MCP: @hono/node-server 2.1.6 closes the open Dependabot alert GHSA-rmxm-3fg6-px4f

The mcp group bump (#196) moved @modelcontextprotocol/node to 2.1.2, which
widens its @hono/node-server range from ^1.19.9 to ^1.19.9 || ^2.1.3, but it
kept the locked 1.19.17. This moves it to 2.1.6 and raises the declared
@modelcontextprotocol/server range to ^2.4.0, the peer range node 2.1.2
requires (the lockfile already had 2.4.0).

2.1.3 already fixes GHSA-rmxm-3fg6-px4f (serveStatic decodes the path twice).
2.1.6 is two days old and inside the 7-day cooldown, but it is the security
release for GHSA-jpvv-r467-5p4w, GHSA-7v5p-43qr-wch5 and GHSA-qv5m-9pm6-hqp3,
which hono has published but the advisory database does not list yet; 2.1.5
would raise those alerts as soon as it does. Lockfile written with npm 11.21.1.

npm audit: the remaining 11 moderate findings are all minimatch < 11.0.1
(GHSA-g3hv-75wg-m249) under eslint and typescript-eslint, which no parent
allows yet.
MCP: tsc, build, lint (0 warnings), knip clean; 1064 tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/McpServer/autopilot-monitor-mcp/package-lock.json

@@ -10,7 +10,7 @@
       "dependencies": {
         "@huggingface/transformers": "^3.8.1",
         "@modelcontextprotocol/node": "^2.1.2",
-        "@modelcontextprotocol/server": "^2.3.1",
+        "@modelcontextprotocol/server": "^2.4.0",
         "ajv": "^8.20.0",
         "ajv-formats": "^3.0.1",
         "compression": "^1.8.2",
@@ -683,6 +683,18 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@hono/node-server": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.6.tgz",
+      "integrity": "sha512-p/KH9MnfNcsm3sR6x4lNgm5j+QN4Et8srKredl9DZfXiyZ1UQ3aQ2YVpFLbqktYN5JI+DB+VZFKM2PqE5hLKjQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "peerDependencies": {
+        "hono": "^4 || ^5.0.0-0"
+      }
+    },
     "node_modules/@huggingface/jinja": {
       "version": "0.5.6",
       "resolved": "https://registry.npmjs.org/@huggingface/jinja/-/jinja-0.5.6.tgz",
@@ -1336,18 +1348,6 @@
         "@modelcontextprotocol/server": "^2.4.0"
       }
     },
-    "node_modules/@modelcontextprotocol/node/node_modules/@hono/node-server": {
-      "version": "1.19.17",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz",
-      "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
-      }
-    },
     "node_modules/@modelcontextprotocol/server": {
       "version": "2.4.0",
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server/-/server-2.4.0.tgz",

src/McpServer/autopilot-monitor-mcp/package.json

@@ -23,7 +23,7 @@
   "dependencies": {
     "@huggingface/transformers": "^3.8.1",
     "@modelcontextprotocol/node": "^2.1.2",
-    "@modelcontextprotocol/server": "^2.3.1",
+    "@modelcontextprotocol/server": "^2.4.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "compression": "^1.8.2",