fix(deps): bump storybook, @modelcontextprotocol/sdk and hono to resolve Dependabot alerts

AV
17d ago
+932-44

Summary

Bumps dependencies to patched versions. Also raises the root overrides for @modelcontextprotocol/sdk (1.31.0 → 1.32.0) and hono (4.13.7 → 4.13.11); without it the override would pin every workspace to the vulnerable version.

Closes Dependabot alerts:

storybook → 10.6.2 (with @storybook/* packages on the same version) in packages/ui, apps/desktop, apps/mobile

  • #396, #391, #392 (critical): Missing origin validation in Storybook preview allows code injection from malicious websites

@modelcontextprotocol/sdk → 1.32.0 in packages/cli, apps/docs, apps/api

  • #381, #379, #375 (high): One HTTP request within the default size limit could exhaust server memory during validation
  • #380, #378, #374 (medium): Server bearer authentication accepted tokens issued for another service
  • #367, #362, #359 (high): Experimental tasks were not tied to the session that created them
  • #366, #361, #358 (medium): HTTP client transports and OAuth requests followed cross-origin redirects

hono → 4.13.11 in packages/host-service, apps/relay, apps/realtime

  • #368, #364, #363 (medium): serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Not included, already covered by open Dependabot PRs: #8695 (hono usercontent), #8693/#8696 (MCP SDK trpc/mcp), #8738/#8694 (vite), #8739 (electron 41 → 42 major), #8740 (storybook chat-ui). Those PRs will conflict with the root override bump on rebase.

Test plan

  • bun install (lockfile refreshed)
  • bun run lint:fix clean
  • bun run typecheck passes in apps/api, apps/desktop, apps/docs, apps/relay, apps/realtime, packages/cli, packages/host-service, packages/ui
  • apps/mobile typecheck fails with the same 12 errors on unmodified main (unref on number in packages/port-scanner and packages/workspace-fs); not caused by this change
  • Smoke-test Storybook in packages/ui and apps/desktop

Summary by cubic

Bumps storybook to 10.6.2, @modelcontextprotocol/sdk to 1.32.0, and hono to 4.13.11 across affected workspaces to resolve Dependabot alerts. Also raises the root overrides for @modelcontextprotocol/sdk and hono to the patched versions; without this, the override would pin every workspace to the vulnerable version.

What each bump fixes

  • storybook 10.6.2 (packages/ui, apps/desktop, apps/mobile): closes a critical missing origin validation in the Storybook preview that allowed code injection from malicious sites.
  • @modelcontextprotocol/sdk 1.32.0 (packages/cli, apps/docs, apps/api): fixes memory exhaustion during validation, bearer tokens accepted across services, experimental tasks not tied to their creating session, and cross-origin redirects in HTTP client transports and OAuth requests.
  • hono 4.13.11 (packages/host-service, apps/relay, apps/realtime): fixes serveStatic double-decoding the request path, which let requests bypass middleware on static paths.

Lockfile refreshed; lint and typecheck pass except in apps/mobile, which fails with the same 12 pre-existing errors as unmodified main. Open Dependabot PRs for related upgrades (electron 42, vite, MCP SDK trpc/mcp, storybook chat-ui) are kept separate and will conflict with the root override bump on rebase.

Summary by CodeRabbit

  • Chores
    • Updated supporting components used across the API, documentation, command-line tools, and service features.
    • Refreshed the components used to build and preview desktop, mobile, and shared UI experiences.
    • These updates do not describe changes to user-facing features or behavior.