fix: Resolve npm audit vulnerabilities in the TypeScript MCP server

[hatayama]

Summary

• Resolves an existing npm audit security failure in the TypeScriptServer package, unrelated to any specific feature.

User Impact

• npm audit was reporting 4 vulnerabilities (3 moderate, 1 high) in the TypeScript MCP server's dependency tree, pulled in transitively through @modelcontextprotocol/sdk and pinned by the package.json overrides block (@hono/node-server, hono, fast-uri).
• These vulnerabilities are now resolved with no breaking changes to server behavior.

Changes

• Raise the overrides pins for @hono/node-server (1.19.13 → 2.0.11) and hono (4.12.25 → 4.12.31).
• Apply the resulting fast-uri lockfile update via npm audit fix.
• Rebuild the bundled server output to reflect the updated dependencies.

Verification

• npm audit --audit-level=moderate → 0 vulnerabilities
• npm run build → succeeds
• npm test → 7 suites / 42 tests passed
• npm run lint:check → 0 errors (pre-existing warnings only, unrelated to this change)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ca9049fd-f98e-4060-b8e6-93986d4c3429

📥 Commits

Reviewing files that changed from the base of the PR and between 9ca7b6f and e005592.

⛔ Files ignored due to path filters (3)

• Packages/src/TypeScriptServer~/dist/server.bundle.js is excluded by !**/dist/** and included by **/*.js
• Packages/src/TypeScriptServer~/dist/server.bundle.js.map is excluded by !**/dist/**, !**/*.map and included by none
• Packages/src/TypeScriptServer~/package-lock.json is excluded by !**/package-lock.json and included by **/*.json

📒 Files selected for processing (1)

• Packages/src/TypeScriptServer~/package.json

---

📝 Walkthrough

Walkthrough

The TypeScript server package updates pinned Hono dependency overrides to newer versions.

Changes

Hono dependency updates

Layer / File(s)	Summary
Update Hono overrides Packages/src/TypeScriptServer~/package.json	Updates @hono/node-server to 2.0.11 and hono to 4.12.31.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• hatayama/unity-cli-loop#907: Updates the same Hono dependency overrides in package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: fixing npm audit vulnerabilities in the TypeScript MCP server.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/npm-audit-typescript-server

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

Packages/src/TypeScriptServer~/package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}