mcp-ts-core ^0.10.9, drop unused hono dependency
Framework adoption (^0.10.6 → ^0.10.9) plus a maintenance dependency pass.
Changed:
- Adopts the check-dependency-specifiers devcheck step (rejects floating latest/*/dist-tag specifiers in package.json and bun.lock workspaces) and lint:packaging check 10 (plugin-manifest descriptions, unscoped display identity, full-name npx install args), gated by devcheck.config.json packaging.pluginManifests.
- Framework brings the ctx.content image/audio collector, sharper canvas SQL gate classification (SELECT-shaped prepare failures throw invalid_sql with DuckDB binder detail), fresh-scaffold guards in build-changelog/devcheck, a check-skill-versions worktree-deletion guard, and the DuckdbProvider.describe() filter-qualification fix.
- Resyncs 14 vendored skills (add-export, add-provider removed upstream); populates .codex-plugin longDescription.
- TypeScript 6 adopted (^5.9.3 → ^6.0.3), reversing the 0.5.10 hold.
Removed:
- Unused direct hono dependency — it was unused in source and tripped a false direct-dep security-audit failure; hono remains available transitively via mcp-ts-core.
Dependency bumps:
- @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
- @biomejs/biome ^2.4.16 → ^2.5.0
- @types/node ^25.9.3 → ^26.0.0
- typescript ^5.9.3 → ^6.0.3
- vitest ^4.1.8 → ^4.1.9
219 tests pass; bun run devcheck clean.