H-6747: Update @hono/node-server and body-parser

[CiaranMn]

🌟 What is the purpose of this PR?

Addressing security advisories.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 3, 2026 2:00pm
hashdotdesign-tokens	Ready	Preview	Aug 3, 2026 2:00pm
petrinaut	Ready	Preview	Aug 3, 2026 2:00pm

[cursor]

PR Summary

Low Risk
Lockfile-only patch/minor dependency bumps for known advisories; no runtime or API changes in repo source.

Overview
Bumps transitive dependencies in yarn.lock to address security advisories, with no application code changes.

@hono/node-server is updated from 1.19.14 to 1.19.17 (includes a backported fix related to advisory GHSA-frvp-7c67-39w9, which the repo already documents in preflight allow-list config). The legacy body-parser@~1.20.3 resolution moves from 1.20.4 to 1.20.6, pulling qs from ~6.14.0 to ~6.15.1.

^{Reviewed by Cursor Bugbot for commit 97f7ea0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

yarn.lock

Name	Version	Vulnerability	Severity	Patched Version
@hono/node-server	1.19.17	Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)	moderate	2.0.5

OpenSSF Scorecard

Package	Version	Score	Details
npm/@hono/node-server	1.19.17	Unknown	Unknown
npm/body-parser	1.20.6	🟢 8	Details Check Score Reason Code-Review 🟢 8 Found 12/15 approved changesets -- score normalized to 8 Dependency-Update-Tool 🟢 10 update tool detected Maintained 🟢 10 19 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found SAST 🟢 9 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches CI-Tests 🟢 9 29 out of 30 merged PRs checked by a CI test -- score normalized to 9 Contributors 🟢 10 project has 32 contributing companies or organizations

Scanned Files

• yarn.lock

[Copilot]

Copilot wasn't able to review any files in this pull request.