fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x (closes #49) by yakimoto · Pull Request #50 · wave-av/sdks

yakimoto · 2026-07-28T13:11:08Z

User description

Closes #49.

@modelcontextprotocol/sdk  1.29.0  → 1.30.0
@hono/node-server          1.19.14 → 2.0.12     (advisory: < 2.0.5, moderate, runtime scope)

#49 asked the wrong question, and the answer changed underneath it

I filed #49 saying this needed a breaking-change assessment because 1.19.14 → 2.0.5 is a major jump. That framing was correct against SDK 1.29.0, which pinned @hono/node-server: ^1.19.9 — the only way through was a pnpm.overrides entry forcing 2.x against a dependency's own declared range, which is exactly the trap in claude-workstation#554.

@modelcontextprotocol/sdk@1.30.0 shipped on 2026-07-27 and widened that range to ^1.19.9 || ^2.0.5. So there is no override, no pin, and no breaking-change assessment to make — the SDK maintainers did it. Updating the SDK is the whole fix.

@hono/node-server is not declared by any manifest in this workspace; it arrives solely through the SDK:

'@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)':
  '@hono/node-server': 1.19.14(hono@4.12.23)

The one manifest line, and why it stays

  "dependencies": {
-   "@modelcontextprotocol/sdk": "^1.0.0",
+   "@modelcontextprotocol/sdk": "^1.30.0",

This is not the churn from claude-workstation#555. That issue is about pnpm update --recursive --lockfile-only silently reformatting all 48 package.json files and unescaping — into literal em-dashes inside published description fields — 928 lines of it, reverted before it could ship. This run touched one manifest and one line.

And it's load-bearing. @wave-av/mcp-server is published, so downstream consumers resolve against its declared range, not our lockfile. Left at ^1.0.0, a consumer could resolve SDK 1.29.x and pull the vulnerable @hono/node-server right back in. ^1.30.0 states the requirement that actually exists.

Verification

CI can't run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes, confirmed live this morning against adk and dispatch-edge). All local:

pnpm install --frozen-lockfile   → resolved 188, done      (lock genuinely consistent with manifests)
pnpm -r build                    → success across the workspace
pnpm -r test                     → 143 tests / 52 files / 48 packages, 0 failed
pnpm -r type-check               → no errors

pnpm audit compares version strings and never loads a module, so it can't be the evidence here. Two things stand in for it:

Reachability — packages/mcp-server/src/server.ts imports only StdioServerTransport and never constructs an HTTP transport, so @hono/node-server is in the tree but off the exercised code path.
The same bump, driven end-to-end on the sibling repo. fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x, clearing the last two runtime advisories mcp-server#68 has the identical two-package move, and there I spawned the built binary over stdio and completed a real MCP handshake: initialize → wave-mcp-server, protocol 2025-06-18; tools/list → 18 tools, byte-identical to baseline.

Merge-order note

#48 also rewrites sdk-typescript/pnpm-lock.yaml. This PR is based on main @ 9eb128a and is independent of it, but the two will conflict textually. Whichever lands second should re-run its own update command rather than hand-merging the lockfile — a hand-merged pnpm lockfile is how you get a tree that installs but doesn't match either intent.

After #48 and this one, the only alerts left on the repo are vite ×2 and esbuild ×1, all dev-only via vitest, which Renovate #24 already bumps.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Note

Low Risk
Dependency-only change with no application source edits; runtime path uses stdio transport, though downstream installs still pick up the updated transitive tree.

Overview
Addresses #49 by raising @modelcontextprotocol/sdk from ^1.0.0 to ^1.30.0 in @wave-av/mcp-server, with lockfile updates so the resolved SDK is 1.30.0 and the transitive @hono/node-server moves from 1.19.x to 2.1.1 (≥ 2.0.5), clearing the moderate advisory without pnpm.overrides.

The ^1.30.0 floor matters for published consumers: a loose ^1.0.0 range could still resolve 1.29.x and pull the vulnerable Hono stack. CHANGELOG adds an [Unreleased] → Security entry documenting the fix.

^{Reviewed by Cursor Bugbot for commit de0be71. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by cubic

Update @modelcontextprotocol/sdk to ^1.30.0 in @wave-av/mcp-server so consumers resolve @hono/node-server 2.x transitively, clearing the moderate advisory without overrides.

SDK 1.30.0 widened its @hono/node-server range to ^1.19.9 || ^2.0.5, so no pnpm.overrides pin is needed. The ^1.30.0 floor is load-bearing: @wave-av/mcp-server is published, and consumers resolve against its declared range rather than our lockfile, so ^1.0.0 would still allow SDK 1.29.x and the vulnerable @hono/node-server. Merged main, keeping both the Security changelog entry and the Go 1.25 note; regenerated sdk-typescript/pnpm-lock.yaml rather than hand-merging, dropping the stale @hono/node-server@1.19.14 entries to force a fresh resolve to 2.1.1.

