chore: upgrade hono to ^4.13.0 to address CVE-2026-69207

[claude]

Fixes SOU-1820

Refreshes the hono lockfile entry from 4.12.31 to 4.13.0, which addresses:

• CVE-2026-69207 (MEDIUM) — ReDoS in the built-in CORS middleware (hono/cors). On a preflight request with the default (empty) allowHeaders, the attacker-controlled Access-Control-Request-Headers value is parsed with a regular expression whose backtracking is quadratic in input length, so a single request with a long whitespace run can consume seconds of CPU. Patched in 4.12.34.

hono is a transitive dependency of @modelcontextprotocol/sdk (1.27.1 and 1.29.0, both via ^4.11.4). The existing range already admitted the patched version, so this is a lockfile refresh (yarn up -R hono) with no package.json change and no new resolutions override.

Verification

• yarn why hono reports 4.13.0 for every requester; no 4.12.31 remains in the graph.
• yarn build (full monorepo) succeeds.
• yarn test passes (1803 tests across queryLanguage, shared, backend, web).

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only dependency bump with no application code changes; risk is limited to transitive MCP SDK behavior on the patched Hono version.

Overview
Bumps the resolved transitive hono dependency from 4.12.31 to 4.13.0 via a yarn.lock refresh (yarn up -R hono); no package.json changes. The package is pulled in through @modelcontextprotocol/sdk’s existing ^4.11.4 range.

This addresses CVE-2026-69207 (ReDoS in hono/cors when parsing Access-Control-Request-Headers on preflight with default empty allowHeaders).

The unreleased CHANGELOG adds a Fixed entry for the hono upgrade (#1544).

^{Reviewed by Cursor Bugbot for commit 656c39b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2196
Resolved (non-standard)	8
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.12	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (8)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo (LICENSE via GitHub license API: livebook-dev/codemirror-lang-elixir)
khroma	2.1.0	UNKNOWN	MIT	GitHub repo (LICENSE via GitHub license API: fabiospampinato/khroma)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo (LICENSE via GitHub license API: livebook-dev/lezer-elixir)
map-stream	0.1.0	UNKNOWN	MIT	GitHub repo (LICENCE via GitHub license API: dominictarr/map-stream)
memorystream	0.3.1	UNKNOWN	MIT	extracted from object (npm registry legacy "licenses"[0].type), confirmed by GitHub repo LICENSE
pause-stream	0.0.11	["MIT", "Apache2"]	MIT OR Apache-2.0	extracted from object (npm "license":["MIT","Apache2"]), confirmed by GitHub repo LICENSE "Dual Licensed MIT and Apache 2"
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	npm package tarball LICENSE file (posthog-js-1.369.0.tgz -> package/LICENSE = Apache-2.0), matches GitHub repo LICENSE
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo (LICENSE text of ogt/valid-url states "released under the MIT license")