fix(deps): take the published fixes for @hono/node-server, qs and systeminformation, and drop the unused sprintf-js exemption (#27960)

<!-- claude-projects-attribution: {"github_login":"os-elon-musk"} -->
_Requested by **Elon** · [project
thread](https://claude.ai/code/project/chan_01WedDzV26nniwxv7jC88B9D?thread=cmsg_01WedDzV26nniwxv7jC88B9DDVkMBvjmXGUmUEnJj9ZYUV)_
Part of #27921
Clause-②: no
Metadata-protocol: none
Skills-docs: none — no page under `skills/**` or `content/docs/**` pins
the `@hono/node-server`, `qs` or `systeminformation` version (git grep:
zero hits).

Five of the six advisories that keep the daily OSV scan red move to
their patched releases, and the unused `GHSA-hp3w-g68c-fv3c` exemption
leaves the ledger. The sixth, `deepmerge` GHSA-gcqx-w48m-w2h4, has no
fixed release; this PR does not exempt it. Two ways to clear it are
below, for the maintainer to choose. That is why this PR says `Part of`
and leaves the card open: the scheduled scan stays red on `deepmerge`
alone until one of them lands.

## 维护者速读

- 改了什么：`@hono/node-server` 升到 `^2.1.3`（实装 2.1.5），`qs` 升到
6.17.1，`systeminformation` 升到 5.33.18；删掉 `osv-scanner.toml` 里已无用的
sprintf-js 豁免。
- 为什么改：每日依赖漏洞扫描已连红 5 天，6 条公开公告里 5 条有修复版；其中 `@hono/node-server` 是
plugin-hono-server 发给用户的运行时依赖。
- 风险与回滚：只是补丁/小版本升级，lockfile 只动这三个包，API 不变；回滚即 revert 本 PR。
- 先看：`pnpm-workspace.yaml`（两条 override 只抬
target）、`pnpm-lock.yaml`、`osv-scanner.toml`。
- 两分钟验证：`pnpm audit` 只剩 deepmerge（low）与已豁免的 @azure/msal-node 两条。
- 需要你做的：定 deepmerge 的去向（A 单独开豁免 PR，或 B 去掉 @object-ui/components 未被使用的
shadcn 开发依赖），见下文；本 PR 本身由席位落地。

## What changes

| Package | Was | Now | Advisory | How |
|:--|:--|:--|:--|:--|
| `@hono/node-server` | 2.1.1 | 2.1.5 | GHSA-rmxm-3fg6-px4f (moderate) |
`^2.1.1` → `^2.1.3` in `packages/plugins/plugin-hono-server`
(dependency) and `packages/client` (devDependency); override target
`'@hono/node-server@<3.0.0'` lifted `^2.0.10` → `^2.1.3` |
| `qs` | 6.16.0 | 6.17.1 | GHSA-6pq8-jhm2-2vcw (moderate) | override
target `'qs@>=6.0.0 <7.0.0'` lifted `^6.16.0` → `^6.16.1` |
| `systeminformation` | 5.33.1 | 5.33.18 | GHSA-3f7j-7jwc-fxfj (high),
GHSA-7648-jmwf-vw7j (moderate), GHSA-4vjg-vx72-qq4g (low) | lockfile
refresh inside `@dotenvx/dotenvx`'s own `^5.22.11` |

- **Why the two overrides move, not root `package.json`.** pnpm 10 reads
`overrides` only from `pnpm-workspace.yaml`. Both packages were already
governed there, so each lift moves only the target and keeps the
selector at the major boundary, per that block's header rule, with a
dated note beside the existing one. Without the `@hono/node-server`
lift, the override would keep rewriting our two declarations to
`^2.0.10`. Without the `qs` lift, express@4.22.2 (under
`@object-ui/cli`) declares `~6.15.1`, a line with no patched release.
- **systeminformation needs no override.** Its one parent,
`@dotenvx/dotenvx` 1.75.1 (under `shadcn`), declares `^5.22.11`, which
admits 5.33.18. A bare `pnpm update systeminformation -r --depth
Infinity` re-resolved unrelated packages (the `@inquirer/*` family,
`seroval`, `type-fest`, `rettime`, `set-cookie-parser`) and dropped
`knex`'s `mysql2`/`pg`/`tedious` peer variant, so it was not used. The
lockfile here was written by pnpm in two installs: one with a temporary
`systeminformation` override, one without it. The committed
`pnpm-workspace.yaml` has no such entry. `pnpm install
--frozen-lockfile` passes on the result.
- **The resolved package set changes in exactly these three packages**
(diff of every `packages:` key before and after). Nothing else moves.
- **`GHSA-hp3w-g68c-fv3c` is removed from `osv-scanner.toml`.** The
scheduled scan reports it unused. `pnpm audit` on the same lockfile does
not match `sprintf-js` either, although 1.1.3 still resolves (through
tedious and fengari). Per the ledger's convention 3, removing an
exemption may ride along with a fix.
- **Changeset:** `@objectstack/plugin-hono-server` and
`@objectstack/client`, patch.

