[dependabot]

Bumps @hono/node-server from 2.1.6 to 2.1.8.

Release notes

Sourced from @​hono/node-server's releases.

v2.1.8

What's Changed

• fix(request): forward duplex to the native request in honojs/node-server#409
• fix(utils): do not chain a promise per chunk while streaming a response in honojs/node-server#417
• fix(listener): cancel the response body when the client has already disconnected in honojs/node-server#412
• fix(utils): cancel late HTTP/2 response bodies in honojs/node-server#419
• fix(listener): do not send a complete response when the body fails during the early read in honojs/node-server#420

Full Changelog: honojs/node-server@v2.1.7...v2.1.8

v2.1.7

Security fixes

This release includes a fix for the following security issue:

serveStatic with allowPercentInPath still allows the double-decode middleware bypass

Affects: serveStatic with allowPercentInPath: true. The fix for GHSA-rmxm-3fg6-px4f rejects a path containing %, but the allowPercentInPath option skipped that check entirely. A malformed percent sequence such as /static/%%36%31dmin/secret.txt was routed as /static/%61dmin/secret.txt, so middleware on /static/admin/* did not run, and serveStatic then decoded %61 to a and served static/admin/secret.txt. The default configuration was already fixed in 2.1.3. GHSA-fj57-4f93-cfw6

serveStatic now accepts the second decode only when its result equals the routed path with %25 replaced by %. File names containing a literal %, requested as %25, are served as before.

---

The same fix ships in hono v4.13.18 (GHSA-74fm-fwc7-3fwp).

Full Changelog: honojs/node-server@v2.1.6...v2.1.7

Commits

• 1fc1dfc 2.1.8
• 3463817 fix(listener): do not send a complete response when the body fails during the...
• f22b99c fix(utils): cancel late HTTP/2 response bodies (#419)
• 4b885d3 fix(listener): cancel the response body when the client has already disconnec...
• 653ec79 fix(utils): do not chain a promise per chunk while streaming a response (#417)
• 7da431b fix(request): forward duplex to the native request (#409)
• abe63c8 2.1.7
• cc42986 Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)