liteagents 2.15.1 → 2.15.3

package/CHANGELOG.md

@@ -15,6 +15,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Enhanced testing capabilities
 - Performance optimizations
 
+## [2.15.3] - 2026-08-04
+
+### Security
+- Merges Dependabot #29/#28: hono 4.13.0 (closes residual moderate ReDoS,
+  GHSA-8j4g-w8fx-2239), ip-address 10.4.0 (3 high SSRF/trust-boundary
+  advisories). Also applies `npm audit fix` for fast-uri 3.1.5 (high,
+  GHSA-7p8r-x3mc-p8w7) — flagged by audit but not yet proposed as a
+  separate Dependabot PR. Transitive deps of the bundled live-canvas-channel
+  plugin's MCP SDK; unreachable in its stdio server. Plugin audit: 3 → 0
+  vulnerabilities. 138 root tests green.
+
+## [2.15.2] - 2026-07-24
+
+### Security
+
+- **Cleared the last plugin audit finding via an `overrides` pin: `@hono/node-server` → 2.0.11.** The advisory [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9) (moderate, Windows-only serve-static path traversal) is patched only in `@hono/node-server@2.0.5`+ — a **major** bump. The plugin's `@modelcontextprotocol/sdk@1.29.0` (latest) pins `@hono/node-server: ^1.19.9`, a `1.x` range that can never resolve to the fix, so `npm audit fix` couldn't clear it (upstream tracked in [modelcontextprotocol/typescript-sdk#2531](https://github.com/modelcontextprotocol/typescript-sdk/issues/2531), still open). Added the community-confirmed `overrides` block to the plugin's `package.json` forcing `@hono/node-server` to `^2.0.11` within the SDK subtree. Plugin `npm audit` is now **0 findings**. The path was already unreachable here (stdio server, no `@hono/node-server`/HTTP-transport usage); this just removes the audit noise. Note: `@hono/node-server@2.x` needs Node 20+, but the plugin never loads it, so its own `>=18` runtime floor is unchanged. 138 root tests green; remove the override once the SDK widens its range.
+
 ## [2.15.1] - 2026-07-24
 
 ### Security

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liteagents",
-  "version": "2.15.1",
+  "version": "2.15.3",
   "description": "AI development toolkit with 11 specialized agents and 17 commands including live-canvas UI design with click-to-annotate feedback. Simple one-question installer for Claude, Opencode, Ampcode, and Droid.",
   "main": "index.js",
   "bin": {

package/packages/claude/plugins/live-canvas-marketplace/plugins/live-canvas-channel/package-lock.json

@@ -16,12 +16,12 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.14",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
-      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.11.tgz",
+      "integrity": "sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==",
       "license": "MIT",
       "engines": {
-        "node": ">=18.14.1"
+        "node": ">=20"
       },
       "peerDependencies": {
         "hono": "^4"
@@ -448,9 +448,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "funding": [
         {
           "type": "github",
@@ -585,9 +585,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.31",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.31.tgz",
-      "integrity": "sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
+      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -636,9 +636,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"

package/packages/claude/plugins/live-canvas-marketplace/plugins/live-canvas-channel/package.json

@@ -13,5 +13,10 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
+  "overrides": {
+    "@modelcontextprotocol/sdk": {
+      "@hono/node-server": "^2.0.11"
+    }
+  },
   "license": "MIT"
 }