Skip to content

chore(deps): Bump @hono/node-server from 1.19.12 to 1.19.13#443

Merged
sjnims merged 1 commit intomainfrom
dependabot/npm_and_yarn/hono/node-server-1.19.13
Apr 8, 2026
Merged

chore(deps): Bump @hono/node-server from 1.19.12 to 1.19.13#443
sjnims merged 1 commit intomainfrom
dependabot/npm_and_yarn/hono/node-server-1.19.13

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 8, 2026

Bumps @hono/node-server from 1.19.12 to 1.19.13.

Release notes

Sourced from @​hono/node-server's releases.

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

Commits

@dependabot dependabot bot added dependencies Pull requests that update a dependency file npm Pull requests that update npm dependencies labels Apr 8, 2026
@dependabot dependabot bot requested a review from sjnims as a code owner April 8, 2026 05:27
@sjnims
Copy link
Copy Markdown
Owner

sjnims commented Apr 8, 2026

@dependabot rebase

Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.12 to 1.19.13.
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.12...v1.19.13)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/hono/node-server-1.19.13 branch from 839778c to 90cd2f5 Compare April 8, 2026 06:27
@sjnims sjnims merged commit 07dfcfe into main Apr 8, 2026
6 of 11 checks passed
@sjnims sjnims deleted the dependabot/npm_and_yarn/hono/node-server-1.19.13 branch April 8, 2026 06:28
@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 8, 2026

CI Failure Analysis: CI

Run: #24121336246 | Commit: 07dfcfe

Summary

All 5 CI jobs (Format Check, Type Check, Lint, Dead Code Check, Test) failed during npm ci due to a peer dependency conflict. madge@8.0.0 requires typescript@"^5.4.4" but the project specifies typescript@"^6.0.2" (resolved to 6.0.2), which is outside madge's accepted range.

Failures Found

File Line Issue
package.json - typescript@^6.0.2 conflicts with madge@8.0.0 peer dep typescript@^5.4.4
package.json - @typescript-eslint/eslint-plugin@8.58.0 peer dep typescript@>=4.8.4 <6.1.0 is satisfied, but madge is not

How to Fix

The root cause is that madge@8.0.0 hasn't been updated to support TypeScript 6.x. Options:

Option 1: Update madge (preferred)
Check if a newer version of madge supports TypeScript 6:

npm info madge versions --json | tail -5
npm info madge peerDependencies

If a compatible version exists, update it in package.json.

Option 2: Add an npm override
Add an overrides field in package.json to force the TypeScript version for madge:

{
  "overrides": {
    "madge": {
      "typescript": "$typescript"
    }
  }
}

Then regenerate the lockfile:

rm package-lock.json && npm install

Option 3: Use --legacy-peer-deps in CI
Update the CI workflow to use npm ci --legacy-peer-deps (least preferred — masks real issues).

After applying the fix, verify locally with:

rm -rf node_modules package-lock.json && npm install && npm run check

Analyzed by Claude

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file npm Pull requests that update npm dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant