[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server	2.1.3 → 2.1.6

---

Release Notes

honojs/node-server (@​hono/node-server)

v2.1.6

Compare Source

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

---

The backslash fix also ships in @hono/node-server v1.19.18. Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.1.5

Compare Source

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in #​404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in #​405

New Contributors

• @​affanmomin made their first contribution in #​404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

Compare Source

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in #​406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[jerelvelarde]

Reviewed 53b63f98a3991cd819dfd879b9a2fa79d6d83d36 with an independent Codex Astra review and local run. This is useful, bounded HTTP-adapter maintenance: upstream request handling, static-method and cancellation fixes, with no new dependency or application configuration. Package bytes match the lockfile and official registry; no actionable security or alignment blocker found in the reviewed scope.

Current-main integration passes formatting, lint, typecheck, all 351 tests and client/server builds. The installed 2.1.6 adapter also passes synthetic body, streaming, static-method and cancellation checks. No live-provider or production run was used. Ready for merge with the current green CI.