From 16ecde282c31b59af582cbbff8ace078fea3de49 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 8 Sep 2026 22:53:50 -0400 Subject: [PATCH 1/2] fix(deps): raise hono floor to ^4.13.7, clearing three moderate advisories `npm audit` at release time reported hono <=4.13.4 against three moderate advisories: GHSA-gqvv-2mrq-wpjv (toSSG() writes outside the output dir), GHSA-g6gw-c38x-mqfc (unbounded dot-notation nesting in parseBody() can exhaust memory) and GHSA-crvj-82cr-hjcx (the query parser reads parameters after the URL fragment, creating cache-key and proxy differentials). hono is a runtime dependency of `core/`, so the fix raises the declared floor rather than only moving the lockfile: a published install resolves this range from the root manifest, and `^4.13.1` would still have let a consumer land on a vulnerable 4.13.x. Refs #2300 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01RsmR1iQstcrEzJFmgZXGLi Signed-off-by: cliffhall --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index ee754a1db..abf3eed03 100644 --- a/package-lock.json +++ b/package-lock.json @@ -22,7 +22,7 @@ "atomically": "^2.1.1", "chokidar": "^4.0.3", "commander": "^13.1.0", - "hono": "^4.13.1", + "hono": "^4.13.7", "ink": "^6.0.0", "open": "^10.2.0", "pino": "^9.14.0", @@ -3160,9 +3160,9 @@ } }, "node_modules/hono": { - "version": "4.13.1", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.1.tgz", - "integrity": "sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==", + "version": "4.13.7", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz", + "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==", "license": "MIT", "engines": { "node": ">=16.9.0" diff --git a/package.json b/package.json index 0614b5182..41b5d6637 100644 --- a/package.json +++ b/package.json @@ -99,7 +99,7 @@ "atomically": "^2.1.1", "chokidar": "^4.0.3", "commander": "^13.1.0", - "hono": "^4.13.1", + "hono": "^4.13.7", "ink": "^6.0.0", "open": "^10.2.0", "pino": "^9.14.0", From fa4b782539975b88aa095a48d700e89f5251737d Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 8 Sep 2026 22:59:41 -0400 Subject: [PATCH 2/2] chore(release): bump version to 2.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ahead of the v2.6.0 milestone merge into `main`. The bump belongs on `v2/main` so it flows into `main` with the rest of the milestone's work — doing it on the merge branch instead leaves `v2/main` reading a stale version and lets the bump leak into unrelated PRs (#2010). There is one version number in the repo; the clients carry none. No tag is created here: the release tag points at the merge commit on `main`. Closes #2300 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01RsmR1iQstcrEzJFmgZXGLi Signed-off-by: cliffhall --- package-lock.json | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index abf3eed03..337f87b07 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@modelcontextprotocol/inspector", - "version": "2.5.0", + "version": "2.6.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@modelcontextprotocol/inspector", - "version": "2.5.0", + "version": "2.6.0", "hasInstallScript": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 41b5d6637..6a18ee076 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@modelcontextprotocol/inspector", - "version": "2.5.0", + "version": "2.6.0", "description": "The Model Context Protocol Inspector", "keywords": [ "MCP",