fix(deps): bump storybook, @modelcontextprotocol/sdk and hono in every workspace to resolve Dependabot alerts

AV
13d ago
+160-96

Summary

Bumps three packages in every workspace manifest that pins them. Lockfile refreshed.

  • storybook and @storybook/* 10.4.2 → 10.6.2: packages/ui, packages/chat-ui, apps/desktop, apps/mobile
  • @modelcontextprotocol/sdk 1.31.0 → 1.32.0: root overrides, packages/trpc, packages/mcp, packages/cli, apps/docs, apps/api
  • hono 4.13.7 → 4.13.11: root overrides, packages/host-service, apps/usercontent, apps/relay, apps/realtime

This replaces #8776 and the per-directory Dependabot PRs #8693, #8695, #8696, #8740 and #8809. #8776 left packages/chat-ui, packages/trpc, packages/mcp and apps/usercontent to those Dependabot PRs. That way every one of them fails Sherif's multiple-dependency-versions check (storybook, @storybook/react-vite, @modelcontextprotocol/sdk, hono), and none can merge green. These pins can only move in all workspaces at once.

Closes Dependabot alerts:

storybook → 10.6.2

  • #396 (ui), #393 (chat-ui), #392 (mobile), #391 (desktop), critical: Missing origin validation in Storybook preview allows code injection from malicious websites
  • #422 (ui), #421 (chat-ui), #416 (mobile), #401 (desktop), high: Storybook dev server vulnerable to code injection from the local network

@modelcontextprotocol/sdk → 1.32.0

  • #385 (trpc), #383 (mcp), #381 (cli), #379 (docs), #375 (api), high: One HTTP request within the default size limit could exhaust server memory during validation
  • #372 (trpc), #370 (mcp), #367 (cli), #362 (docs), #359 (api), high: Experimental tasks were not tied to the session that created them
  • #384 (trpc), #382 (mcp), #380 (cli), #378 (docs), #374 (api), medium: Server bearer authentication accepted tokens issued for another service
  • #371 (trpc), #369 (mcp), #366 (cli), #361 (docs), #358 (api), medium: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

hono → 4.13.11

  • #368 (host-service), #365 (usercontent), #364 (relay), #363 (realtime), medium: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Not in this PR (already covered by open PRs):

  • zod 4.6.6: #8844
  • next, @sentry/nextjs, vite: #8821
  • @azure/msal-node 5.5.0 → 7.1.0 (#444): #8836

Test plan

  • bun install (Bun 1.4.3, the repo's packageManager); native modules rebuilt; lockfile has only storybook@10.6.2, @modelcontextprotocol/sdk@1.32.0 and hono@4.13.11
  • bunx sherif (no issues)
  • bun run lint:fix (clean, no fixes)
  • bun run lint (clean)
  • bun run typecheck passes in packages/ui, packages/chat-ui, packages/mcp, packages/trpc, packages/cli, packages/host-service, apps/api, apps/docs, apps/realtime, apps/relay, apps/usercontent, apps/desktop
  • apps/mobile typecheck fails locally with the same 190 errors with and without this change (identical sorted error set, mostly host-service router types such as ChangesetFile). main's CI Typecheck passes on the same base commit, so this is local-environment only; CI checks it here.
  • Smoke-test Storybook in packages/ui, packages/chat-ui and apps/desktop
  • CI

Summary by CodeRabbit

  • Chores
    • Updated underlying platform components and development tools to newer versions across the API, documentation, desktop, mobile, and shared packages. These updates include components used for service communication, real-time features, and Storybook previews.