Updating Hono & @modelcontextprotocol/sdk dependency versions

[matthew-heath]

As per #48 / anomalyco/sst#6190, this PR intends to update the version of Hono to use patched version.

This also addresses #51.

Vulnerabilities:
high: Hono Improper Authorization vulnerability - GHSA-m732-5p4w-x69g
high: @modelcontextprotocol/sdk - GHSA-w48q-cv73-mx4w
moderate: Hono has Body Limit Middleware Bypass - GHSA-92vj-g62v-jqhh
moderate: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass - GHSA-q7jf-gf43-6x6p

[matthew-heath]

would this need updated to

"opencontrol": "workspace:*" / latest version?

[matthew-heath]

would core sst package need version bumped from opencontrol@0.0.6 to latest change, subsequent to patching in this package?

[the-sides]

Can we get this merged? What are the incompatibilities with hono 4.10 that are slowing this down?

[smith558]

Can we get this merged? What are the incompatibilities with hono 4.10 that are slowing this down?

anomalyco/sst#6215

[vimtor]

i'm commited to fixing the security vulnerability in SST

for this we need to release a new version of Opencode and then update it on SST

i'm trying your branch @matthew-heath and i get the following error when trying to run the examples/bun

error: Cannot find module 'zod/v4' from '/Developer/opencontrol/node_modules/.bun/@modelcontextprotocol+sdk@1.24.2/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js'

how have you tested the change? i'm not as familiar with this codebase as with the SST one so if anyone can help me test this i will forward it to the core team

[matthew-heath]

i'm commited to fixing the security vulnerability in SST

for this we need to release a new version of Opencode and then update it on SST

i'm trying your branch @matthew-heath and i get the following error when trying to run the examples/bun

error: Cannot find module 'zod/v4' from '/Developer/opencontrol/node_modules/.bun/@modelcontextprotocol+sdk@1.24.2/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js'

how have you tested the change? i'm not as familiar with this codebase as with the SST one so if anyone can help me test this i will forward it to the core team

Hey @vimtor, thanks for your reply. I have just re-visited this, updating @modelcontextprotocol/sdk subsequently to Hono added additional needs. There was an override in root directory pinning the zod version to 3.24.2 but @modelcontextprotocol/sdk required either zod versions >3.25.0 or >4. I have updated in multiple places and it looks like running examples/bun starts up correctly now and can connect to google models (gemini-3-flash-preview in my case)

[vimtor]

working!

i'll push to get this merged and released by next week

[niclaszllaudi]

@vimtor Any updates on this? Would be great to get this merged to fix the various vulnerabilities in SST

[vimtor]

@niclaszllaudi waiting on the core team, probably getting merged this week