deps: refresh tuistory transitive Hono versions with published advisories

[PierrunoYT]

Version / branch / commit

main at 1b5db1765672820caac1684b168c9898b5ba3593, package version 0.8.0.

Current result

npm audit --package-lock-only --omit=dev
2 moderate severity vulnerabilities

The lockfile resolves:

• @hono/node-server@1.19.14 through tuistory@0.10.0 — GHSA-frvp-7c67-39w9, patched in 1.19.15;
• hono@4.12.27 through tuistory@0.10.0 — four advisories, all patched by 4.12.34.

Applicability review

This is dependency exposure, not evidence of an exploitable Zero path. Review of tuistory@0.10.0 found that its relay server:

• imports Hono from the package root;
• imports and calls createAdaptorServer from @hono/node-server;
• binds the relay to 127.0.0.1; and
• installs its own local-only middleware plus explicit JSON/text/WebSocket routes.

It does not import or call the affected APIs:

• @hono/node-server/serve-static / serveStatic;
• hono/cors / cors();
• hono/jsx / memo();
• hono/proxy / proxy(); or
• hono/language / languageDetector().

Accordingly, none of the currently reported advisory mechanisms appears reachable through tuistory@0.10.0. The packages are nevertheless shipped in the vendored helper tree, and the audit gate remains red.

Compatible remediation verification

tuistory@0.10.0 already declares dependency ranges that permit patched versions (@hono/node-server ^1.19.9, hono ^4.11.7). In a temporary copy of package.json and package-lock.json:

npm audit fix --package-lock-only --ignore-scripts --omit=dev
resolved @hono/node-server 1.19.17
resolved hono 4.13.7
found 0 vulnerabilities

The temporary directory was deleted; the repository lockfile was not changed by this report.

Expected outcome

Refresh the lockfile within the existing compatible ranges, verify the helper/runtime matrix, and return npm audit --package-lock-only --omit=dev to zero findings. No manifest or production dependency substitution should be necessary.

Acceptance checks

• npm audit --package-lock-only --omit=dev passes;
• node --test scripts/action-summary.test.mjs passes;
• release helper staging verifies the tuistory shim on all supported platforms;
• release packaging/build/smoke checks remain green; and
• the PR describes this as removal of non-reachable vulnerable inventory, not a proven Zero exploit.

Reported from codebase audit finding DEP-01.

[Vasanthdev2004]

Confirmed against GitHub's advisory database: the locked hono@4.12.27 has seven open advisories, six medium and one low, the newest three published on 2026-09-08. It is transitive through tuistory. How much of that hono surface (SSG, body parsing, CORS, the language middleware, the proxy helper) tuistory actually exercises I have not checked, so treat this as hygiene until someone does, but the lock should not pin a version with published advisories either way. Approving. Prefer bumping tuistory to a release that pulls a patched hono; an overrides entry in package.json is the fallback if there is none yet.