chore(deps): patch hono, and drop two overrides that pinned nothing

[VickyXAI]

Follow-on from #376. Having found that the Desktop runtime had never had any of the root security pins, the obvious next question was whether the root ones are doing what they claim. Audited all 13 against what the lockfile actually resolves.

hono was inside the advisory range

Pinned ^4.13.0, resolving to 4.13.1. Both open hono advisories (the toSSG() write and the query parser reading past the URL fragment) are fixed in 4.13.5. Pinned ^4.13.5; resolves to 4.13.7. Three lines of lockfile.

Two overrides pin nothing

basic-ftp and jayson > uuid match no package in the tree — none of basic-ftp, jayson or uuid is installed at all. Leftovers from dependencies that have since gone. An override matching nothing is worse than no override, because it reads as protection: #358's body cites "the 13 entries already there are security pins … all still enforced", and two of them enforce nothing. Removed; no resolution changes.

The other nine are fine

One copy each, all above their advisories: axios 1.19.0, undici 8.10.0, ws 8.21.3, postcss 8.5.26, esbuild 0.28.1, brace-expansion 5.0.9, fast-uri 3.1.5, tar 7.5.22, ip-address 10.4.0.

Worth knowing while reading the security tab: the four fast-uri "high" alerts are phantom. They cite ranges >= 2.3.1, < 2.4.5, and the tree contains exactly one fast-uri, at 3.1.5 (fast-uri/-/fast-uri-3.1.5.tgz, the only tarball in the lockfile). They should clear on the next dependency-graph pass.

What is deliberately not fixed

vitest ^4.1.3 resolves to 4.1.10, and the @vitest/mocker path-traversal advisory is fixed in 4.1.11. Every route to it — vitest@^4.1.11, exact vitest@4.1.11 — crashes Arborist:

npm error Cannot read properties of null (reading 'edgesOut')
  at #loadPeerSet (build-ideal-tree.js:1289)
  ... silly unfinished npm timer idealTree:node_modules/vitest

Same failure as #373, and retrying does not clear it; unmodified main resolves fine, so the bump is the trigger. vitest declares exact-version peers on a dozen optional @vitest/* packages, which is the likely cause. It is development scope and not shipped, and hand-editing a lockfile on a package that publishes real-money code to chase a test-runner advisory is a bad trade. Left for when npm or vitest moves.

Verification

Clean npm ci from this lockfile into a scratch tree: hono 4.13.7, tsc --noEmit clean, 1088 tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_015mUab3xrLHNpYqVHJLgJHL

Summary by CodeRabbit

• Chores
  • Updated the Hono package override to version 4.13.5.
  • Removed package-specific overrides for basic-ftp and jayson, including its uuid override.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 9b56e7fb-1702-4997-af85-35713b109e08

📥 Commits

Reviewing files that changed from the base of the PR and between 04d5c01 and c502674.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The package override configuration removes the basic-ftp override and updates the hono override from ^4.13.0 to ^4.13.5.

Changes

Dependency override updates

Layer / File(s)	Summary
Override configuration package.json	The basic-ftp override was removed. The hono override was updated to ^4.13.5.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: 1bcmax

Merge Risk: ⚪ Minimal · up to c5026

This updates the Hono security patch and removes overrides for absent packages. Dependency resolution is consistent with the new Hono floor, with no current merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: patching Hono and removing two ineffective dependency overrides.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/root-overrides

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}