Skip to content

fix: bump @hono/node-server to 1.19.17 and split complex validators - #8

Closed
S4v3easy wants to merge 1 commit into
edgegap:mainfrom
S4v3easy:fix/security-and-tech-debt
Closed

S4v3easy wants to merge 1 commit into
edgegap:mainfrom
S4v3easy:fix/security-and-tech-debt

Conversation

@S4v3easy

@S4v3easy S4v3easy commented Oct 9, 2026

Copy link
Copy Markdown

Bump transitive @hono/node-server 1.19.14 -> 1.19.17 for GHSA-frvp-7c67-39w9 (serve-static path traversal on Windows). Lockfile-only: @modelcontextprotocol/sdk 1.30.0 already accepts ^1.19.9. Not reachable here; this package does not use serve-static.

Split validateServerConfig, generateDockerfile and buildMatchmakerConfig into single-purpose helpers. Signatures, return shapes, messages and finding order are unchanged.

Cyclomatic complexity (fallow 3.32.0):
validateServerConfig 72 -> 6
generateDockerfile 28 -> 9
buildMatchmakerConfig 23 -> 12
No function in the three files now exceeds 12 cyclomatic or 11
cognitive.

Bump transitive @hono/node-server 1.19.14 -> 1.19.17 for
GHSA-frvp-7c67-39w9 (serve-static path traversal on Windows).
Lockfile-only: @modelcontextprotocol/sdk 1.30.0 already accepts
^1.19.9. Not reachable here; this package does not use serve-static.

Split validateServerConfig, generateDockerfile and
buildMatchmakerConfig into single-purpose helpers. Signatures, return
shapes, messages and finding order are unchanged.

Cyclomatic complexity (fallow 3.32.0):
  validateServerConfig   72 -> 6
  generateDockerfile     28 -> 9
  buildMatchmakerConfig  23 -> 12
No function in the three files now exceeds 12 cyclomatic or 11
cognitive.
@mathieuduperre

Copy link
Copy Markdown
Contributor

thanks for that. i missed the PR and added the update in another PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants