FE-1286: Bump seroval, postcss and @hono/node-server (security)

[claude]

Requested by Tim Diekmann · Slack thread

Fixes the three npm findings from the 2026-07-27 security scan that are not covered by draft #332 or the open Dependabot PRs. Lockfile-only apart from one overrides entry; kept deliberately minimal so it cannot conflict badly with #332 (verified: #332 touches none of these packages).

Changes

Package	From	To	Advisory	Severity
seroval	1.5.2	1.5.6	GHSA-mv8w-475r-vwqw (CVE-2026-59940)	CRITICAL
postcss	8.5.14	8.5.23	GHSA-r28c-9q8g-f849	HIGH
@hono/node-server	1.19.14	2.0.10 (override)	GHSA-frvp-7c67-39w9, GHSA-9mqv-5hh9-4cgg	MODERATE

seroval (the priority)

seroval.fromJSON() Promise resolver type confusion invokes attacker-controlled methods during deserialization. Fixed in 1.5.3; resolution-respecting npm update landed 1.5.6 (dependent ranges ^1.5.0 / ^1.0 permit it, no override needed).

postcss

Path traversal in previous-source-map auto-loading (sourceMappingURL) discloses arbitrary .map files. Fixed in 8.5.18; npm update landed 8.5.23 within the existing ^8.5.x ranges. This pulls nanoid 3.3.11 → 3.3.16 as a side effect of postcss's updated dependency range.

@hono/node-server (2.0.10 override — kept because of the required dependency-review gate)

Path traversal in serve-static on Windows via encoded backslash (%5C), GHSA-frvp-7c67-39w9. The fix was backported to the 1.x line: 1.19.15 (released 2026-07-24, latest-1 dist-tag; verified by tarball diff — the serve-static traversal-guard regex gains |\\), so the sole dependent, @modelcontextprotocol/sdk (^1.19.9), can resolve in-range to 1.19.17 with no forced major bump. However, the GitHub advisory still lists the affected range as < 2.0.5, and this repo's "Dependencies / Review" check is a required status check (org-wide ruleset), so an interim commit that switched to 1.19.17 failed the gate and was reverted. brunch therefore keeps the pinned "@hono/node-server": "2.0.10" overrides entry (matching the style of the existing hono pin) purely so the required gate passes — it deliberately diverges from internal#739 and internal-sites#189, which landed the 1.x backport because their dependency-review job did not gate those heads. 2.0.10 rather than 2.0.5 because GHSA-9mqv-5hh9-4cgg is only patched in 2.0.10. Note: this force-resolves a major version under @modelcontextprotocol/sdk — worth a smoke test of MCP server functionality before merging.

Known issues

• Stale advisory range: the GitHub advisory for GHSA-frvp-7c67-39w9 still lists the affected range as < 2.0.5, even though 1.19.15+ contains the backported fix. Once upstream narrows the range, the 2.0.10 override here should be removed so @hono/node-server returns to the in-range 1.x resolution (1.19.17+), aligning brunch with the other repos.

Deliberately out of scope

• Everything covered by draft SRE-808: upgrade vulnerable npm dependencies (2026-07-13 weekly scan) #332 (babel, chrome-devtools-mcp, mermaid, dompurify, undici, js-yaml, qs, form-data, vite, brace-expansion 5.x, etc.) — no overlapping hunks.
• Findings covered by open Dependabot PRs.
• brace-expansion GHSA-mh99 — held, per the scan triage.

Verification

• npm ci --ignore-scripts passes against the updated lockfile.
• Lockfile diff audited: only the three target packages + nanoid are touched.

Linear: FE-1286

🤖 Generated with Claude Code

https://claude.ai/code/session_01WfQz9Y36mQ8J6kRC3zaEtt

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

package-lock.json

Name	Version	Vulnerability	Severity	Patched Version
@hono/node-server	1.19.17	Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)	moderate	2.0.5

OpenSSF Scorecard

Package	Version	Score	Details
npm/@hono/node-server	1.19.17	Unknown	Unknown
npm/nanoid	3.3.16	🟢 6.4	Details Check Score Reason Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 10 all dependencies are pinned Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 5 SAST tool is not run on all commits -- score normalized to 5
npm/postcss	8.5.23	🟢 7.3	Details Check Score Reason Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/seroval	1.5.6	Unknown	Unknown

Scanned Files

• package-lock.json

[cursor]

PR Summary

Medium Risk
Forcing @hono/node-server 2.x for MCP SDK’s 1.x range is a major transitive bump; seroval/postcss patches are routine security fixes with low direct app impact.

Overview
Addresses residual npm security findings with lockfile updates and a new package.json override for @hono/node-server.

seroval is bumped 1.5.2 → 1.5.6 (critical deserialization/type-confusion advisory). postcss moves 8.5.14 → 8.5.23 (path traversal in source-map loading); the lockfile also picks up nanoid 3.3.16 under postcss’s dependency tree.

@hono/node-server is forced to 2.0.10 via overrides (from 1.19.14 in the lockfile), including for @modelcontextprotocol/sdk, which declares ^1.19.9. That is a major resolution change, not an in-range 1.x patch.

^{Reviewed by Cursor Bugbot for commit f1ad812. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f1ad812. Configure here.}

[cursor]

Incorrect major version override

Medium Severity

The @hono/node-server override pins 2.0.10, but @modelcontextprotocol/sdk declares ^1.19.9 and cannot take 2.x. The path-traversal fix is already in 1.19.15+, so an in-range bump to 1.19.17 is enough. Forcing the major may break MCP at runtime without the smoke coverage this PR says is required when a 2.x override remains.

Additional Locations (1)

• package-lock.json#L3458-L3465

 

^{Reviewed by Cursor Bugbot for commit f1ad812. Configure here.}

[claude]

You're right that the fix is backported to 1.19.15+, and we tried exactly that: commit ffb6d8c removed this override so @modelcontextprotocol/sdk's ^1.19.9 resolved in-range to 1.19.17. But this repo's "Dependencies / Review" check is a required status check (org-wide ruleset), and it failed on that head because the GHSA-frvp-7c67-39w9 advisory still lists the affected range as < 2.0.5 — the advisory database hasn't caught up with the 1.19.15 backport. So the 1.19.17 commit was reverted and the 2.0.10 override kept purely to satisfy the gate (2.0.10 is patched for both GHSA-frvp-7c67-39w9 and GHSA-9mqv-5hh9-4cgg). We'll switch back to the in-range 1.x resolution once GitHub corrects the advisory range — the PR body's known-issues section tracks this. The MCP smoke-test caveat for the forced major remains noted in the body.