fix: Update hono and @hono/node-server to resolve high severity vulnerabilities

[hatayama]

Summary

• Update hono from 4.12.2 to 4.12.5
• Update @hono/node-server from 1.19.9 to 1.19.11
• Fixes 2 high severity vulnerabilities detected by npm audit

Vulnerabilities Fixed

hono <= 4.12.3

• GHSA-5pq2-9x2x-5p6w - Cookie Attribute Injection via unsanitized domain/path in setCookie()
• GHSA-p6xx-57qc-3wxr - SSE Control Field Injection via CR/LF in writeSSE()
• GHSA-q5qw-h33p-qvwr - Arbitrary file access via serveStatic vulnerability

@hono/node-server < 1.19.10

• GHSA-wc8c-qw6v-h7f6 - Authorization bypass for protected static paths via encoded slashes

Changes

• Only Packages/src/TypeScriptServer~/package-lock.json is modified (transitive dependency update via @modelcontextprotocol/sdk)

Test plan

• npm audit --audit-level=moderate reports 0 vulnerabilities
• No changes to direct dependencies or application code

---

Summary by cubic

Updated Hono and @hono/node-server to patch high-severity vulnerabilities flagged by npm audit. Only the TypeScriptServer package-lock was changed; npm audit (moderate) now reports 0 vulnerabilities.

• Dependencies

  • hono: 4.12.2 -> 4.12.5
  • @hono/node-server: 1.19.9 -> 1.19.11

• Bug Fixes

  • hono: fixes cookie attribute injection, SSE control field injection, and arbitrary file access
  • @hono/node-server: fixes authorization bypass via encoded slashes

^{Written for commit 5a2bbd8. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file