DeepADB v1.1.3

DeepADB v1.1.3 — Transitive Dependency Security & CI Hardening

Security patch release. Dependency lockfile, CI configuration, and test/docs files only — no tool, API, or behavior changes. Still 204 tools across 45 modules.

Security — transitive hono (4 advisories)

Bumped the transitive hono dependency 4.12.18 → 4.12.23 (the fixes landed in 4.12.21). hono is pulled in only by @modelcontextprotocol/sdk@1.29.0, whose ^4.11.4 range already permitted the patched version, so this is a lockfile refresh — no SDK or API change, and hono is not imported anywhere in DeepADB's own source.

Advisories cleared (all fixed at 4.12.21):

• HTTP request smuggling via app.mount — percent-encoded multi-byte characters in the request path could route to unintended sub-application routes.
• ipRestriction IPv6 deny-rule bypass — non-canonical IPv6 forms (compressed / explicit-zero representations) skipped configured deny rules.
• jwt middleware authorization bypass — a valid JWT presented under any Authorization scheme, not just Bearer, was accepted.
• Cookie HTTP response-splitting via serialize — crafted sameSite / priority values could inject attributes into the Set-Cookie header.

DeepADB's published transport is stdio (see server.json), so the HTTP routing and middleware paths these advisories concern are outside the default configuration; the dependency is patched regardless.

Also included (previously unreleased)

• CI supply-chain hardening — Dependabot cooldown windows (7-day npm/Actions, 30-day npm majors), npm ci --ignore-scripts on all CI installs, and full SHA-pinning of GitHub Actions.
• Device-free CI fixes — four assertions now tolerate the ubuntu-latest state where adb is installed but non-functional (no device/server).

Install

npm install -g deepadb@1.1.3

Verification

• Build: clean (zero errors, zero warnings).
• Device-free suite: 148 passed, 0 failed, 0 skipped (boundaries, result-handles, sanitizer-fuzz, supply-chain, transports).

Full details in CHANGELOG.md.