Security fix errors

examples/desktop-counter/package.json

@@ -5,7 +5,7 @@
   "private": true,
   "type": "module",
   "engines": {
-    "node": ">=22 <26"
+    "node": ">=22"
   },
   "main": "dist/desktop/index.js",
   "scripts": {
@@ -25,10 +25,10 @@
     "@cossackframework/renderer": "workspace:*",
     "@cossackframework/ui": "workspace:*",
     "@cossackframework/node-adapter": "workspace:*",
-    "@hono/node-server": "^1.13.0",
-    "@tailwindcss/vite": "^4.1.0",
-    "hono": "^4.12.31",
-    "tailwindcss": "^4.1.0",
+    "@hono/node-server": "^2.0.5",
+    "@tailwindcss/vite": "^4.3.3",
+    "hono": "^4.12.34",
+    "tailwindcss": "^4.3.3",
     "vite": "^8.1.4",
     "ws": "^8.18.0"
   },

packages/auth/package.json

@@ -20,10 +20,10 @@
     "test": "vitest"
   },
   "devDependencies": {
-    "hono": "^4.12.31",
+    "hono": "^4.12.34",
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
-    "hono": "^4.12.0"
+    "hono": "^4.12.34"
   }
 }

packages/core/package.json

@@ -39,14 +39,14 @@
   "devDependencies": {
     "@types/jsdom": "^28.0.3",
     "@types/node": "^22.19.0",
-    "hono": "^4.12.31",
+    "hono": "^4.12.34",
     "jsdom": "^29.1.1",
     "reflect-metadata": "^0.2.2",
     "typescript": "^7.0.2",
     "vite": "^8.1.4",
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
-    "hono": "^4.12.0"
+    "hono": "^4.12.34"
   }
 }

packages/database/package.json

@@ -88,7 +88,7 @@
     "@tursodatabase/database": "^0.7.2",
     "@tursodatabase/serverless": "^1.4.0",
     "better-sqlite3": ">=11",
-    "hono": "^4.12.0",
+    "hono": "^4.12.34",
     "mysql2": ">=3.11",
     "pg": ">=8.13",
     "reflect-metadata": ">=0.2"
@@ -115,7 +115,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.19.0",
-    "hono": "^4.12.31",
+    "hono": "^4.12.34",
     "reflect-metadata": "^0.2.2",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"

packages/deno-adapter/package.json

@@ -20,11 +20,11 @@
   },
   "peerDependencies": {
     "@cossackframework/framework": "workspace:*",
-    "hono": "^4.12.0"
+    "hono": "^4.12.34"
   },
   "devDependencies": {
     "@cossackframework/framework": "workspace:*",
-    "hono": "^4.12.31",
+    "hono": "^4.12.34",
     "typescript": "^7.0.2",
     "vite": "^8.1.4",
     "vitest": "^4.1.10"

packages/desktop/README.md

@@ -47,9 +47,9 @@ An unpacked Forge executable bypasses that desktop entry; launch it with both
 `--no-sandbox` and `--ozone-platform=x11` when testing directly from `out/`.
 The sandbox flag is only appropriate for that uninstalled test package.
 
-Use Node 22 or 24 LTS for Forge packaging. The current Forge/Packager ZIP stack
-can extract Electron pathologically slowly under Node 26; generated Desktop
-projects declare `node: ">=22 <26"` until that upstream combination is fixed.
+Node 22 or 24 LTS is recommended for Forge packaging. Node 26 is supported, but
+the current Forge/Packager ZIP stack can extract Electron pathologically slowly
+there; generated Desktop projects declare `node: ">=22"`.
 
 Use Electron APIs in the bootstrap or through ordinary `@Server()` methods via
 `this.env.COSSACK_DESKTOP`. There is deliberately no renderer client or generic

packages/desktop/docs/guide.md

@@ -67,9 +67,9 @@ for an unpacked app and `desktop:make` for the current host's `.deb`, `.msi`, or
 `.dmg`; installers are not cross-built. Signing and notarization are optional
 until credentials are supplied.
 
-Package with Node 22 or 24 LTS. Electron Packager's current ZIP extraction path
-is extremely slow under Node 26, so generated Desktop manifests temporarily
-declare `node: ">=22 <26"`.
+Node 22 or 24 LTS is recommended for packaging. Node 26 is supported, but
+Electron Packager's current ZIP extraction path is extremely slow there;
+generated Desktop manifests declare `node: ">=22"`.
 
