[dependabot]

Bumps the prod group with 5 updates in the / directory:

Package	From	To
@hono/node-server	2.1.5	2.1.6
@simplewebauthn/server	14.0.3	14.1.0
@tauri-apps/plugin-updater	2.14.0	2.14.1
hono	4.13.13	4.13.17
ws	8.22.0	8.22.1

Updates @hono/node-server from 2.1.5 to 2.1.6

Release notes

Sourced from @​hono/node-server's releases.

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

Commits

• 123f782 2.1.6
• cfaa79f Merge commit from fork
• 61cc026 Merge commit from fork
• a152a45 test: wait for the first chunk before sending the second in the readable-stre...
• fb97395 Merge commit from fork
• See full diff in compare view

Updates @simplewebauthn/server from 14.0.3 to 14.1.0

Release notes

Sourced from @​simplewebauthn/server's releases.

v14.1.0

Changes:

• [server] Support for the FIDO Convenience Metadata Service has been added with the new ConvenienceMetadataService. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#convenience-metadata-service for more info (#812)
• [server] verifyRegistrationResponse() and verifyAuthenticationResponse() will now raise a SimpleWebAuthnError when expectedRPID or expectedOrigin are not valid values (#824)
• [server] "android-key" attestation statement verification now checks that the x5c root certificate is a known one before verifying the certificate chain (#821)
• [server] "android-key" attestation statement verification now knows about the new Google Android Key Attestation CA1 trust anchor (#820)
• [server] "tpm" attestation statement verification now properly parses non-TPM_ALG_NULL schemes in pubArea (#822)

Changelog

Sourced from @​simplewebauthn/server's changelog.

v14.1.0

Changes:

• [server] Support for the FIDO Convenience Metadata Service has been added with the new ConvenienceMetadataService. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#convenience-metadata-service for more info (#812)
• [server] verifyRegistrationResponse() and verifyAuthenticationResponse() will now raise a SimpleWebAuthnError when expectedRPID or expectedOrigin are not valid values (#824)
• [server] "android-key" attestation statement verification now checks that the x5c root certificate is a known one before verifying the certificate chain (#821)
• [server] "android-key" attestation statement verification now knows about the new Google Android Key Attestation CA1 trust anchor (#820)
• [server] "tpm" attestation statement verification now properly parses non-TPM_ALG_NULL schemes in pubArea (#822)

Commits

• 01d1a64 Fix deno publish issue
• f8b71cb Update server version to v14.1.0
• 60c34a1 Require ASCII inputs for expectedRPID and expectedOrigin (#824)
• 8f41b23 Improve TPM pubArea parsing (#822)
• 6a87602 Mount better defenses against malicious cert chains in Android Key attestatio...
• a0d9d94 Add Google Android Key Attestation CA1 trust anchor (#820)
• 96f0f24 Fix copy-pasted "teeEnforced" w/"softwareEnforced" in Android Key error messa...
• df53178 Add support for FIDO Convenience MDS (#812)
• See full diff in compare view

Updates @tauri-apps/plugin-updater from 2.14.0 to 2.14.1

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.14.1

[2.14.1]

• 385f60c0 (#3515 by @​renovate) Updated dependency base64 to 0.23
• ba98bfad (#3698 by @​renovate) Update zip to v9. On Windows, the Error::Extract variant now wraps zip 9's ZipError.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.14.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.9kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.8kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.14.1
npm notice filename: tauri-apps-plugin-updater-2.14.1.tgz
npm notice package size: 4.9 kB
npm notice unpacked size: 25.5 kB
npm notice shasum: f1ae182e36409a7d32cdfbfc897b1c848b7ff94d
npm notice integrity: sha512-Hr7nlBm1wT6xb[...]35UqnbrQxmYQw==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3529335775
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.14.1

updater v2.14.1

[2.14.1]

• 385f60c0 (#3515 by @​renovate) Updated dependency base64 to 0.23
• ba98bfad (#3698 by @​renovate) Update zip to v9. On Windows, the Error::Extract variant now wraps zip 9's ZipError.

... (truncated)

Commits

• 1281906 publish new versions (#3712)
• 52fa775 chore(deps): update rust crate rand to 0.10 (#3738)
• 1331ca4 chore(deps): update rust crate rfd to 0.17 (#3737)
• 385f60c chore(deps): update rust crate base64 to 0.23 (#3515)
• 8e04d30 chore(deps): update dependency @​tauri-apps/cli to v2.12.4 (#3717)
• 34ed7d3 chore(deps): update dependency @​rollup/plugin-terser to v1.0.2 (#3733)
• c75459d chore(deps): update dependency rollup to v4.64.12 (#3715)
• df59420 chore(deps): update webpki-roots crates (lockfile-only) (#3723)
• 11211c3 fix(window-state): stop macOS overlay windows changing size on every restore ...
• f36ba7b feat(notification): add Android chronometer support (#3282)
• Additional commits viewable in compare view

Updates hono from 4.13.13 to 4.13.17

Release notes

Sourced from hono's releases.

v4.13.17

What's Changed

• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in honojs/hono#5608
• fix(utils/url): do not match a query key across separators in honojs/hono#5607
• fix(etag,pretty-json): cancel the discarded response body in honojs/hono#5606
• fix(client): detect the JSON media type with whitespace before a parameter in honojs/hono#5609
• fix(timing): honor a precision of 0 in setMetric in honojs/hono#5363
• fix(utils/mime,ssg): match media types case-insensitively in honojs/hono#5449
• fix(timing): escape double quotes and backslashes in Server-Timing descriptions in honojs/hono#5478
• fix(etag): preserve commas within quoted entity tags in honojs/hono#5353
• fix(accepts): preserve exact media type quality over subtype wildcards in honojs/hono#5427
• fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in honojs/hono#5611
• fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in honojs/hono#5430
• fix(ssg): do not reuse created directories across toSSG runs in honojs/hono#5381
• fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in honojs/hono#5483
• fix(jsx): escape element and object attribute values in honojs/hono#5512
• fix(jsx): do not render ref objects as attributes in honojs/hono#5615
• fix(factory): keep independent return types for nine handlers in honojs/hono#5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

... (truncated)

Commits

• 61f7c59 4.13.17
• 1534ffa fix(factory): keep independent return types for nine handlers (#5618)
• eb754bd fix(jsx): do not render ref objects as attributes (#5615)
• 6cbe361 fix(jsx): escape element and object attribute values (#5512)
• 8b7f9e9 fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events (#...
• 7852e0a fix(ssg): do not reuse created directories across toSSG runs (#5381)
• bcfd02b fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary (#5430)
• 456fe46 fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in C...
• 98b35af fix(accepts): preserve exact media type quality over subtype wildcards (#5427)
• b3f1272 fix(etag): preserve commas within quoted entity tags (#5353)
• Additional commits viewable in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

• The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

• http.websocketMask() and http.websocketUnmask() are now used instead of the bufferutil variants when available (2ab3d3e5).
• Sender.frame() no longer returns empty chunks (85319a72).

Commits

• c18a80a [dist] 8.22.1
• 2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
• c9efa88 [ci] Test on node 27
• aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
• b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
• 85319a7 [minor] Prevent Sender.frame() from returning empty chunks
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions