From 238a419f6b4572e86ebda3ac35cec073fcb13c08 Mon Sep 17 00:00:00 2001
From: Leslie Barry <195984913+LeslieCBarry@users.noreply.github.com>
Date: Thu, 5 Nov 2026 19:53:54 +1100
Subject: [PATCH] fix(deps): pin @hono/node-server 2.1.5 under the MCP SDK
 (GHSA-rmxm-3fg6-px4f)

---
 bun.lock     | 5 ++++-
 package.json | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/bun.lock b/bun.lock
index 0880185ac..67b446fd0 100644
--- a/bun.lock
+++ b/bun.lock
@@ -276,6 +276,9 @@
   ],
   "overrides": {
     "@better-auth/core": "1.7.7",
+    "@modelcontextprotocol/sdk": {
+      "@hono/node-server": "2.1.5",
+    },
     "@nestjs/platform-express": {
       "multer": "2.5.0",
     },
@@ -487,7 +490,7 @@
 
     "@hapi/bourne": ["@hapi/bourne@3.0.0", "", {}, "sha512-Waj1cwPXJDucOib4a3bAISsKJVb15MKi9IvmTI/7ssVEm6sywXGjVJDhl6/umt1pK1ZS7PacXU3A1PmFKHEZ2w=="],
 
-    "@hono/node-server": ["@hono/node-server@2.0.12", "", { "peerDependencies": { "hono": "^4" } }, "sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg=="],
+    "@hono/node-server": ["@hono/node-server@2.1.5", "", { "peerDependencies": { "hono": "^4 || ^5.0.0-0" } }, "sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q=="],
 
     "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
 
diff --git a/package.json b/package.json
index 3e2eb7d28..df491dccb 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,8 @@
 		"eve>undici": "8.12.2",
 		"guarded-fetch>undici": "7.30.1",
 		"@nestjs/platform-express>multer": "2.5.0",
-		"@vercel/cli-config>zod": "4.6.7"
+		"@vercel/cli-config>zod": "4.6.7",
+		"@modelcontextprotocol/sdk>@hono/node-server": "2.1.5"
 	},
 	"catalog": {
 		"vite-plus": "1.3.0"