fix: resolve vite and hono CVEs

[jwfing]

Summary

• vite (CVE-2026-39363): bump from ^8.0.3 to ^8.0.5 (resolved 8.0.8)
• hono (CVE-2026-39408): add override ^4.12.12 (via @modelcontextprotocol/sdk)
• @hono/node-server (CVE-2026-39406): add override ^1.19.13 (via @modelcontextprotocol/sdk)

Test plan

• npm audit reports 0 vulnerabilities
• npm ls vite confirms 8.0.8
• npm ls hono confirms 4.12.12
• npm ls @hono/node-server confirms 1.19.13
• CI passes

🤖 Generated with Claude Code

Note

Fix CVEs in vite and hono dependencies

Updates vite from ^8.0.3 to ^8.0.5 and pins hono and @hono/node-server to patched versions to resolve known CVEs in package.json.

^{Macroscope summarized 86a0bfd.}

Summary by CodeRabbit

• Chores
  • Updated project dependencies to maintain compatibility and stability.

[coderabbitai]

Walkthrough

The PR updates package.json by adding npm overrides entries for @hono/node-server and hono to pin specific versions, and bumps the vite dev dependency from ^8.0.3 to ^8.0.5. No application code changes are included.

Changes

Cohort / File(s)	Summary
Package.json dependencies package.json	Added overrides for @hono/node-server (^1.19.13) and hono (^4.12.12); bumped vite dev dependency from ^8.0.3 to ^8.0.5.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• fix: add vite as explicit devDependency for CI #47: Updates vite devDependency in package.json, overlapping with this PR's vite version bump to ^8.0.5.

Suggested reviewers

• Fermionic-Lyu
• tonychang04

Poem

🐰 A hop, skip, and versions so neat,
Pinning our hono, making it sweet!
Vite's bumped up high, dependencies aligned,
No code to fuss with, just constraints refined! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: addressing CVEs in vite and hono dependencies through version bumps and overrides.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/vite-hono-cves

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

package.json (1)

3-3: ⚠️ Potential issue | 🟠 Major

Bump package version for this bug-fix release.

This PR is a security bug fix, but version was not incremented. That can block/complicate publishing the fix as a new production artifact.

📦 Suggested patch version bump

-  "version": "1.2.9",
+  "version": "1.2.10",

As per coding guidelines: use npm version patch for bug fixes, and always increment production version from the last production version.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 3, The package.json "version" field was not incremented
for this bug-fix release; run npm version patch (or manually set the "version"
field to the next patch, e.g. from 1.2.9 to 1.2.10) to update package.json and
package-lock.json, commit the change and push tags so the release artifact can
be published; ensure the git tag created by npm version is pushed (git push
--follow-tags) so CI/release tooling picks up the new production version.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Around line 64-65: The package.json still lists version 1.2.9 but this is a
bug-fix/security release—run npm version patch (which will update the version to
1.2.10 and create the commit/tag) and ensure the package.json "version" field is
updated to 1.2.10 before publishing; verify the dependency bumps for "hono" and
"@hono/node-server" remain intact after the version change.

---

Outside diff comments:
In `@package.json`:
- Line 3: The package.json "version" field was not incremented for this bug-fix
release; run npm version patch (or manually set the "version" field to the next
patch, e.g. from 1.2.9 to 1.2.10) to update package.json and package-lock.json,
commit the change and push tags so the release artifact can be published; ensure
the git tag created by npm version is pushed (git push --follow-tags) so
CI/release tooling picks up the new production version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f464b2fe-fcad-45d5-8be8-6a52e13627f8

📥 Commits

Reviewing files that changed from the base of the PR and between 81d8522 and 86a0bfd.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== package.json declared ranges ==="
jq -r '.overrides["hono"], .overrides["@hono/node-server"], .devDependencies["vite"]' package.json

echo "=== lockfile resolved versions (if present) ==="
if [ -f package-lock.json ]; then
  jq -r '
    .packages["node_modules/hono"].version,
    .packages["node_modules/@hono/node-server"].version,
    .packages["node_modules/vite"].version
  ' package-lock.json
else
  echo "package-lock.json not found. Verify with: npm ls hono `@hono/node-server` vite"
fi

Repository: InsForge/insforge-mcp

Length of output: 196

---

Bump package version from 1.2.9 to 1.2.10 for this security fix release.

The security dependency updates (hono, @hono/node-server, vite) are correctly specified. However, per the coding guidelines, bug-fix releases require a patch version bump. Use npm version patch to increment to 1.2.10 before publishing.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 64 - 65, The package.json still lists version
1.2.9 but this is a bug-fix/security release—run npm version patch (which will
update the version to 1.2.10 and create the commit/tag) and ensure the
package.json "version" field is updated to 1.2.10 before publishing; verify the
dependency bumps for "hono" and "@hono/node-server" remain intact after the
version change.

[jwfing]

Re: version bump suggestion from CodeRabbit — version bumps are handled in dedicated release PRs (e.g. #52), not in individual fix PRs. This PR only adds overrides and bumps a devDependency, so no version bump is needed here.