From f74435080d26f42f2a7b2b425f41c63469b9cf9a Mon Sep 17 00:00:00 2001 From: Web Artisan Date: Mon, 26 Oct 2026 17:08:10 +0300 Subject: [PATCH] fix(deps): bump zod, hono and image runtimes --- .github/CONTRIBUTING.md | 2 +- .github/workflows/ci.yml | 2 +- CHANGELOG.md | 7 +++++++ Dockerfile | 6 +++--- apps/gateway/package.json | 4 ++-- apps/web/package.json | 2 +- bun.lock | 22 +++++++++++----------- packages/schema/package.json | 2 +- 8 files changed, 27 insertions(+), 20 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 8b78d90..5bf1f65 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -4,7 +4,7 @@ Thanks for taking the time. This document covers what you need to build the gate ## Setup -You need [Bun](https://bun.sh) 1.4.2 or newer. Docker is optional and only needed for the container runtime and its tests. +You need [Bun](https://bun.sh) 1.4.4 or newer. Docker is optional and only needed for the container runtime and its tests. ```sh bun install diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4eaadab..d7f4dde 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,7 +47,7 @@ jobs: - uses: actions/checkout@v7 - uses: oven-sh/setup-bun@v2 with: - bun-version: 1.4.2 + bun-version: 1.4.4 - run: bun install --frozen-lockfile - run: bun run check - run: bun run typecheck diff --git a/CHANGELOG.md b/CHANGELOG.md index 3f97e20..6faacb8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,13 @@ All notable changes to this project are documented here. The format follows ## [Unreleased] +### Security + +- **`zod` moves to 4.6.7**, closing CVE-2023-54404 (denial of service through validation of an unbounded array). Every request body the gateway accepts, including the MCP and OAuth endpoints, is validated with zod, so this was reachable. +- **The image is rebuilt on a patched Debian base and ships uv 0.12.19, Bun 1.4.4 and npm 12.2.1**, closing the OpenSSL advisories (CVE-2026-84782 and four medium ones), CVE-2026-104843 and GHSA-2mjx-qc3c-rqvc in uv. +- **`hono` moves to 4.13.13; `body-parser`, `fast-uri`, `ip-address` and `qs` are bumped in the lockfile**, closing CVE-2026-111757, CVE-2026-111181, CVE-2026-110306, CVE-2026-110180 and CVE-2026-111997. None of these code paths is used by the gateway (it does not use `serveStatic` and never imports `express`), the bumps clear the scanner findings. +- **The `undici` and `ip-address` copies bundled inside npm itself stay flagged** until npm ships a release that updates them; npm only launches `npx` servers and never handles gateway traffic. + ## [0.2.5] - 2026-10-08 ### Security diff --git a/Dockerfile b/Dockerfile index 01381a7..c156be3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ -ARG BUN_VERSION=1.4.2 +ARG BUN_VERSION=1.4.4 ARG NODE_VERSION=22 -ARG UV_VERSION=0.12.15 -ARG NPM_VERSION=12.2.0 +ARG UV_VERSION=0.12.19 +ARG NPM_VERSION=12.2.1 FROM oven/bun:${BUN_VERSION}-slim AS bun FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv diff --git a/apps/gateway/package.json b/apps/gateway/package.json index 6bdc4bb..b592884 100644 --- a/apps/gateway/package.json +++ b/apps/gateway/package.json @@ -22,9 +22,9 @@ "@modelcontextprotocol/sdk": "1.32.1", "@modelcontextprotocol/server": "2.3.1", "drizzle-orm": "^0.45.2", - "hono": "^4.13.7", + "hono": "4.13.13", "jose": "^6.1.0", - "zod": "^4.6.5" + "zod": "4.6.7" }, "devDependencies": { "@types/bun": "^1.4.0", diff --git a/apps/web/package.json b/apps/web/package.json index 29f9972..e8c0ba9 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -23,7 +23,7 @@ "vue": "^3.5.42", "vue-router": "^5.3.1", "vue-sonner": "^2.0.9", - "zod": "^4.6.5" + "zod": "4.6.7" }, "devDependencies": { "@types/node": "^26.5.1", diff --git a/bun.lock b/bun.lock index 759f2a7..91c5559 100644 --- a/bun.lock +++ b/bun.lock @@ -11,7 +11,7 @@ }, "apps/gateway": { "name": "@junctio/gateway", - "version": "0.2.4", + "version": "0.2.5", "bin": { "junctio": "./src/cli/index.ts", }, @@ -23,9 +23,9 @@ "@modelcontextprotocol/sdk": "1.32.1", "@modelcontextprotocol/server": "2.3.1", "drizzle-orm": "^0.45.2", - "hono": "^4.13.7", + "hono": "4.13.13", "jose": "^6.1.0", - "zod": "^4.6.5", + "zod": "4.6.7", }, "devDependencies": { "@types/bun": "^1.4.0", @@ -72,7 +72,7 @@ "vue": "^3.5.42", "vue-router": "^5.3.1", "vue-sonner": "^2.0.9", - "zod": "^4.6.5", + "zod": "4.6.7", }, "devDependencies": { "@types/node": "^26.5.1", @@ -87,7 +87,7 @@ "name": "@junctio/schema", "version": "0.0.0", "dependencies": { - "zod": "^4.6.5", + "zod": "4.6.7", }, }, }, @@ -656,7 +656,7 @@ "birpc": ["birpc@2.9.0", "", {}, "sha512-KrayHS5pBi69Xi9JmvoqrIgYGDkD6mcSe/i6YKi3w5kekCLzrX4+nawcXqrj2tIp50Kw/mT/s3p+GVK0A0sKxw=="], - "body-parser": ["body-parser@2.3.0", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^2.0.0", "debug": "^4.4.3", "http-errors": "^2.0.1", "iconv-lite": "^0.7.2", "on-finished": "^2.4.1", "qs": "^6.15.2", "raw-body": "^3.0.2", "type-is": "^2.1.0" } }, "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw=="], + "body-parser": ["body-parser@2.4.0", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" } }, "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ=="], "boolbase": ["boolbase@1.0.0", "", {}, "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="], @@ -848,7 +848,7 @@ "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="], - "fast-uri": ["fast-uri@3.1.8", "", {}, "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg=="], + "fast-uri": ["fast-uri@3.1.9", "", {}, "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ=="], "fast-wrap-ansi": ["fast-wrap-ansi@0.2.2", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q=="], @@ -920,7 +920,7 @@ "hastscript": ["hastscript@9.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "comma-separated-tokens": "^2.0.0", "hast-util-parse-selector": "^4.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0" } }, "sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w=="], - "hono": ["hono@4.13.7", "", {}, "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ=="], + "hono": ["hono@4.13.13", "", {}, "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA=="], "hono-rate-limiter": ["hono-rate-limiter@0.5.4", "", { "peerDependencies": { "hono": "^4.10.8", "unstorage": "^1.17.3" }, "optionalPeers": ["unstorage"] }, "sha512-P3/cscAmz1hA+MuM+Hn9gP/EyO2zWv2aXIFkVYuLZkPzrPa4oaWdVCS94vyDlsNBgeMnE/Hr2+LznIKQxrF0ng=="], @@ -940,7 +940,7 @@ "inline-style-parser": ["inline-style-parser@0.2.7", "", {}, "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA=="], - "ip-address": ["ip-address@10.7.3", "", {}, "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg=="], + "ip-address": ["ip-address@10.7.4", "", {}, "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg=="], "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="], @@ -1244,7 +1244,7 @@ "proxy-addr": ["proxy-addr@2.0.8", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ=="], - "qs": ["qs@6.16.0", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA=="], + "qs": ["qs@6.16.1", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg=="], "quansync": ["quansync@0.2.11", "", {}, "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA=="], @@ -1548,7 +1548,7 @@ "yocto-queue": ["yocto-queue@1.2.2", "", {}, "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ=="], - "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="], + "zod": ["zod@4.6.7", "", {}, "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg=="], "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="], diff --git a/packages/schema/package.json b/packages/schema/package.json index eb6fae2..14d9f8a 100644 --- a/packages/schema/package.json +++ b/packages/schema/package.json @@ -8,6 +8,6 @@ ".": "./src/index.ts" }, "dependencies": { - "zod": "^4.6.5" + "zod": "4.6.7" } }