Verification

Frozen install, build, and type-check clean; 143 tests across 48 packages pass.
The MCP server is stdio-only, so @hono/node-server is in the tree but off the exercised path.
CI can't run (org-wide account billing lock); the same bump was verified over stdio on the sibling repo.

^{Written for commit fc82be8. Summary will update on new commits.}

Summary by Sourcery

Update the MCP server SDK dependency to ^1.30.0, bringing in a fixed transitive @hono/node-server version and removing the need for overrides or pins.

Bug Fixes:

Update the MCP server dependency tree to resolve the moderate security advisory affecting vulnerable @hono/node-server versions.

Enhancements:

Raise the published MCP server SDK requirement to ^1.30.0 so downstream consumers cannot resolve the older vulnerable SDK range without dependency overrides.

Documentation:

Document the dependency security update in the changelog.

CodeAnt-AI Description

Update the MCP server dependencies to resolve a moderate security advisory

What Changed

The MCP server now requires SDK 1.30.0, which updates the transitive Hono Node server dependency from 1.19.14 to 2.1.1.
The dependency update removes versions below 2.0.5 affected by the moderate advisory without requiring an override or forced pin.
The security fix is recorded in the changelog.

Impact

✅ Removes the vulnerable Hono Node server version
✅ Keeps published MCP server consumers on the fixed SDK range
✅ Avoids dependency overrides and forced version pins

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

closes #49, which called this a major bump needing a breaking-change assessment. that was true against @modelcontextprotocol/sdk 1.29.0, which declared @hono/node-server ^1.19.9. sdk 1.30.0, published 2026-07-27, widened the range to ^1.19.9 || ^2.0.5, so no pnpm.overrides pin is needed. forcing 2.x onto the old sdk would have meant overriding a dependency own declared range, which is the failure claude-workstation#554 documents. @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 @hono/node-server 1.19.14 -> 2.0.12 the one manifest line is deliberate, not the claude-workstation#555 churn. #555 is about all 48 package.json files being reformatted and em dashes unescaped inside published description fields; that was reverted. this run touched one manifest and one line. it is load-bearing: @wave-av/mcp-server is published, and consumers resolve against its declared range rather than our lockfile, so ^1.0.0 would let them pull sdk 1.29.x and the vulnerable node-server straight back in. pnpm install --frozen-lockfile clean, pnpm -r build clean, 143 tests / 52 files / 48 packages green, type-check clean. packages/mcp-server/src/server.ts imports only StdioServerTransport and never builds an HTTP transport, so node-server sits off the exercised path. the identical bump was verified end to end on wave-av/mcp-server#68 by driving the built binary over stdio: initialize plus tools/list returning all 18 tools, matching baseline. CI cannot run.

changeset-bot · 2026-07-28T13:11:13Z

⚠️ No Changeset found

Latest commit: 12aff7a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-07-28T13:11:20Z

Warning

Review limit reached

Next included review available in 13 seconds.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 95 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: f5253a65-9f03-41de-a4cd-6dfe6ff118ce

📥 Commits

Reviewing files that changed from the base of the PR and between 8838c2e and fc82be8.

⛔ Files ignored due to path filters (1)

sdk-typescript/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

CHANGELOG.md
sdk-typescript/packages/mcp-server/package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/mcp-sdk-1.30-hono-node-server

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/mcp-sdk-1.30-hono-node-server

_{Comment @coderabbitai help to get the list of available commands.}

cursor · 2026-07-28T13:11:25Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7383ed78-198a-429f-83ad-92da8f883030)

socket-security · 2026-07-28T13:11:59Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@modelcontextprotocol/sdk@1.29.0 ⏵ 1.30.0	⁺¹

View full report

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

Resolves CHANGELOG.md Unreleased-section conflict by keeping both entries (Security note on top, Go 1.25 floor Changed note below). Regenerated sdk-typescript/pnpm-lock.yaml instead of hand-merging: pnpm's incremental lockfile-only resolve kept the stale @hono/node-server@1.19.14 pin (still satisfies the SDK's ^1.19.9||^2.0.5 range) rather than advancing it, so the two @hono/node-server registry entries were dropped from the lockfile first to force a fresh resolution — it now resolves to 2.1.1, clearing the moderate advisory this PR targets (same fix intent as the PR's original 2.0.12, on a newer patch).

codeant-ai · 2026-09-06T22:49:24Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	`fc82be8`	Sep 08, 2026 · 18:21	18:22
✅ Reviewed your PR	`de0be71`	Sep 06, 2026 · 22:49	22:50

codeant-ai · 2026-09-06T22:49:25Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

cursor · 2026-09-06T22:49:26Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9ed337cf-2052-4b25-b8db-6ea2c0b2b91e)

sourcery-ai

Sourcery assessment

Approved.

