[aviggiano]

Summary

• Update Vitest from 4.1.11 to 4.1.12, which brings its exact @vitest/mocker dependency to the first patched release.
• Pin transitive Hono to 4.13.14 across the Smithers server, MCP SDK, and Hono node server dependency paths. The first patched release is 4.13.11.
• Resolve the red Dependabot security update jobs for Hono and @vitest/mocker.

Validation

• pnpm install --frozen-lockfile
• pnpm -w build
• pnpm -w format:check
• pnpm -w lint
• pnpm -w knip
• pnpm -w size
• pnpm -w security:dependency-advisories (passed with the existing approved production exception)
• Focused Vitest tests across all six affected workspace packages: 1,212 passed
• pnpm -w test:ci-scripts: 79 passed
• Exact-head CI is running.

Confidence Score: 5/5

The dependency updates appear safe to merge.

Summary

Updates vitest to 4.1.12 and pins transitive hono to 4.13.14.

• Workspace tests now use Vitest 4.1.12.
• The Smithers server and MCP SDK now use Hono 4.13.14.

_{Reviews (1) · Last reviewed commit: "fix(deps): resolve Hono and Vitest secur..." · Reviewed by Greptile}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T11:26:15.802800Z	03112af	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.11 ⏵ 4.1.12

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03112af5a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin Hono in the generated controller manifest

This override only affects the repository's pnpm installation. When a launch or resume installs the production .smithers workspace, renderSmithersPackageJson() instead uses REQUIRED_SMITHERS_OVERRIDES, which still omits Hono, and that installation runs without this lockfile under the existing 2026-10-25 resolution cutoff. Consequently, the Smithers server/MCP dependency path can continue resolving the pre-fix Hono version despite the root advisory check passing; add the pin to the generated manifest, update its cutoff/publish metadata as needed, and migrate the previously generated manifest shape.

Useful? React with 👍 / 👎.