From 71f336305e699213d70d41f55e270144d53630e4 Mon Sep 17 00:00:00 2001
From: arimu1 <19286898+arimu1@users.noreply.github.com>
Date: Sat, 25 Jul 2026 22:29:14 +0700
Subject: [PATCH] fix(deps): widen @hono/node-server to clear
 GHSA-frvp-7c67-39w9

Allow ^2.0.5 (patched) while keeping ^1.19.9 for Node 18 consumers.
getRequestListener API is unchanged; serveStatic is unused by the SDK.

Closes #2531
Closes #2548
---
 package-lock.json | 23 ++++++++++++++++++-----
 package.json      |  2 +-
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 21e19cb402..8eb8e58293 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
             "version": "1.29.0",
             "license": "MIT",
             "dependencies": {
-                "@hono/node-server": "^1.19.9",
+                "@hono/node-server": "^1.19.9 || ^2.0.5",
                 "ajv": "^8.17.1",
                 "ajv-formats": "^3.0.1",
                 "content-type": "^1.0.5",
@@ -667,12 +667,12 @@
             }
         },
         "node_modules/@hono/node-server": {
-            "version": "1.19.11",
-            "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.11.tgz",
-            "integrity": "sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==",
+            "version": "2.0.11",
+            "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.11.tgz",
+            "integrity": "sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==",
             "license": "MIT",
             "engines": {
-                "node": ">=18.14.1"
+                "node": ">=20"
             },
             "peerDependencies": {
                 "hono": "^4"
@@ -798,6 +798,19 @@
                 }
             }
         },
+        "node_modules/@modelcontextprotocol/sdk/node_modules/@hono/node-server": {
+            "version": "1.19.15",
+            "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.15.tgz",
+            "integrity": "sha512-Za2ai6TLdKjUvnur+eenO6nuYYipVAEhyCAdaV8IRvmU9kK8crOZUSYvIXn72E4f8fJqyAbpcJuTsYYmZp9Deg==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=18.14.1"
+            },
+            "peerDependencies": {
+                "hono": "^4"
+            }
+        },
         "node_modules/@noble/hashes": {
             "version": "1.8.0",
             "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
diff --git a/package.json b/package.json
index 7d0c26cdbb..1ae67dd597 100644
--- a/package.json
+++ b/package.json
@@ -101,7 +101,7 @@
         "test:conformance:client:all": "npx @modelcontextprotocol/conformance client --command 'npx tsx test/conformance/src/everythingClient.ts' --suite all --expected-failures test/conformance/conformance-baseline.yml"
     },
     "dependencies": {
-        "@hono/node-server": "^1.19.9",
+        "@hono/node-server": "^1.19.9 || ^2.0.5",
         "ajv": "^8.17.1",
         "ajv-formats": "^3.0.1",
         "content-type": "^1.0.5",