump @hono/node-server from 1.19.17 to 2.1.5 - #229

Merged
glebedel merged 1 commit into
mainfrom
dependabot/npm_and_yarn/hono/node-server-2.1.5
Oct 29, 2026
Merged

glebedel merged 1 commit into
mainfrom
dependabot/npm_and_yarn/hono/node-server-2.1.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Bumps @hono/node-server from 1.19.17 to 2.1.5.

Release notes

Sourced from @​hono/node-server's releases.

v2.1.5

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

... (truncated)

Commits
  • 4b47a0d 2.1.5
  • e77824a fix(serve-static): only serve GET and HEAD requests (#405)
  • 1b6e6bf fix(listener): abort the request signal when an HTTP/2 client resets the stre...
  • d57ed9b 2.1.4
  • 92b014c chore: allow hono v5 as a peer dependency (#406)
  • 720ac78 2.1.3
  • 9821792 Merge commit from fork
  • 35bca95 2.1.2
  • 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
  • fe7467c test(request): accept asynchronous body read errors (#403)
  • Additional commits viewable in compare view

@glebedel glebedel left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.17 to 2.1.5.
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.17...v2.1.5)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.5
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/hono/node-server-2.1.5 branch from 0063514 to 8385e85 Compare October 22, 2026 10:22

@s2d2-agent s2d2-agent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s2d2 dependabot evidence (run sa-2026-10-29-7e1f25f1)

Decision: SAFE. dev-only major, CI green.
Packages: @hono/node-server 1.19.17 to 2.1.5
Scope: dev only, major bump, tier 1.
CI: 12 checks, 0 failing, 0 pending at classification.
Not a security update.
Local verification not required for this class of bump.

Awaiting merge approval from Guillaume in the Security Autopilot thread. This is an evidence note, not an approval.

@glebedel
glebedel merged commit b915683 into main Oct 29, 2026
12 checks passed
@glebedel
glebedel deleted the dependabot/npm_and_yarn/hono/node-server-2.1.5 branch October 29, 2026 14:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant