chore(deps): override hono to ^4.12.25 (CVE fixes)

[cliffhall]

Summary

hono is a transitive runtime dependency pulled in via @modelcontextprotocol/sdk (and @hono/node-server), previously resolving to hono@4.12.23. Five Dependabot security advisories affecting hono are patched in hono >= 4.12.25.

This PR adds an overrides entry pinning hono to ^4.12.25, so the entire dependency tree resolves to a patched version. After npm install, npm ls hono --all shows all hono at 4.12.30 (>= 4.12.25).

The only source change is the overrides block in the root package.json (the existing get-intrinsic override is preserved); package-lock.json is refreshed accordingly. No inspector version numbers were changed.

Verification

• npx prettier --check . — pass
• npm run check-version — pass
• client lint — pass
• client tests — 535 passed
• cli tests — 85 passed
• npm run build (server + client + cli) — pass

Resolves Dependabot alerts 126, 128, 127, 125, 124

Part of #1706

🤖 Generated with Claude Code

https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

[cliffhall]

@claude review — security dependency fix adding a hono override to ^4.12.25 (part of #1706). Verify it resolves the advisories, the override is correct/minimal, and nothing is broken. Flag anything actionable.

[claude]

Claude finished @cliffhall's task in 1m 30s —— View job

---

Review: hono override → ^4.12.25 (part of #1706)

• Read the diff (package.json + package-lock.json)
• Verify override is correct/minimal & syntax valid
• Confirm resolved version satisfies advisories (≥ 4.12.25)
• Check dependency tree resolves consistently
• Flag anything actionable

Verdict: ✅ LGTM — approve. Minimal, correct, and it resolves the advisories. No blocking issues.

---

What I verified

Override is correct & minimal. package.json:78-81 adds a single hono key alongside the existing get-intrinsic override (preserved):

"overrides": {
  "get-intrinsic": "1.3.0",
  "hono": "^4.12.25"
}

hono is a transitive-only runtime dep — pulled in by @modelcontextprotocol/sdk@1.26.0 (hono@^4.11.4) and @hono/node-server (hono@^4). It's not a direct dependency of any workspace, so an overrides entry is the right mechanism (a direct dependencies bump would be wrong here). One line, nothing extraneous.

Resolved version satisfies all 5 advisories. Lockfile resolves to a single deduped hono@4.12.30 (package-lock.json:7594-7601), which is ≥ 4.12.25 and satisfies both ^4.11.4 and ^4. No second/stale hono copy anywhere in the tree.

Advisories are actually gone. npm audit against the refreshed lockfile reports no hono advisories — the 5 Dependabot alerts (124, 125, 126, 127, 128) are cleared.

Lockfile is in sync. npm install --package-lock-only --ignore-scripts reports "up to date" with zero diff — the committed lockfile matches what the override produces, so no drift.

Notes (non-blocking)

• Scope is intentionally narrow. npm audit still lists other unrelated advisories (form-data, js-yaml, minimatch, shell-quote, vite, vitest). Those are out of scope for this PR and presumably tracked separately under Tracking: resolve open Dependabot and code scanning security alerts #1706 — correct to leave them here.
• Floor vs. latest: since the transitive ranges (^4.11.4/^4) already accept the latest 4.x, the practical value of this override is a durable floor (≥ 4.12.25) that prevents any future resolution from sliding back below the patched version. Good defensive pin.

Nothing actionable. Ship it. 🚢
· deps/security-hono