From 2ff9c289ef770b88cb0a79b7378deaa99e483f2d Mon Sep 17 00:00:00 2001 From: illodev Date: Fri, 7 Aug 2026 20:51:35 +0200 Subject: [PATCH] Prove the audit gate fails on a pull request (do not merge) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Throwaway branch for T-0148's last criterion: "a pull request proves it fails there first". CI had shown the `audit` job running and passing on #30 and #31, which proves the wiring and the green path; the red path had only ever been run locally, and this repository does not treat a local run as proof of a pull request. So this pins `hono` to 4.12.33 deliberately — the version carrying GHSA-8j4g-w8fx-2239, which T-0222 overrode away — and nothing else. The `audit` job should go red. It also demonstrates T-0222's threshold change on one tree: this exact install exits 1 at `--audit-level=moderate` and 0 at `--audit-level=high`, which is the whole argument for lowering the floor to the one Dependabot alerts on. To be closed unmerged once the run is recorded on T-0148. Cards: T-0148 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01D3LTdq3mzMAQ98rwBegGjU --- package.json | 2 +- pnpm-lock.yaml | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 67c0c9e..60e0fe3 100644 --- a/package.json +++ b/package.json @@ -55,7 +55,7 @@ "pnpm": { "overrides": { "fast-uri": "^3.1.5", - "hono": "^4.12.34", + "hono": "4.12.33", "js-yaml": "^4.3.1" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a9378ae..132c8c9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: fast-uri: ^3.1.5 - hono: ^4.12.34 + hono: 4.12.33 js-yaml: ^4.3.1 importers: @@ -356,7 +356,7 @@ packages: resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} engines: {node: '>=20'} peerDependencies: - hono: ^4.12.34 + hono: 4.12.33 '@huggingface/tokenizers@0.1.3': resolution: {integrity: sha512-8rF/RRT10u+kn7YuUbUg0OF30K8rjTc78aHpxT+qJ1uWSqxT1MHi8+9ltwYfkFYJzT/oS+qw3JVfHtNMGAdqyA==} @@ -1989,8 +1989,8 @@ packages: resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} engines: {node: '>= 0.4'} - hono@4.13.1: - resolution: {integrity: sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==} + hono@4.12.33: + resolution: {integrity: sha512-+SwvkaiJtxsiPjhy9LivY/1m7UsNqCJetM1BrZl9A5DkQhlbHQDU730mMiDPWjnoCYOM8Chf3WrCJw27kNTPFQ==} engines: {node: '>=16.9.0'} http-errors@2.0.1: @@ -3367,9 +3367,9 @@ snapshots: '@fontsource-variable/geist@5.3.0': {} - '@hono/node-server@2.0.12(hono@4.13.1)': + '@hono/node-server@2.0.12(hono@4.12.33)': dependencies: - hono: 4.13.1 + hono: 4.12.33 '@huggingface/tokenizers@0.1.3': {} @@ -3394,7 +3394,7 @@ snapshots: '@modelcontextprotocol/sdk@1.30.0(zod@3.25.76)': dependencies: - '@hono/node-server': 2.0.12(hono@4.13.1) + '@hono/node-server': 2.0.12(hono@4.12.33) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -3404,7 +3404,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.6.1(express@5.2.1) - hono: 4.13.1 + hono: 4.12.33 jose: 6.2.5 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -4903,7 +4903,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.13.1: {} + hono@4.12.33: {} http-errors@2.0.1: dependencies: