fix(deps): update dependency @hono/node-server to v2.0.12 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server	1.19.15 → 2.0.12

---

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C)

GHSA-frvp-7c67-39w9

More information

Details

The same as the hono core Path traversal in serve-static on Windows via encoded backslash (%5C).

Summary

On Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. Directory escape (..) remains blocked.

Details

The router splits paths only on /, so /admin%5Csecret.txt is one segment and middleware on /admin/* does not run. The serve-static guard rejects ./.. and consecutive separators but lets a lone \ through; on Windows the file resolver re-splits it into the protected subtree.

This affects Windows hosts serving static files via the Node, Bun, or Deno adapters that guard a static subtree with prefix-mounted middleware.

Impact

An unauthenticated attacker can read static files under a middleware-guarded prefix on Windows hosts. The read stays within the configured root; escape outside the root is not possible.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/honojs/node-server/security/advisories/GHSA-frvp-7c67-39w9
• https://github.com/honojs/node-server/commit/cd076e117cfe4cb8d31f9eb11d2e8f38a6cb8faf
• https://github.com/honojs/node-server/releases/tag/v2.0.5
• https://github.com/advisories/GHSA-frvp-7c67-39w9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/node-server (@​hono/node-server)

v2.0.12

Compare Source

What's Changed

• test: replace supertest by @​BlankParticle in #​379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in #​382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[anconina]

Closing: not mergeable as-is, and merging it would break every npm install -g comisai.

@hono/node-ws has published no 2.x — latest is 1.3.1 and it still declares peerDependencies: { "@hono/node-server": "^1.19.11" }. Both packages are pinned together in packages/comis and packages/gateway, so moving @hono/node-server to 2.0.12 puts an unsatisfiable peer in the published manifest. pnpm only warns; npm install fails it with ERESOLVE, which kills the installer's bundled-dependency repair pass and leaves the CLI unable to load.

That is the exact regression #350 just fixed, and test/architecture/npm-peer-consistency.test.ts was written to guard it. This PR's unit jobs only pass because the branch is 23 commits behind main and predates that test — rebasing it onto main turns the gate red.

The advisory stands unresolved until upstream ships a @hono/node-ws that accepts @hono/node-server@2.x; we can take the bump in the same change then.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (2.0.12). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.