3dtours/penguin-harness
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release: 0.2.1 (#204)

Browse Source 
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Yaowei ZhengandClaude Fable 5 authored and GitHub committed 2026-08-05 00:30:55 +08:00
1 parent 1cf0e4d9bc
commit 88916880eb
19 files changed
+94 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

changelog/0.2.1/2026-08-04-deps-hono-redos.md
+3
View File
@@ -0,0 +1,3 @@
# Dependencies: hono ≥ 4.12.34 (CORS preflight ReDoS)
Resolves the repository's one open Dependabot alert: GHSA-8j4g-w8fx-2239 / CVE-2026-69207, a moderate ReDoS in Hono's `hono/cors` middleware — quadratic regex backtracking on an attacker-controlled `Access-Control-Request-Headers` preflight header when `allowHeaders` is unconfigured. The server package's direct `hono` range moves from `^4.8.0` to `^4.12.34` (the first patched version, same major); the lockfile change is confined to the hono chain, and `pnpm audit` reports no known vulnerabilities after the bump.