fix(security): update MCP SDK Hono runtime chain

[mohanagy]

Closes #281.

Security change

• Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0.
• Pins every @hono/node-server lock entry to 2.0.10 through npm overrides.
• SDK 1.30.0 accepts the 2.x Hono range. Version 2.0.10 is the first compatible patched release after the 2.0.0 through 2.0.9 WebSocket-handshake advisory range, while also replacing the vulnerable 1.x runtime chain.
• Adds package-contract coverage for the manifest override, the resolved lock entry, and stale nested Hono entries.

Validation-gate repair

The full suite exposed a pre-existing stale checked fake-upstream bundle. Its test, generator, and bundle were unchanged from development. This PR regenerates the documented fixture and keeps the existing contract as the guardrail.

Validation

• npm audit --omit=dev --json: 0 vulnerabilities
• npm run test:core
• npm run test:oauth-console
• npm run test:package
• npm test: 1,770 passed, 33 expected skips
• npm run test:coverage: 1,770 passed, 95.65 percent statements and 91.88 percent branches
• npm run lint
• npm run typecheck
• npm run build
• npm run smoke:cli
• npm run check:pack
• git diff --check

Follow-up

Full development-toolchain audit findings are tracked separately in #282. They do not appear in the published runtime graph, which this PR verifies is clean.

Summary by CodeRabbit

• Bug Fixes
  • Updated the Model Context Protocol SDK to the latest compatible release.
  • Applied a dependency resolution patch for the Hono server to ensure consistent runtime behavior.
  • Improved object validation behavior for optional fields.
• Tests
  • Added/extended contract checks to ensure the patched Hono server version is resolved consistently, including nested dependency paths.

[coderabbitai]

📝 Walkthrough

Walkthrough

The MCP SDK is upgraded to ^1.30.0, @hono/node-server is pinned to 2.0.10, bundled fixture output is regenerated, and package contract tests validate top-level and nested lockfile resolutions.

Changes

Dependency and package contracts

Layer / File(s)	Summary
Runtime dependency and fixture update package.json, tests/fixtures/fake-upstream-bundled.mjs	The MCP SDK dependency is upgraded, @hono/node-server is overridden to 2.0.10, and bundled object parsing output is regenerated.
Resolved version contract tests tests/package-contract.test.ts	Tests verify the manifest override, all matching lockfile entries, and rejection of stale nested Hono versions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• mohanagy/miftah#126: Both update package overrides and validate pinned lockfile versions.
• mohanagy/miftah#145: Both add nested lockfile version checks and stale-entry regression coverage.
• mohanagy/miftah#194: Both modify the bundled test fixture and its generated output.

Poem

A bunny watched the versions hop,
One SDK rose to the top.
Hono’s pin is firm and bright,
Lockfile paths now match just right.
Tests thump softly: all is tight!

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The SDK bump and contract tests align with #281, but the locked runtime graph depends on package-lock.json, which was excluded by !**/package-lock.json.	Include package-lock.json in review or provide its diff so the patched Hono lock graph can be verified against #281.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the security-focused MCP SDK and Hono runtime update.
Description check	✅ Passed	The description covers the change, validation, and follow-up details well enough for the template.
Out of Scope Changes check	✅ Passed	The changes stay within the stated security update, fixture regeneration, and package-contract test scope.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/281-mcp-sdk-hono-security

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

Review note: the change adds no production API surface that needs docstrings. The package-lock graph is intentionally covered by the package-contract test: it asserts the SDK/Hono override, every resolved Hono entry, and rejects stale nested versions. Current-head CI is green on all required platforms.