chore(release): audit, hono advisory fix, and bump to 2.6.0

[cliffhall]

Closes #2300

Release 2.6.0, step 1 of two. Per the release skill this PR carries the release npm audit, any fixes it forces, and the version bump — all three together, on v2/main, so they flow into main with the rest of the milestone's work.

The audit

npm audit --audit-level=high across all five installs (root + web/cli/tui/launcher): all exit 0 — nothing high or critical. Two moderate clusters were reported:

Cluster	Severity	Runtime?	Disposition
hono <=4.13.4 — GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc, GHSA-crvj-82cr-hjcx	moderate ×3	Yes — core/ imports it	Fixed here
@vitest/mocker 2.1.0–4.1.10 — GHSA-82fw-gwwq-j7x9	moderate	No — test runner	Deferred to #2301

No npm audit fix was run, with or without --force — it resolves an in-range advisory by silently downgrading, which local:gate cannot detect (#2058).

The hono fix

Raises the declared floor ^4.13.1 → ^4.13.7, not just the lockfile. hono is a runtime dependency of core/, and a published install resolves this range from the root manifest — under ^4.13.1 a consumer could still land on a vulnerable 4.13.x even with our lockfile pinned safely.

Why the vitest bump is not here

vitest, @vitest/coverage-v8 and web's @vitest/browser-playwright are pinned exactly and must move together (AGENTS.md). The root install takes 4.1.11 cleanly; clients/web will not:

npm error Conflicting peer dependency: vitest@4.1.11
npm error   peer vitest@"4.1.11" from @vitest/browser-playwright@4.1.11

@vitest/browser-playwright declares an exact peer on vitest, web does not declare vitest itself (it is the peer shadow AGENTS.md describes), and web's lockfile pins that copy at 4.1.10 — a knot npm resolves by refusing. Regenerating web's lockfile does clear it, but re-resolves the whole tree: 298 version lines changed, 649 → 657 packages. That is an uncontrolled dependency update, not a security patch, and it does not belong in a release-prep PR.

It is dev-only, moderate, and does not gate the release (--audit-level=high is clean), so it is tracked as #2301 with the full reproduction and three candidate approaches.

The bump

npm version minor --no-git-tag-version — 2.5.0 → 2.6.0. Two version lines, and deliberately no tag: the release tag points at the merge commit on main, cut in step 2.

Verification

npm run local:gate — pass, in a dedicated worktree with a full npm install.

Stage	Result
web unit + integration (coverage)	418 files / 8001 tests
cli	29 files / 383 tests
tui	30 files / 432 tests
launcher	1 file / 5 tests
Storybook	123 files / 525 tests
smokes	11 OK — launcher, cli, tui, web ×2 engines (browser/app/elicit/tabs)
verify:build-gate	OK
verify:bundle-externals	OK — 3 bundles, no externalized package inlined

Build output confirms the new version throughout (@modelcontextprotocol/inspector@2.6.0).

No UI or TUI surface changes, so no screenshots apply.

Next

Once this merges, PR 2 takes v2/main into main whole — no commits of its own — smoke-tested from the production build against every one of the milestone's 42 closed issues, with the ledger artifact for maintainer review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RsmR1iQstcrEzJFmgZXGLi

[Copilot]

🟢 Approval recommended

The manifest and lockfile changes are internally consistent and match issue #2300’s release-preparation scope.

Pull request overview

Prepares release 2.6.0 by updating the package version and raising Hono’s minimum compatible version beyond the reported runtime advisories.

Changes:

• Bumps Inspector from 2.5.0 to 2.6.0.
• Raises Hono from ^4.13.1 to ^4.13.7.
• Synchronizes the root lockfile metadata and resolved Hono artifact.

File summaries

File	Description
package.json	Updates the release version and secure Hono dependency floor.
package-lock.json	Records version metadata and locks Hono at 4.13.7.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.