[campaign] Security Alert Burndown: Dependabot bundle — Node.js — /.github/workflows/package.json (2026-01-30)

[github-actions]

Context

This issue tracks one Dependabot PR bundle discovered by the Security Alert Burndown campaign.

Bundle

• Runtime: Node.js
• Manifest: /.github/workflows/package.json

Bundling Rules

• Group work by runtime. Never mix runtimes.
• Group changes by target dependency file (one manifest + its lockfile).
• Patch/minor updates may be bundled; major updates should be isolated unless tightly coupled.
• Bundled releases must include a research report (packages, versions, breaking changes, migration, risk, tests).

PRs in Bundle

• Bump @sentry/mcp-server from 0.27.0 to 0.29.0 in /.github/workflows #12009 - Bump @sentry/mcp-server from 0.27.0 to 0.29.0 in /.github/workflows
• Bump hono from 4.11.4 to 4.11.7 in /.github/workflows #12099 - Bump hono from 4.11.4 to 4.11.7 in /.github/workflows

Agent Task

1. Research each update for breaking changes and summarize risks.
2. Create a single bundled PR (one runtime + one manifest).
3. Ensure CI passes; run relevant runtime tests.
4. Add the research report to the bundled PR.
5. Update this issue checklist as PRs are merged.

AI generated by Dependabot Burner