Override hono, and drop the audit floor to the one Dependabot alerts on

[illodev]

Closes the Dependabot alert that had been open for days, and the reason it stayed open.

The advisory

GHSA-8j4g-w8fx-2239 — ReDoS in hono's CORS middleware via Access-Control-Request-Headers, moderate, patched in 4.12.34. One path: shadcn → @modelcontextprotocol/sdk → @hono/node-server → hono, and shadcn is a devDependency. Nothing published reaches it, so this is the honest kind of override — same class as fast-uri and js-yaml, opposite of the sharp/adm-zip entries T-0221 had to delete.

The better fix, checked and ruled out

Removing shadcn from devDependencies would have taken hono out of the graph entirely, plus one of two fast-uri paths and one js-yaml path — a much better outcome than another pin. docs/ui.md teaches pnpm dlx shadcn@latest add <component> and no script invokes a local shadcn binary, so it looked unused.

It is not. ui/src/styles.css has @import "shadcn/tailwind.css", which resolves to shadcn/dist/tailwind.css and carries the scroll-fade-* utilities that Boards, Memory and attachment.tsx use — the rules are in the built CSS, checked rather than assumed. The package is load-bearing at build time, not just tooling.

Why it sat there for days

This is the part worth reviewing. The gate ran at --audit-level=high; Dependabot alerts at moderate. So this advisory could never turn anything red — it went to the security tab, where nothing fails and nobody is obliged to look. A gate whose floor sits above the floor of something that already reports guarantees a backlog somewhere else.

Both audits now block at moderate: the workspace pnpm audit job and the consumer-tree gate.

It cost nothing today — both trees audit clean at low, so this is not papering over a current reading. What it will cost is stated in ADR-0021 and CHG-0150: an advisory published against a transitive devDependency will now turn unrelated pull requests red until an override lands. That is the same trade the no-allowlist posture already made, and it is the one that produced the real fix in T-0221.

One-line revert if you decide the noise is not worth it: put high back in ci.yml, check:release, and THRESHOLD in scripts/audit-consumer.ts.

Also

scripts/audit-consumer.ts had a stale header describing the sharp and adm-zip overrides as present, after T-0221 removed them. Corrected — a record that lies is worse than none.

Verification

• pnpm audit --audit-level=moderate and --audit-level=low: no known vulnerabilities.
• pnpm why hono: 4.13.1 through the single path above.
• pnpm run audit:consumer: clean at moderate and above, nothing below.
• pnpm run check: 465 + 10 tests pass, strict ratchet held at 488.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D3LTdq3mzMAQ98rwBegGjU

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workfile	Ready	Preview	Aug 7, 2026 6:41pm
workfile-site	Ready	Preview	Aug 7, 2026 6:41pm