5 npm advisories (4 high) that npm reports as unfixable are all reachable by widening declared ranges #2850

A clean install of [email protected] reports 5 advisories, and npm audit marks every one fixAvailable: false:

[MODERATE] @hono/node-server <2.0.5   serve-static path traversal on Windows via encoded backslash (%5C)  GHSA-frvp-7c67-39w9
[HIGH]     adm-zip <0.6.0             crafted ZIP triggers 4GB allocation                                 GHSA-xcpc-8h2w-3j85
[HIGH]     sharp <0.35.0              inherited libvips CVEs (CVE-2026-33327/33328/35590/35591)           GHSA-f88m-g3jw-g9cj
[HIGH]     onnxruntime-node           via adm-zip
[HIGH]     hyperframes                aggregates the above

fixAvailable: false here does not mean no fix exists — patched releases exist for all of them. It means they sit outside the ranges packages/cli declares (@hono/node-server ^1.8.0, adm-zip ^0.5.16, sharp ^0.34.5), so npm cannot reach them.

They are compatible — tested

Consumer-side overrides reach the patched versions:

"overrides": {
  "@hono/node-server": "^2.0.5",
  "adm-zip": "^0.6.0",
  "sharp": "^0.35.0"
}

Result: npm audit → 0 vulnerabilities, resolving to @hono/node-server 2.0.12, adm-zip 0.6.0, sharp 0.35.3 (onnxruntime-node 1.23.2 stops inheriting the adm-zip advisory).

Nothing broke. Verified with a full workflow run on a real project — a 14s 1080×1920 composition with a timed <video>, a timed <audio> master track, GSAP camera moves and 7 tracks:

Why it is worth doing upstream

Because they resolve cleanly, this looks like it just needs the declared ranges widened in packages/cli/package.json rather than any code change. Right now every downstream project starts with 4 high advisories and the standard remediation (npm audit fix) cannot help, so each consumer has to rediscover the override trick.

The @hono/node-server one has the sharpest edge for Windows users specifically: it is a serve-static path traversal via encoded backslash, and hyperframes preview is exactly that server, bound locally while an agent drives a browser against it.

Happy to open a PR bumping the ranges if that is useful.