From 5472747e929c3adc926f9d28bcb4eaab23e9910c Mon Sep 17 00:00:00 2001
From: Badcuban <108198679+badcuban@users.noreply.github.com>
Date: Fri, 13 Nov 2026 14:55:01 -0500
Subject: [PATCH] fix(deps): bump hono to 4.13.17 for five advisories

GitHub opened five Dependabot alerts on Nov 13 for hono below 4.13.16:
GHSA-h7mg-cq63-vhpq and GHSA-4m76-xfj5-7975 (middleware bypass in the
router and in mount()), GHSA-4h7h-rv7c-7m2v (form validation skipped),
GHSA-46wx-v44x-9hh2 (csrf() and text/ping) and GHSA-3gg2-335m-rxc6
(HTML injection in the css helper).

hono is not ours. It comes in as a peer of @hono/node-server, under
@modelcontextprotocol/sdk, and nothing in Threadlines imports it. The
desktop app does not ship it at all: none of the 5,216 script files in
nightly 0.10.1-nightly.20261113.383 contain hono code. So this only
moves the version the repo installs for development and tests, from
4.13.13 to 4.13.17 (six days old; 4.13.18 is under three).

Only the lockfile changes: the parents' ranges already allow the fixed
version, so no override is left behind.
---
 pnpm-lock.yaml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b3b2d4e97..4ac76ec1c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4832,8 +4832,8 @@ packages:
   highlight.js@10.7.3:
     resolution: {integrity: sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==}
 
-  hono@4.13.13:
-    resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==}
+  hono@4.13.17:
+    resolution: {integrity: sha512-vZIcbkvjOR5hHRWERbGkr8fGfF0GGM1ooYkuH448iO3b2AdVEr3AXZSw4Z3Kn+1L5z0CVoVeyV29VGYmFh05kQ==}
     engines: {node: '>=16.9.0'}
 
   hosted-git-info@4.1.0:
@@ -8057,9 +8057,9 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@hono/node-server@2.1.6(hono@4.13.13)':
+  '@hono/node-server@2.1.6(hono@4.13.17)':
     dependencies:
-      hono: 4.13.13
+      hono: 4.13.17
 
   '@img/colour@1.1.0': {}
 
@@ -8538,7 +8538,7 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.32.2(zod@4.6.7)':
     dependencies:
-      '@hono/node-server': 2.1.6(hono@4.13.13)
+      '@hono/node-server': 2.1.6(hono@4.13.17)
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 1.0.5
@@ -8548,7 +8548,7 @@ snapshots:
       eventsource-parser: 3.1.1
       express: 5.3.0
       express-rate-limit: 8.7.1(express@5.3.0)
-      hono: 4.13.13
+      hono: 4.13.17
       jose: 6.2.12
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
@@ -11042,7 +11042,7 @@ snapshots:
 
   highlight.js@10.7.3: {}
 
-  hono@4.13.13: {}
+  hono@4.13.17: {}
 
   hosted-git-info@4.1.0:
     dependencies: