[finalerock44]

pnpm audit flagged GHSA-5r4p-p66f-jhc7 (moderate) on hono >=4.12.4 <4.13.11, which comes in through @modelcontextprotocol/sdk. In those versions serveStatic decodes the request path twice. The advisory was published on 2026-10-20, after dev's last green run, so the lint-and-test audit step now fails on every branch. Dependabot opened an alert but no fix PR, because the exact-pin override holds hono at 4.13.7.

4.13.11 is the lowest patched version, as with the earlier pins. The audit passes apart from the advisory that was already ignored. Lint, typecheck, unit tests and build pass, and dcd-mcp answers initialize and tools/list over stdio with all five tools.

What & why

Type of change

• fix — bug fix
• feat — new feature
• perf — performance improvement
• refactor — code change that's neither a fix nor a feature
• docs — documentation only
• chore / ci / build / test — tooling, no user-facing change
• Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

• PR title follows the Conventional Commits format (see comment above)
• pnpm lint passes
• pnpm typecheck passes
• pnpm build passes
• I have not bumped the version or edited CHANGELOG.md (release-please handles this)
• I have signed the CLA (the bot will prompt on first contribution)
• Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

This PR only bumps the hono pnpm override from 4.13.7 to 4.13.11, the lowest version patched for GHSA-5r4p-p66f-jhc7. Every pnpm-lock.yaml entry that mentions hono matches the new override: the override key, the @hono/node-server peer, the @modelcontextprotocol/sdk snapshot, and the package resolution. The change doesn't touch the version, the CHANGELOG or the generated files, and the chore(deps): title doesn't trigger a release bump. Because it's this small, I skipped the full multi-agent review.

🤖 Generated with Claude Code