v4.3.0

FranckyB/Voice-Clone-Studiov4.3.0May 5, 2026by sinewaveai

AI Summary

A critical security update patching multiple vulnerabilities in the Hono framework and GitHub Actions, along with dependency updates.

Key Highlights

Patched 8 Hono CVEs including XSS, path traversal, and authentication bypass.
Fixed critical fail-open vulnerability in GitHub Actions.
Updated Hono, Vite, and Lodash dependencies.
Added 18 new regression tests for critical fixes.

New Features

18 new regression tests

Full Release Notes

## 🔒 Critical Security & Reliability Fixes

### Security Updates
- **CRITICAL:** Fix fail-open vulnerability in GitHub Actions that could bypass security gates (#71)
- **CRITICAL:** Patch 8 Hono CVEs including XSS, path traversal, and authentication bypass (#75, #66, #65, #64, #62)
  - GHSA-69xw-7hcm-h432: HTML injection via unvalidated JSX tag names
  - GHSA-9vqf-7f2p-gf9v: bodyLimit() bypass for chunked requests
  - GHSA-458j-xx4x-4375: Improper JSX attribute name handling
  - GHSA-wmmm-f939-6g9c: Middleware bypass via repeated slashes
  - GHSA-xf4j-xp2r-rqqx: Path traversal in toSSG()
  - GHSA-xpcf-pg52-r92g: IPv4-mapped IPv6 address bypass
  - GHSA-26pp-8wgv-hjvm: Missing cookie name validation
  - GHSA-r5rp-j6wh-rvv4: Cookie prefix bypass

### Bug Fixes
- Fix confidence threshold filtering case sensitivity (#73)
- Fix SARIF generation for GitHub Code Scanning (#72)

### Dependencies
- Update Hono 4.12.7 → 4.12.16
- Update @hono/node-server to 1.19.13
- Update Vite to 7.3.2
- Update Lodash 4.17.23 → 4.18.1
- Update PostCSS, path-to-regexp, picomatch

### Testing
- Add 18 new regression tests for critical fixes
- All 420+ tests passing

**⚠️ Upgrade recommended for production use.**

See [CHANGELOG.md](https://github.com/sinewaveai/agent-security-scanner-mcp/blob/main/CHANGELOG.md#430---2026-05-05) for complete details.

## Installation

```bash
npm install -g agent-security-scanner-mcp@4.3.0
```

## What Changed
- 18 PRs merged (3 critical bug fixes + 15 security dependency updates)
- 100% backward compatible
- No breaking changes