From 794b0b01aacfc3bf6e7726d10069cb55855cffb2 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Tue, 28 Jul 2026 09:05:29 -0400 Subject: [PATCH] fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x, clearing the last two runtime advisories @hono/node-server is not a direct dependency. it is pinned by @modelcontextprotocol/sdk, which declared ^1.19.9 through 1.29.0, so forcing 2.x onto the old sdk would mean overriding a dependency own declared range. that is the shape claude-workstation#554 documents, where a patched version broke its consumer while npm audit reported zero vulnerabilities and 195 of 195 tests passed. sdk 1.30.0, published 2026-07-27, widened the range to ^1.19.9 || ^2.0.5. the root already declares ^1.0.0, so both moves are reachable with npm update --package-lock-only and no manifest edit. the peer @modelcontextprotocol/sdk ^1.29.0 from @anthropic-ai/claude-agent-sdk is still satisfied. @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 @hono/node-server 1.19.14 -> 2.0.12 audit, dev scope included: main 7 (3 high, 2 mod), here 5 (3 high, 0 mod). both moderates clear, since the sdk was only ever flagged transitively via @hono/node-server. this repo has no test suite (#64), so a green build proves nothing about runtime. spawned the built binary over stdio and completed a real MCP handshake: initialize returns wave-mcp-server protocol 2025-06-18 and tools/list still enumerates all 18 tools. src/server.ts imports only StdioServerTransport, so node-server sits off this code path entirely. build, tsc --noEmit and eslint all clean. CI cannot run. --- package-lock.json | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5eb3c07..dae2127 100644 --- a/package-lock.json +++ b/package-lock.json @@ -770,12 +770,12 @@ } }, "node_modules/@hono/node-server": { - "version": "1.19.14", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz", - "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==", + "version": "2.0.12", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.12.tgz", + "integrity": "sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==", "license": "MIT", "engines": { - "node": ">=18.14.1" + "node": ">=20" }, "peerDependencies": { "hono": "^4" @@ -887,12 +887,12 @@ } }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.29.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz", - "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==", + "version": "1.30.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", + "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", "license": "MIT", "dependencies": { - "@hono/node-server": "^1.19.9", + "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5",