Skip to content

deps: bump @hono/oauth-providers to 0.8.8 in api (GHSA-fm3f-ch8h-qw8q) - #293

Open
katsugtgz wants to merge 1 commit into
dafthunk-com:mainfrom
katsugtgz:deps-oauth-providers-0.8.6
Open

katsugtgz wants to merge 1 commit into
dafthunk-com:mainfrom
katsugtgz:deps-oauth-providers-0.8.6

Conversation

@katsugtgz

Copy link
Copy Markdown

Updates @hono/oauth-providers to address GHSA-fm3f-ch8h-qw8q.

Evidence:

  • apps/api/package.json referenced @hono/oauth-providers@^0.8.5, locked at 0.8.5
  • osv-scanner reported GHSA-fm3f-ch8h-qw8q (OAuth state check fails open on omitted state) for 0.8.5
  • updated version: 0.8.8 (resolves ^0.8.6, the first patched release)

Validation:

  • osv-scanner no longer reports GHSA-fm3f-ch8h-qw8q after the update
  • npx vitest run in apps/api passes (53 files, 813 tests)

Scope: dependency/lockfile update only (apps/api/package.json, pnpm-lock.yaml).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant