From d9a2c2cbe48103a57ffa5db54cd8b2144bd1d6bf Mon Sep 17 00:00:00 2001 From: idapixl Date: Thu, 9 Jul 2026 09:23:32 -0700 Subject: [PATCH] fix(deps): bump transitive hono to patch high-sev vulnerabilities hono <=4.12.24 (peerDependency of @modelcontextprotocol/sdk, range ^4.11.4) was resolved to the vulnerable 4.12.23 in the lockfile. GitHub's dependency graph never generated a Dependabot alert for it (same blind spot found in tools-graph on 2026-07-06). npm audit fix resolves it in-range to 4.12.28. Co-Authored-By: Claude Sonnet 5 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index f30f0df..3dbb9f1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -860,9 +860,9 @@ } }, "node_modules/hono": { - "version": "4.12.23", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.23.tgz", - "integrity": "sha512-eIaZ9qDgu7XV0pxOCrg7/WhnQ6Ivm22UcxhXx/A3dcbqbbYgBEkc6e/J/s7j2tS96zoB0S9VBdLwQNCWwUo4LA==", + "version": "4.12.28", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz", + "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==", "dev": true, "license": "MIT", "engines": {