chore(deps): bump @hono/node-server from 1.19.13 to 1.19.17 in /mcp-server

[dependabot]

Bumps @hono/node-server from 1.19.13 to 1.19.17.

Release notes

Sourced from @​hono/node-server's releases.

v1.19.17

No release notes provided.

v1.19.14

What's Changed

• fix: add custom inspect to lightweight Request/Response to prevent TypeError on console.log by @​usualoma in honojs/node-server#340

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

Commits

• 71941da 1.19.17
• 0208500 ci: add stage option for publishing (#386)
• cbdf713 1.19.16
• 86e96c2 ci: add an action for trusted publisher (#385)
• 99c1a1a ci: run on v1.x branch pushes
• 84cb2ee Merge commit from fork
• b5e63a3 1.19.14
• c02d777 fix: add custom inspect to lightweight Request/Response to prevent TypeError ...
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

🤖 Dependabot PR Review — Automated Analysis

Dependencies Changed

• @hono/node-server: 1.19.13 → 1.19.17 (patch, transitive via @modelcontextprotocol/sdk@1.28.0)

Changelog highlights (1.19.13 → 1.19.17):

• 1.19.14: Fix custom inspect on lightweight Request/Response to prevent TypeError on console.log
• 1.19.16: Security fix in serve-static (path handling)
• 1.19.17: Test/CI maintenance; no documented API changes

No dependencies added or removed. mcp-server/package.json unchanged — only package-lock.json updated.

Build Result

✅ Passed (npm ci && npm run build)

Test Result

✅ All tests passed (17 files, 435 tests)

Execution Check

✅ Starts successfully — node dist/index.mjs boots and logs "Currents MCP Server is live" when CURRENTS_API_KEY is set (no --help flag; missing API key exits cleanly with expected error)

Risk Assessment

LOW — Patch-level transitive dependency bump with bug/security fixes only. @hono/node-server is not imported directly in this codebase; it is pulled in by the MCP SDK for HTTP transport. No breaking changes documented, no source code changes required.

Code Changes Proposed

None

Decision

✅ Auto-approved and merged

cc @miguelangaranocurrents

[cursor]

Update: Automated approval and merge could not be completed — the integration token lacks addPullRequestReview / merge permissions. All verification checks passed; this PR is ready for human approval and merge.

cc @miguelangaranocurrents

[maxigimenez]

Security triage: Tier A — ready to merge, nothing outstanding

What and why. @hono/node-server 1.19.13 → 1.19.17 (moderate; via @modelcontextprotocol/sdk). Closes GHSA-frvp-7c67-39w9, vulnerable range <1.19.15.

No Vanta finding covers this — Vanta has no integrationId=github vulnerability record for currents-mcp at any deadline, so there is no SLA clock on it. It came from npm audit on mcp-server/package-lock.json.

Exposure. Advisory impact, quoted: "Path traversal in serve-static on Windows via encoded backslash (%5C)". Transitive only — @hono/node-server appears in no manifest in this repo; the sole requester is @modelcontextprotocol/sdk at ^1.19.9. Reachable only through serveStatic on a Windows host; the published artifact is a Linux container image and an npm package, so exposure is low in practice. Worth taking anyway because the fix is free.

The fix. Lockfile refresh, no manifest edit — correct mechanism here, since ^1.19.9 already admits 1.19.17. Diff is one stanza in mcp-server/package-lock.json (version + resolved + integrity). No resolutions/overrides entry needed, and none added.

Breaking-change check. Same major, patch-level move across 1.19.14–1.19.17. engines.node is unchanged at >=18.14.1 on both sides. Nothing breaking in range.

Verification. Not run locally — this repo has no installed tree in the triage sandbox this run, and CI covers the same ground directly (npm ci + build + tests on three Node majors). Relying on CI, per below.

CI coverage. test.yml triggers — pull_request to main with no paths filter — and it runs npm ci, npm run build, npm run test:run in mcp-server/. All check runs on head dbc6ec1 concluded success:

check	conclusion
Test (Node 20.x)	success
Test (Node 22.x)	success
Test (Node 24.x)	success
Cursor Agent Dependency Review	success

Not triggered by this diff: publish.yaml, release.yaml, promote.yaml (all workflow_dispatch), linear-release.yaml (push to main/release/**), auto-pr-parity-branch.yaml (push to cursor/currents-mcp-parity-*). post-release.yaml and parity-pr-merged.yaml are pull_request: closed and will evaluate on merge. None of those gate this change.

What a human should still check. Nothing.

Needs release. @currents/mcp is published, and this moves a transitive runtime dependency of the server. No release is required to close the advisory in the repo, but the fix only reaches users on the next publish. Not publishing anything here.

---

Unrelated to this PR, recorded so it is not lost: npm audit also reports nanoid <3.3.18 (high, GHSA-2v37-7h3g-55p8) transitively in this repo, with no Vanta record either. This PR does not address it.

---

Generated by Claude Code