From bd530cdc17dbe7124c22963825d7d79212d9267d Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Wed, 22 Jul 2026 08:46:37 -0400
Subject: [PATCH] fix(docker): pull the image off a vulnerable
 @hono/node-server (GHSA-frvp-7c67-39w9)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Scorecard opened a high-severity Vulnerabilities alert (#28) minutes after #91
landed. The dependency is not new — `npm i -g` was installing the same tree
before — but nothing in the repo described it, so nothing could see it. The
lockfile that #91 added is what made it visible, which is the point of having
one.

The advisory (published 2026-07-21, hours before that merge) is a path traversal
in @hono/node-server's serve-static, patched in 2.0.5. It reaches this image
transitively: server-everything -> @modelcontextprotocol/sdk -> @hono/node-server
"^1.19.9". That caret range can never resolve to 2.0.5, the SDK is already at its
latest (1.29.0), and server-everything is already at its latest (2026.7.4) — so
there is no upstream bump to wait for. An npm override is the only way off it
today.

Overriding a transitive major the SDK was not written against is the real risk
here, so it is tested rather than assumed: with the override in place, `npm ci`
resolves @hono/node-server 2.0.11 and the reference server still completes a full
MCP handshake over stdio, returning all 13 tools. The image only ever runs the
downstream over stdio, so it never constructs a Hono HTTP server at all — the
vulnerable serve-static path was unreachable here either way. This is about not
shipping a flagged dependency in a supply-chain tool's own image, not about a
live exploit.

Drop the override once the SDK widens its range; Dependabot watches /docker
(added in #91) and will offer that bump.

Verified: clean-cache `npm ci --omit=dev` with SSH disabled resolves 108 packages
and pins @hono/node-server to the patched 2.0.11; live stdio handshake against
that exact tree returns 13 tools. The full image build + non-root check + live
handshake is what docker.yml asserts on this PR.
---
 docker/package-lock.json | 8 ++++----
 docker/package.json      | 6 ++++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/docker/package-lock.json b/docker/package-lock.json
index 90e8f64..6aaea74 100644
--- a/docker/package-lock.json
+++ b/docker/package-lock.json
@@ -51,12 +51,12 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.14",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
-      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.11.tgz",
+      "integrity": "sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==",
       "license": "MIT",
       "engines": {
-        "node": ">=18.14.1"
+        "node": ">=20"
       },
       "peerDependencies": {
         "hono": "^4"
diff --git a/docker/package.json b/docker/package.json
index 8126f33..6c91b68 100644
--- a/docker/package.json
+++ b/docker/package.json
@@ -7,5 +7,11 @@
   "dependencies": {
     "@askalf/truecopy": "0.9.0",
     "@modelcontextprotocol/server-everything": "2026.7.4"
+  },
+  "comments": {
+    "overrides": "GHSA-frvp-7c67-39w9 — path traversal in @hono/node-server's serve-static. It reaches this image transitively (server-everything -> @modelcontextprotocol/sdk -> @hono/node-server ^1.19.9), and the SDK's caret range cannot resolve to the patched 2.0.5, so there is no upstream fix to wait for yet. Drop this override once the SDK widens its range; Dependabot watches /docker and will offer that bump."
+  },
+  "overrides": {
+    "@hono/node-server": "^2.0.5"
   }
 }