 References: [security checklist](https://www.electronjs.org/docs/latest/tutorial/security),
 [protocol API](https://www.electronjs.org/docs/latest/api/protocol),

packages/framework/package.json

@@ -142,18 +142,18 @@
     "vfile-matter": "^5.0.1",
     "@cloudflare/vite-plugin": "^1.47.0",
     "@playwright/test": "^1.61.1",
-    "@tailwindcss/vite": "^4.1.0",
+    "@tailwindcss/vite": "^4.3.3",
     "@types/mdast": "^4.0.4",
     "cossack": "workspace:*",
-    "hono": "^4.12.31",
+    "hono": "^4.12.34",
     "reflect-metadata": "^0.2.2",
-    "tailwindcss": "^4.1.0",
+    "tailwindcss": "^4.3.3",
     "vite": "^8.1.4",
     "vitest": "^4.1.10",
     "wrangler": "^4.114.0"
   },
   "peerDependencies": {
-    "hono": "^4.12.0",
+    "hono": "^4.12.34",
     "vite": "^8.1.0"
   },
   "engines": {

packages/framework/tests/package-contract.test.ts

@@ -16,7 +16,7 @@ describe('Hono package contract', () => {
       'utf8',
     ));
 
-    expect(packageJson.peerDependencies?.hono).toBe('^4.12.0');
+    expect(packageJson.peerDependencies?.hono).toBe('^4.12.34');
     expect(packageJson.dependencies?.hono).toBeUndefined();
     expect(packageJson.devDependencies?.hono).toMatch(/^\^4\.12\./);
   });
@@ -104,7 +104,7 @@ describe('framework publication contract', () => {
       expect(frameworkPackage.devDependencies).toHaveProperty(name);
     }
     expect(frameworkPackage.peerDependencies).toMatchObject({
-      hono: '^4.12.0',
+      hono: '^4.12.34',
       vite: '^8.1.0',
     });
   });

packages/node-adapter/package.json

@@ -36,12 +36,12 @@
   "devDependencies": {
     "@types/nodemailer": "^8.0.1",
     "@types/ws": "^8.18.0",
-    "hono": "^4.12.31",
+    "hono": "^4.12.34",
     "typescript": "^7.0.2",
     "vite": "^8.1.4",
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
-    "hono": "^4.12.0"
+    "hono": "^4.12.34"
   }
 }

packages/renderer/package.json

@@ -38,6 +38,7 @@
     "css-tree": "^3.2.1"
   },
   "devDependencies": {
+    "happy-dom": "^20.11.1",
     "oxlint": "^1.41.0",
     "typescript": "^7.0.2",
     "vite": "^8.1.4",

packages/renderer/src/minify-html.test.ts

@@ -167,6 +167,28 @@ Line 1
         expect(result).toContain('<div />');
     });
 
+    it('preserves sibling SVG elements whose final attribute precedes a self-closing slash', () => {
+        const input = `<svg xmlns="http://www.w3.org/2000/svg">
+            <circle cx="11.5" cy="11.5" r="9.5"stroke="currentColor" stroke-width="1.5"/>
+            <path d="M18.5 18.5L22 22"stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/>
+        </svg>`;
+        const result = minifyHtml(input);
+
+        expect(result).toContain('stroke-width="1.5"/>');
+        expect(result).toContain('stroke-linecap="round"/>');
+
+        document.body.innerHTML = result;
+        const svg = document.body.querySelector('svg')!;
+        const circle = svg.querySelector('circle')!;
+        const path = svg.querySelector('path')!;
+
+        expect(svg.children).toHaveLength(2);
+        expect(circle.children).toHaveLength(0);
+        expect(circle.getAttribute('stroke-width')).toBe('1.5');
+        expect(path.parentElement).toBe(svg);
+        expect(path.getAttribute('stroke-linecap')).toBe('round');
+    });
+
     it('trims leading and trailing whitespace', () => {
         const input = '   <div>hello</div>   ';
         const result = minifyHtml(input);

packages/renderer/src/minify-html.ts

@@ -23,7 +23,7 @@ const TYPE_JS_CSS = /\s+type\s*=\s*["']text\/(javascript|css)["']/gi;
 // separator. Besides matching the HTML grammar, this prevents malformed
 // third-party markup such as `r="6"stroke="currentColor"` from becoming the
 // substantially worse `r=6stroke=currentColor` during minification.
-const QUOTED_ATTR = /(\w[\w-]*)\s*=\s*["']([a-zA-Z0-9_.-]+)["'](?=\s|\/?>)/g;
+const QUOTED_ATTR = /(\w[\w-]*)\s*=\s*["']([a-zA-Z0-9_.-]+)["'](?=(\s|\/?>))/g;
 
 function preserveBlocks(html: string): { html: string; blocks: string[] } {
     const blocks: string[] = [];
@@ -64,7 +64,14 @@ export function minifyHtml(html: string): string {
     result = result.replace(/>\s+</g, '><');
 
     // Step 6: Remove optional quotes around simple attribute values
-    result = result.replace(QUOTED_ATTR, (_, name, value) => {
+    result = result.replace(QUOTED_ATTR, (match, name, value, separator) => {
+        // In a self-closing tag, `/` is not a delimiter for an unquoted HTML
+        // attribute value. Unquoting the final SVG attribute would turn e.g.
+        // `stroke-width="1.5"/>` into `stroke-width=1.5/>`; the tokenizer then
+        // reads the slash as part of the value and fails to self-close the SVG
+        // element. Keep that final value quoted so sibling SVG nodes retain
+        // their intended structure during the initial server render.
+        if (separator === '/>') return match;
         return `${name}=${value}`;
     });
 

packages/scaffold/package.json

@@ -37,13 +37,13 @@
       "@tursodatabase/serverless": "^1.4.0",
       "@cossackframework/solar-icons": "^0.7.1",
       "@cossackframework/studio": "^0.8.1",
-      "@hono/node-server": "^1.13.0",
-      "@tailwindcss/vite": "^4.1.0",
+      "@hono/node-server": "^2.0.5",
+      "@tailwindcss/vite": "^4.3.3",
       "@types/node": "^22.0.0",
       "@types/mdast": "^4.0.4",
       "@types/pg": "^8.15.5",
       "@types/ws": "^8.18.0",
-      "hono": "^4.12.31",
+      "hono": "^4.12.34",
       "electron": "^43.3.0",
       "mysql2": "^3.14.3",
       "pg": "^8.16.3",
@@ -57,7 +57,7 @@
       "remark-rehype": "^11.1.2",
       "remark-sugar-high": "^0.6.3",
       "remark-toc": "^9.0.0",
-      "tailwindcss": "^4.1.0",
+      "tailwindcss": "^4.3.3",
       "tsx": "^4.23.0",
       "unified": "^11.0.5",
       "vite": "^8.1.4",

packages/scaffold/src/index.js

@@ -578,7 +578,7 @@ function packageJson(recipe, projectName) {
     name: projectName,
     version: '0.1.0',
     type: 'module',
-    ...(recipe.resolvedFeatures.includes('desktop') ? { engines: { node: '>=22 <26' } } : {}),
+    ...(recipe.resolvedFeatures.includes('desktop') ? { engines: { node: '>=22' } } : {}),
     description: 'The Borderless TypeScript Framework',
     cossack: { runtime: recipe.adapter },
     scripts,

packages/scaffold/tests/scaffold.test.js

@@ -695,7 +695,7 @@ describe('composition', () => {
       expect(targetPackage.devDependencies.electron).toBeDefined();
       expect(targetPackage.devDependencies['@electron-forge/cli']).toBeDefined();
       expect(targetPackage.main).toBe('dist/desktop/index.js');
-      expect(targetPackage.engines.node).toBe('>=22 <26');
+      expect(targetPackage.engines.node).toBe('>=22');
       expect(targetPackage.scripts['build:desktop']).toContain('src/desktop/index.ts');
       expect(targetPackage.scripts['build:desktop']).toContain('--mode desktop');
       expect(targetPackage.scripts['desktop:dev']).toBe('cossack-desktop');

packages/studio/package.json

@@ -35,18 +35,18 @@
     "@cossackframework/renderer": "workspace:*",
     "@cossackframework/solar-icons": "^0.7.1",
     "@cossackframework/ui": "workspace:*",
-    "hono": "^4.12.31",
+    "hono": "^4.12.34",
     "prompts": "^2.4.2",
     "reflect-metadata": "^0.2.2"
   },
   "devDependencies": {
     "@tursodatabase/database": "^0.7.2",
     "@tursodatabase/serverless": "^1.4.0",
     "@playwright/test": "^1.61.1",
-    "@tailwindcss/vite": "^4.1.0",
+    "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^22.19.0",
     "monaco-editor": "^0.52.2",
-    "tailwindcss": "^4.1.0",
+    "tailwindcss": "^4.3.3",
     "typescript": "^7.0.2",
     "tsx": "^4.23.0",
     "vite": "^8.1.4",