## `deepmerge` GHSA-gcqx-w48m-w2h4: awaiting the maintainer's decision

No fixed release exists. 4.3.1 is the latest (published 2023-03-16) and
the advisory covers `>=4.2.0 <=4.3.1`.

**Reach, measured with `pnpm why -r deepmerge`:** one copy, 4.3.1,
through `shadcn` 4.22.1 and its `@shadcn/registry` 0.2.0. Both declare
`^4.3.1`, and so do the latest releases (shadcn 4.23.0,
`@shadcn/registry` 0.2.1). `shadcn` is a **devDependency** of
`@object-ui/components`, so the path is dev-only: no published package
installs it downstream. `systeminformation` came in through the same
`shadcn` path. Nothing in the tree imports `shadcn` or runs its binary:
git grep finds no import, require, `.bin/shadcn` or `pnpm exec`/`dlx
shadcn`. The `pnpm shadcn:*` scripts run `ui/scripts/shadcn-sync.js`,
and `ui/.mcp.json` launches `shadcn@latest` through npx, not this
devDependency.

- **A. An exemption in its own PR.** Per the ledger's convention 3, an
exemption never rides in a dependency-bump PR, so it is **not** in this
diff. The proposed entry, in the style of the `GHSA-xcx6-jx8p-x3h5`
reason:

  ```toml
  [[IgnoredVulns]]
  id = "GHSA-gcqx-w48m-w2h4"
  ignoreUntil = 2026-11-29
reason = "GHSA-gcqx-w48m-w2h4 — no fixed
deepmerge exists (4.3.1, the latest release, is the last affected
version), and it arrives only through shadcn 4.22.1 and @shadcn/registry
0.2.0, whose latest releases (shadcn 4.23.0, @shadcn/registry 0.2.1)
still require ^4.3.1; shadcn is a devDependency of @object-ui/components
(dev tree only) that nothing in the tree imports or runs; remove when
deepmerge publishes a fix or shadcn leaves the tree."
  ```

- **B. Remove the parent.** Drop the `shadcn` devDependency from
`ui/packages/components/package.json`. That removes `deepmerge` and
`systeminformation` from the tree, and no exemption is needed. It is a
`domain:ui` file outside this card's file surface, so it would be a
separate card, where the ui lane confirms nobody runs the CLI from that
install.

Recommendation, as input to the maintainer's decision and not a ruling:
B, because the ledger's intended steady state is zero exemptions and
nothing in the tree uses the dependency. A is the stopgap if the
scheduled scan must go green before B lands. Not decided here.

## Tests

No source changes. At head `29248fc312` (main `ed0e71db94` merged in),
under the container's verify lock with
`NODE_OPTIONS=--max-old-space-size=4096`, each package whose manifest
moved was tested and typechecked after a full build:

- `pnpm build` (115 of 115 turbo tasks): exit 0.
- `pnpm --filter @objectstack/plugin-hono-server test`: 35 test files,
448 tests, all pass.
- `pnpm --filter @objectstack/client test`: 52 test files, 680 tests,
all pass.
- `pnpm --filter @objectstack/plugin-hono-server typecheck` and `pnpm
--filter @objectstack/client typecheck`: exit 0.

No tested behaviour changed, so there is no ablation.

## Acceptance notes

- **The card's premise needed one correction.** `packages/client`
declares `@hono/node-server` as a devDependency, not a shipped
dependency, and no source or test file in `packages/client` imports it.
It moves in lockstep so the two declarations agree with the override
target. `plugin-hono-server` is the shipped one.
- **The dispatch named the root `package.json` `pnpm.overrides` for any
override.** pnpm 10 ignores that block, so the lifts went to
`pnpm-workspace.yaml`. The seat amended the claim's file surface to
match before the push.
- **`@azure/msal-node` GHSA-xcx6-jx8p-x3h5** still matches and stays
covered by its existing exemption, which expires 2026-11-26. Unchanged
here.
- **The OSV-Scanner binary could not run in the authoring container**
(the download was refused and `api.osv.dev` is not reachable from it).
The before and after readings use `pnpm audit`, which reads the same
lockfile against the GitHub advisory database that OSV ingests. This
PR's `Validate Package Dependencies` check runs the pinned scanner
(v2.5.0 image), base-relative. The card's final reading is the next
scheduled run.