codeant-ai · 2026-09-06T22:50:42Z

  },
  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",


Suggestion: The new SDK resolves @hono/node-server 2.1.1, which requires Node 20; Node 18 consumers can fail installation under engine-strict. [api mismatch]

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes

Prompt for AI Agent 🤖

This is a comment left during a code review. **Path:** sdk-typescript/packages/mcp-server/package.json **Line:** 67:67 **Comment:** *Api Mismatch: The new SDK resolves `@hono/node-server` 2.1.1, which requires Node 20; Node 18 consumers can fail installation under engine-strict. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

codeant-ai · 2026-09-06T22:50:50Z

CodeAnt Nitpicks

1 code suggestion

1. The entry says the transitive package is version 2.0.12, but this workspace lockfile resolves `@hono/node-server` to 2.1.1, making the security record inaccurate.

Comment mismatch · CHANGELOG.md:13

macroscopeapp · 2026-09-06T22:52:27Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This published dependency update resolves @hono/node-server 2.1.1, which requires Node 20 while the MCP server still declares Node 18 support, potentially breaking engine-strict installations. The unresolved compatibility concern and changes to files owned by the SDK owners make the security-focused dependency change non-inert.

Not approved because:

Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}

…-node-server # Conflicts: # CHANGELOG.md

cursor · 2026-09-08T18:21:40Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_2328be00-6175-4629-8584-f7c8b5abc276)

yakimoto mentioned this pull request Jul 28, 2026

fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x, clearing the last two runtime advisories wave-av/mcp-server#68

Merged

docs(changelog): record sdk 1.30.0 advisory fix under Unreleased

12aff7a

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

yakimoto mentioned this pull request Jul 28, 2026

fix(deps): clear the two unremediated HIGHs in sdk-typescript/pnpm-lock.yaml (postcss + vite) #51

Open

yakimoto mentioned this pull request Sep 4, 2026

fix(legal): 52 packages declared Apache-2.0 and shipped the MIT text (LEGAL-001) #80

Merged

codeant-ai Bot added the size:S This PR changes 10-29 lines, ignoring generated files label Sep 6, 2026

sourcery-ai Bot approved these changes Sep 6, 2026

View reviewed changes

codeant-ai Bot reviewed Sep 6, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into fix/mcp-sdk-1.30-hono…

fc82be8

…-node-server # Conflicts: # CHANGELOG.md

Navigation Menu

Uh oh!

fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x (closes #49) - #50

fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x (closes #49)#50
yakimoto wants to merge 4 commits into
mainfrom
fix/mcp-sdk-1.30-hono-node-server

yakimoto commented Jul 28, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

changeset-bot Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

Review limit reached

Uh oh!

cursor Bot commented Jul 28, 2026

Uh oh!

socket-security Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

codeant-ai Bot commented Sep 6, 2026 •

edited

Loading

Uh oh!

codeant-ai Bot commented Sep 6, 2026

Uh oh!

cursor Bot commented Sep 6, 2026

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

codeant-ai Bot Sep 6, 2026

Uh oh!

codeant-ai Bot commented Sep 6, 2026

1. The entry says the transitive package is version 2.0.12, but this workspace lockfile resolves `@hono/node-server` to 2.1.1, making the security record inaccurate.

Uh oh!

macroscopeapp Bot commented Sep 6, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

yakimoto commented Jul 28, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

#49 asked the wrong question, and the answer changed underneath it

The one manifest line, and why it stays

Verification

Merge-order note

Summary by cubic

Summary by Sourcery

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Uh oh!

changeset-bot Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

cursor Bot commented Jul 28, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

socket-security Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codeant-ai Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-ai Bot commented Sep 6, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

cursor Bot commented Sep 6, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Sourcery assessment

Uh oh!

codeant-ai Bot Sep 6, 2026

Choose a reason for hiding this comment

Uh oh!

codeant-ai Bot commented Sep 6, 2026

CodeAnt Nitpicks

1. The entry says the transitive package is version 2.0.12, but this workspace lockfile resolves @hono/node-server to 2.1.1, making the security record inaccurate.

Uh oh!

macroscopeapp Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approvability

Uh oh!

cursor Bot commented Sep 8, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yakimoto commented Jul 28, 2026 •

edited by cubic-dev-ai Bot

Loading

changeset-bot Bot commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

socket-security Bot commented Jul 28, 2026 •

edited

Loading

codeant-ai Bot commented Sep 6, 2026 •

edited

Loading

1. The entry says the transitive package is version 2.0.12, but this workspace lockfile resolves `@hono/node-server` to 2.1.1, making the security record inaccurate.

macroscopeapp Bot commented Sep 6, 2026 •

edited

Loading