claude-threads 1.17.1 → 1.17.2

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.17.2] - 2026-06-19
+
+### Security
+- **`@hono/node-server` 2.0.4 → 2.0.5** to resolve GHSA-frvp-7c67-39w9: on Windows, prefix-mounted Serve Static middleware could be bypassed. Only affects Windows deployments using Serve Static. (#408)
+
+### Dependencies
+- **Production:** `hono` 4.12.25 → 4.12.26, `semver` 7.8.1 → 7.8.4. (#408)
+- **Dev:** `@types/node` 25.9.1 → 25.9.3, `@types/react` 19.2.16 → 19.2.17, `eslint` 10.4.1 → 10.5.0, `prettier` 3.8.3 → 3.8.4, `typescript-eslint` 8.60.1 → 8.61.1. (#409)
+
 ## [1.17.1] - 2026-06-19
 
 ### Fixed

package/dist/index.js

@@ -7203,6 +7203,18 @@ var require_semver = __commonJS((exports, module) => {
   var { safeRe: re, t } = require_re();
   var parseOptions = require_parse_options();
   var { compareIdentifiers } = require_identifiers();
+  var isPrereleaseIdentifier = (prerelease, identifier) => {
+    const identifiers = identifier.split(".");
+    if (identifiers.length > prerelease.length) {
+      return false;
+    }
+    for (let i2 = 0;i2 < identifiers.length; i2++) {
+      if (compareIdentifiers(prerelease[i2], identifiers[i2]) !== 0) {
+        return false;
+      }
+    }
+    return true;
+  };
 
   class SemVer {
     constructor(version, options) {
@@ -7442,8 +7454,9 @@ var require_semver = __commonJS((exports, module) => {
             if (identifierBase === false) {
               prerelease = [identifier];
             }
-            if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
-              if (isNaN(this.prerelease[1])) {
+            if (isPrereleaseIdentifier(this.prerelease, identifier)) {
+              const prereleaseBase = this.prerelease[identifier.split(".").length];
+              if (isNaN(prereleaseBase)) {
                 this.prerelease = prerelease;
               }
             } else {
@@ -8032,6 +8045,7 @@ var require_range = __commonJS((exports, module) => {
     return comp;
   };
   var isX = (id) => !id || id.toLowerCase() === "x" || id === "*";
+  var invalidXRangeOrder = (M, m, p) => isX(M) && !isX(m) || isX(m) && p && !isX(p);
   var replaceTildes = (comp, options) => {
     return comp.trim().split(/\s+/).map((c) => replaceTilde(c, options)).join(" ");
   };
@@ -8091,9 +8105,9 @@ var require_range = __commonJS((exports, module) => {
         debug("no pr");
         if (M === "0") {
           if (m === "0") {
-            ret = `>=${M}.${m}.${p}${z} <${M}.${m}.${+p + 1}-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${m}.${+p + 1}-0`;
           } else {
-            ret = `>=${M}.${m}.${p}${z} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${+m + 1}.0-0`;
           }
         } else {
           ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -8112,6 +8126,9 @@ var require_range = __commonJS((exports, module) => {
     const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
     return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
       debug("xRange", comp, ret, gtlt, M, m, p, pr);
+      if (invalidXRangeOrder(M, m, p)) {
+        return comp;
+      }
       const xM = isX(M);
       const xm = xM || isX(m);
       const xp = xm || isX(p);

package/dist/mcp/mcp-server.js

@@ -12269,6 +12269,18 @@ var require_semver = __commonJS((exports, module) => {
   var { safeRe: re, t } = require_re();
   var parseOptions = require_parse_options();
   var { compareIdentifiers } = require_identifiers();
+  var isPrereleaseIdentifier = (prerelease, identifier) => {
+    const identifiers = identifier.split(".");
+    if (identifiers.length > prerelease.length) {
+      return false;
+    }
+    for (let i = 0;i < identifiers.length; i++) {
+      if (compareIdentifiers(prerelease[i], identifiers[i]) !== 0) {
+        return false;
+      }
+    }
+    return true;
+  };
 
   class SemVer {
     constructor(version3, options) {
@@ -12508,8 +12520,9 @@ var require_semver = __commonJS((exports, module) => {
             if (identifierBase === false) {
               prerelease = [identifier];
             }
-            if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
-              if (isNaN(this.prerelease[1])) {
+            if (isPrereleaseIdentifier(this.prerelease, identifier)) {
+              const prereleaseBase = this.prerelease[identifier.split(".").length];
+              if (isNaN(prereleaseBase)) {
                 this.prerelease = prerelease;
               }
             } else {
@@ -13098,6 +13111,7 @@ var require_range = __commonJS((exports, module) => {
     return comp;
   };
   var isX = (id) => !id || id.toLowerCase() === "x" || id === "*";
+  var invalidXRangeOrder = (M, m, p) => isX(M) && !isX(m) || isX(m) && p && !isX(p);
   var replaceTildes = (comp, options) => {
     return comp.trim().split(/\s+/).map((c) => replaceTilde(c, options)).join(" ");
   };
@@ -13157,9 +13171,9 @@ var require_range = __commonJS((exports, module) => {
         debug("no pr");
         if (M === "0") {
           if (m === "0") {
-            ret = `>=${M}.${m}.${p}${z2} <${M}.${m}.${+p + 1}-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${m}.${+p + 1}-0`;
           } else {
-            ret = `>=${M}.${m}.${p}${z2} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.${p} <${M}.${+m + 1}.0-0`;
           }
         } else {
           ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -13178,6 +13192,9 @@ var require_range = __commonJS((exports, module) => {
     const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE];
     return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
       debug("xRange", comp, ret, gtlt, M, m, p, pr);
+      if (invalidXRangeOrder(M, m, p)) {
+        return comp;
+      }
       const xM = isX(M);
       const xm = xM || isX(m);
       const xp = xm || isX(p);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",
@@ -63,7 +63,7 @@
     "package.json"
   ],
   "dependencies": {
-    "@hono/node-server": "2.0.4",
+    "@hono/node-server": "2.0.5",
     "@inkjs/ui": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "@redactpii/node": "^1.0.16",
@@ -71,13 +71,13 @@
     "commander": "^14.0.2",
     "diff": "^8.0.3",
     "express-rate-limit": "^8.3.0",
-    "hono": "4.12.25",
+    "hono": "4.12.26",
     "ink": "^6.6.0",
     "ink-scroll-view": "^0.3.5",
     "js-yaml": "^4.1.1",
     "prompts": "^2.4.2",
     "react": "^19.2.3",
-    "semver": "7.8.1",
+    "semver": "7.8.4",
     "update-notifier": "^7.3.1",
     "ws": "8.21.0",
     "zod": "^4.3.6"