## Verification

`pnpm audit --json`, pnpm 10.31.0, lockfile only:

| | high | moderate | low | advisories |
|:--|--:|--:|--:|:--|
| `main` `e41642dd2` | 2 | 3 | 2 | the card's six, plus
`@azure/msal-node` (exempted) |
| this branch | 1 | 0 | 1 | `@azure/msal-node` (exempted), `deepmerge`
(A or B above) |

- `dispatch-gates --commands`: 65 derived families, all run, all exit 0,
reconciled by `--ran` (65 run, 0 not measured, 0 unrun).
`check:dual-build-cjs-loads` and `check:skill-examples` need every
package's `dist`, so they ran after the full build.
- `pnpm lint`: exit 0.
- `node scripts/check-osv-exemptions.mjs --self-test` and `node
scripts/check-osv-exemptions.mjs`: exit 0.
- `pnpm check:override-consistency` and `pnpm
check:vendor-export-contract-resolve`: exit 0 (both are in the derived
set).
- `node scripts/check-commit-card-trailers.mjs --range
origin/main..HEAD`: exit 0.
- `pnpm install --frozen-lockfile`: exit 0. `pnpm install
--lockfile-only` after the last merge of `main` rewrites
`pnpm-lock.yaml` byte-identical, so the merged lockfile is the one pnpm
writes.
- The resolved package set against `main` `ed0e71db94` differs in
exactly `@hono/node-server`, `qs` and `systeminformation`.

CI on this PR runs the pinned OSV-Scanner base-relative. The gate run
above was at head `29248fc312`.

## Human Minimum

- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(not touched)
- [x] 2. Every name I added uses the casing for its kind. (no names
added)
- [x] 3. No formatter ran; `pnpm lint` passes.
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request.
- [x] 5. A change that publishes carries a changeset, and both
declaration lines are filled in here and in the changeset.
- [x] 6. `packages/spec` touched: its generated artifacts are
regenerated and committed. (not touched)
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English.
- [x] The *Before Submitting* list in CONTRIBUTING.md is done.

---
_Generated by [Claude
Code](https://claude.ai/code/session_016WV4d1258HZ753L165zExJ)_

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_016WV4d1258HZ753L165zExJ

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/27921-hono-node-server-advisory.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/plugin-hono-server': patch
+'@objectstack/client': patch
+---
+
+fix(deps): `@hono/node-server` goes to `^2.1.3`, the first release with the GHSA-rmxm-3fg6-px4f fix (#27921)
+
+Clause-②: no
+Metadata-protocol: none
+
+`@objectstack/plugin-hono-server` declares `@hono/node-server` as a runtime dependency, so a downstream install now resolves the patched line instead of an affected `2.1.1`. `@objectstack/client` declares the same range as a devDependency and moves in lockstep. No API, behaviour or export changes.

osv-scanner.toml

@@ -85,11 +85,6 @@
 # Verify locally:  node scripts/check-osv-exemptions.mjs
 # Prove the check: node scripts/check-osv-exemptions.mjs --self-test
 
-[[IgnoredVulns]]
-id = "GHSA-hp3w-g68c-fv3c"
-ignoreUntil = 2026-11-05
-reason = "https://github.com/advisories/GHSA-hp3w-g68c-fv3c — no fixed sprintf-js exists (1.1.3, the latest release, is the last affected version), and it arrives only transitively through tedious 18.6.2 (driver-sql's optional mssql peer) and fengari 0.1.5 (under ioredis-mock, a service-cluster-redis devDependency), whose latest releases (tedious 20.3.3, fengari 0.1.5) still require ^1.1.3; remove when sprintf-js publishes a fix or both parents drop it."
-
 [[IgnoredVulns]]
 id = "GHSA-xcx6-jx8p-x3h5"
 ignoreUntil = 2026-11-26

packages/client/package.json

@@ -33,7 +33,7 @@
     "@objectstack/spec": "workspace:*"
   },
   "devDependencies": {
-    "@hono/node-server": "^2.1.1",
+    "@hono/node-server": "^2.1.3",
     "@objectstack/driver-sqlite-wasm": "workspace:*",
     "@objectstack/hono": "workspace:*",
     "@objectstack/metadata-core": "workspace:*",

packages/plugins/plugin-hono-server/package.json

@@ -26,7 +26,7 @@
     "check:test-typecheck": "tsx ../../../scripts/check-test-typecheck.mts --self-test && tsx ../../../scripts/check-test-typecheck.mts --package packages/plugins/plugin-hono-server --project tsconfig.test.json"
   },
   "dependencies": {
-    "@hono/node-server": "^2.1.1",
+    "@hono/node-server": "^2.1.3",
     "@objectstack/core": "workspace:*",
     "@objectstack/observability": "workspace:*",
     "@objectstack/spec": "workspace:*",