chore(deps): bump @hono/node-server from 1.19.14 to 1.19.17

[dependabot]

Bumps @hono/node-server from 1.19.14 to 1.19.17.

Commits

• 71941da 1.19.17
• 0208500 ci: add stage option for publishing (#386)
• cbdf713 1.19.16
• 86e96c2 ci: add an action for trusted publisher (#385)
• 99c1a1a ci: run on v1.x branch pushes
• 84cb2ee Merge commit from fork
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

[cursor]

PR Summary

Low Risk
Patch/minor lockfile-only dependency updates with no application source changes; impact is limited to transitive HTTP/MCP stack versions.

Overview
Updates pnpm-lock.yaml to resolve @hono/node-server 1.19.14 → 1.19.17 and its peer hono 4.12.31 → 4.13.2. Those packages are pulled in through @modelcontextprotocol/sdk (e.g. Claude agent SDK), not as a direct app dependency change in this diff.

The lockfile also refreshes several packages in that same MCP / Express 5 subtree—jose, ajv, cors, express-rate-limit, eventsource-parser, content-type, cookie, range-parser, and related type-is / body-parser pins—plus metadata-only shifts (e.g. clearbit’s needle git resolution format and added deprecation notes on some entries).

^{Reviewed by Cursor Bugbot for commit 047a184. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bcb2f94. Configure here.}

[cursor]

Lockfile forces SSH for needle

High Severity

The clearbit dependency’s needle resolution changed from a public HTTPS codeload tarball to a git clone of git@github.com:clearbit/needle.git. CI runs pnpm i --frozen-lockfile without GitHub SSH keys, so installs can fail with public-key errors even though the intended change is only the @hono/node-server bump.

Additional Locations (2)

• pnpm-lock.yaml#L15710-L15711
• pnpm-lock.yaml#L18577-L18578

 

^{Reviewed by Cursor Bugbot for commit bcb2f94. Configure here.}