Tools
MCP Inspector 2.6.0 raised its declared hono floor rather than trusting its lockfile, and documented why
PR #2302, merged 2026-09-09T03:20Z for the 2.6.0 release, moves the declared range for hono from ^4.13.1 to ^4.13.7 to close GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc and GHSA-crvj-82cr-hjcx. The reasoning is the transferable part: hono is a runtime dependency of `core/`, and a published install resolves the range from the root manifest, so a consumer could land on a vulnerable 4.13.x even with the project's own lockfile pinned safely. The maintainers also refused to run `npm audit fix` at all, because it resolves in-range advisories by silently downgrading in a way their `local:gate` cannot detect.
Source
↳ Follow the thread