chore(proxy): update MCP SDK and protobuf, clear hono advisories

[Wibias]

Summary

• Bump @modelcontextprotocol/sdk 1.29.0 → 1.30.0 — carries the @hono/node-server dependency-range widening past GHSA-frvp-7c67-39w9, stricter Content-Type validation, SSE keep-alive + timer-lifecycle fixes, Zod 3.25 method-literal support, and a stdio buffer limit.
• Bump @bufbuild/protobuf 2.12.1 → 2.13.0 — Protobuf Text Format support, erasable enum syntax, readMaxBytes option for sizeDelimitedDecode.
• Pin overrides to clear the remaining bun audit findings in the MCP SDK dependency tree: @hono/node-server 2.1.0 (GHSA-frvp-7c67-39w9) and hono 4.13.1 (GHSA-8j4g-w8fx-2239, GHSA-f23p-vx2j-j53r, GHSA-79qm-7rj5-m7r9, GHSA-54fx-42gc-7vw4).
• No application code changes; the diff is package.json + bun.lock only.

Validation

• bun run typecheck — pass
• bun audit — pass, 0 vulnerabilities after overrides
• bun install --frozen-lockfile --dry-run — pass, lockfile consistent
• Full bun run test cannot complete on this Windows host: Bun 1.3.14 crashes mid-suite (documented in ci.yml — the repo avoids hosted-Windows full-suite runs for this reason) and 7 codex-native-residue tests fail from a Windows account-lookup environment issue. Both reproduce identically on the clean dev base (56 pass / 2 skip / 7 fail in that file on base and head alike). CI runs the suite on Linux shards and is the authoritative test gate.

Review notes

• The MCP SDK widened @hono/node-server to ^1.19.9 || ^2.0.5, but bun resolves the 1.x line to 1.19.14 which is still below the advisory fix <2.0.5; the override forces 2.1.0 (same for hono, where ^4.11.4 resolves below the fixed 4.12.34).

Summary by CodeRabbit

• Chores
  • Updated supporting packages to newer versions.
  • Added server runtime packages to improve compatibility and deployment support.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0f8309b-6ab4-4ef0-ad63-a88593777d1f

📥 Commits

Reviewing files that changed from the base of the PR and between fb3cb40 and 052adb2.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

Updated @bufbuild/protobuf to ^2.13.0 and added pinned overrides for @hono/node-server and hono in package.json.

Changes

Dependency updates

Layer / File(s)	Summary
Package version alignment package.json:62, package.json:73-75	Updates @bufbuild/protobuf from ^2.12.0 to ^2.13.0. Adds 2.1.0 overrides for @hono/node-server and hono.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: lidge-jun, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency updates and Hono advisory remediation described in the pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}