chore(deps): move @hono/node-server to 2.x and lift systeminformation

The serveStatic double decode has no fix on the 1.x line, and the MCP
SDK accepts 2.x. The app uses the web-standard transport and never loads
it. systeminformation sits under the shadcn CLI at dev time.

CHANGELOG.md

@@ -16,6 +16,14 @@
 - Dependabot no longer proposes a new Node major for the image. The major
   is tied to `engines`, `.nvmrc` and `.node-version` and moves by hand.
 
+### Security
+
+- `@hono/node-server` moves to the 2.x line, which fixes a second decode of
+  the request path in `serveStatic`. It arrives under the MCP SDK; the app
+  uses the SDK's web-standard transport and never loads it, but the copy
+  was in the tree. `systeminformation`, under the shadcn CLI at dev time,
+  moves past a Windows command injection.
+
 ## [1.47.0] — 2026-11-04
 
 ### Added

Dockerfile

@@ -133,7 +133,7 @@ RUN mkdir -p /opt/prisma-cli && \
     npm init -y && \
     npm pkg set 'overrides.deepmerge-ts=^8.0.0' && \
     npm pkg set 'overrides.mysql2=^3.22.0' && \
-    npm pkg set 'overrides.@hono/node-server=^1.19.15' && \
+    npm pkg set 'overrides.@hono/node-server=^2.1.3' && \
     npm pkg set 'overrides.valibot=^1.4.2' && \
     npm pkg set 'allowScripts.@prisma/engines=true' 'allowScripts.prisma=true' 'allowScripts.esbuild=true' --json && \
     npm install --omit=dev prisma@7.10.1 @prisma/engines@7.10.1 tsx@4.23.1 dotenv@18.0.9 --no-fund --no-audit

pnpm-lock.yaml

@@ -12,12 +12,13 @@ overrides:
   dompurify@<3.4.17: ^3.4.17
   postcss@<8.5.23: ^8.5.23
   nanoid@<3.3.18: ^3.3.18
-  '@hono/node-server@<1.19.15': ^1.19.15
+  '@hono/node-server@<2.1.3': ^2.1.3
   picomatch@<4.0.4: ^4.0.4
   body-parser@<2.4.0: ^2.4.0
   source-map-js@<1.2.2: ^1.2.2
   postcss-selector-parser@<7.1.6: ^7.1.6
   smol-toml@<1.9.0: ^1.9.0
+  systeminformation@<5.33.16: ^5.33.16
   qs@<6.16.0: ^6.16.0
   fast-uri@<3.1.9: ^3.1.9
   flatted@<3.4.2: ^3.4.2
@@ -870,9 +871,9 @@ packages:
   '@hexagon/base64@1.1.28':
     resolution: {integrity: sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==}
 
-  '@hono/node-server@1.19.17':
-    resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==}
-    engines: {node: '>=18.14.1'}
+  '@hono/node-server@2.1.6':
+    resolution: {integrity: sha512-p/KH9MnfNcsm3sR6x4lNgm5j+QN4Et8srKredl9DZfXiyZ1UQ3aQ2YVpFLbqktYN5JI+DB+VZFKM2PqE5hLKjQ==}
+    engines: {node: '>=20'}
     peerDependencies:
       hono: ^4.13.11
 
@@ -6679,8 +6680,8 @@ packages:
     resolution: {integrity: sha512-qsjeeq5YjBZ5eMdFuUa4ZosMLxgr5RZ+F+Y1OrDhuOCEInRMA3x74XdBtggJcj9kOeInz0WE+LgCPDkZFlBYJw==}
     engines: {node: '>=12.0.0'}
 
-  systeminformation@5.33.15:
-    resolution: {integrity: sha512-s5RloL0F7xhN0ZjfHtLGnbf7EW74EI0N8NFL+1xR7Oxz9QA33obNZsl7lyfnJOhN04E/kGFPoJPlvY7TZ5fzmw==}
+  systeminformation@5.33.19:
+    resolution: {integrity: sha512-Zm7wGeCG7PqfvzegMJIzrxICopWqYCeLATVmvxOOci1isLcNVKgY4Fr0hhYQzvc7cgtK3377jQVChTFAnznOiA==}
     engines: {node: '>=10.0.0'}
     os: [darwin, linux, win32, freebsd, openbsd, netbsd, sunos, android]
     hasBin: true
@@ -7925,7 +7926,7 @@ snapshots:
       object-treeify: 1.1.33
       open: 8.4.2
       picomatch: 4.0.7
-      systeminformation: 5.33.15
+      systeminformation: 5.33.19
       undici: 7.30.1
       which: 4.0.0
       yocto-spinner: 1.2.2
@@ -8079,7 +8080,7 @@ snapshots:
 
   '@hexagon/base64@1.1.28': {}
 
-  '@hono/node-server@1.19.17(hono@4.13.13)':
+  '@hono/node-server@2.1.6(hono@4.13.13)':
     dependencies:
       hono: 4.13.13
 
@@ -8374,7 +8375,7 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.32.2(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.6.7)':
     dependencies:
-      '@hono/node-server': 1.19.17(hono@4.13.13)
+      '@hono/node-server': 2.1.6(hono@4.13.13)
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 1.0.5
@@ -14105,7 +14106,7 @@ snapshots:
   svg-pathdata@6.0.3:
     optional: true
 
-  systeminformation@5.33.15: {}
+  systeminformation@5.33.19: {}
 
   tagged-tag@1.0.0: {}
 

pnpm-workspace.yaml

@@ -22,13 +22,13 @@ overrides:
   # bump; the fix landed in 8.5.23.
   "postcss@<8.5.23": "^8.5.23"
   "nanoid@<3.3.18": "^3.3.18"
-  # GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. Mirrored for
-  # /opt/prisma-cli in the Dockerfile, which is where the flagged 1.19.11
-  # actually landed: prisma pulls it through @prisma/dev, and that install
-  # reads npm `overrides`, not this file. The bound stays on the 1.x line
-  # because the advisory is fixed there too and 2.x is a major nothing asked
-  # for.
-  "@hono/node-server@<1.19.15": "^1.19.15"
+  # GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. The
+  # serveStatic double decode fixed in 2.1.3 has no fix on the 1.x line, so
+  # the bound moves to 2.x, which the MCP SDK accepts (`^1.19.9 || ^2.0.5`).
+  # The app never calls serveStatic; the copy sits on the MCP path all the
+  # same. Mirrored for /opt/prisma-cli in the Dockerfile, where an older
+  # @prisma/dev once pulled it in.
+  "@hono/node-server@<2.1.3": "^2.1.3"
   "picomatch@<4.0.4": "^4.0.4"
   # CVE-2026-111181 (HIGH) raised the floor from 2.3.0. The copy arrives
   # under express in the MCP SDK, on a production path.
@@ -40,6 +40,9 @@ overrides:
   "source-map-js@<1.2.2": "^1.2.2"
   "postcss-selector-parser@<7.1.6": "^7.1.6"
   "smol-toml@<1.9.0": "^1.9.0"
+  # Command injection through services() on Windows, under shadcn's CLI at
+  # dev time only. 5.33.16 has the fix.
+  "systeminformation@<5.33.16": "^5.33.16"
   # Array-limit bypass through bracket-key comma parsing, and a denial of
   # service through an attacker-controlled isBuffer. 6.16.0 covers both.
   "qs@<6.16.0": "^6.16.0"