[horsefacts]

Bumps hono to >= 4.13.16 and @hono/node-server to >= 2.1.6, updating overrides where needed. The lockfile was regenerated with the repository's pinned package manager in lockfile-only mode.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tempo-docs	Ready	Preview	Nov 14, 2026 1:50am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hono@​4.13.14 ⏵ 4.13.18	+1	+6	+1

View full report

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

[claude]

LGTM. The follow-up commit removes the hono@<4.13.16 and @ hono/node-server@<2.1.6 overrides, so transitive consumers are no longer pinned to exact versions.

What was reviewed:

• The lockfile matches the new ^4.13.16 specifier and the wata>@ hono/node-server: 2.1.6 override. The @ hono/node-server@ 2.1.6 peer range is back to ^4 || ^5.0.0-0, and 4.13.14 is gone.
• Two hono copies remain: 4.13.18 for the root and the mppx 0.13.3 peer, and 4.13.16 for the transitive consumers. Both are at or above the 4.13.16 floor and all the ranges allow either, so a later dedupe is optional.
• The comment above the wata override is still accurate for the 2.1.5 to 2.1.6 patch bump.
• Not run: pnpm build, pnpm check:types and pnpm test. I only read the code.

Extended reasoning...

The change touches only dependency metadata: one direct specifier bump in package.json, one override version bump in pnpm-workspace.yaml, and the regenerated pnpm-lock.yaml. It changes no application code and no auth, crypto or data-handling code. My earlier inline concern was about the open-ended hono and node-server overrides pinning transitive consumers, and commit 892f681 addressed it by removing both overrides. No CODEOWNERS file covers these paths, the timeline shows no other reviewer objections, and the bug hunt ran to a dry streak with no findings.