v2: pnpm audit fixes (#1394)

Author: KKonstantinov

package.json

@@ -47,9 +47,9 @@
         "@changesets/cli": "^2.29.8",
         "@eslint/js": "catalog:devTools",
         "@modelcontextprotocol/client": "workspace:^",
-        "@modelcontextprotocol/conformance": "0.1.9",
-        "@modelcontextprotocol/node": "workspace:^",
+        "@modelcontextprotocol/conformance": "0.1.10",
         "@modelcontextprotocol/server": "workspace:^",
+        "@modelcontextprotocol/node": "workspace:^",
         "@pnpm/workspace.find-packages": "^1000.0.54",
         "@pnpm/workspace.read-manifest": "^1000.2.9",
         "@types/content-type": "catalog:devTools",

pnpm-lock.yaml

@@ -6,17 +6,17 @@ packages:
 
 catalogs:
     devTools:
-        '@eslint/js': ^9.39.1
+        '@eslint/js': ^9.39.2
         '@types/content-type': ^1.1.8
         '@types/cors': ^2.8.17
         '@types/cross-spawn': ^6.0.6
         '@types/eventsource': ^1.1.15
-        '@types/express': ^5.0.0
+        '@types/express': ^5.0.6
         '@types/express-serve-static-core': ^5.1.0
         '@types/supertest': ^6.0.2
         '@types/ws': ^8.5.12
         '@typescript/native-preview': ^7.0.0-dev.20251217.1
-        eslint: ^9.8.0
+        eslint: ^9.39.2
         eslint-config-prettier: ^10.1.8
         eslint-plugin-n: ^17.23.1
         prettier: 3.6.2
@@ -33,9 +33,9 @@ catalogs:
         cross-spawn: ^7.0.5
         eventsource: ^3.0.2
         eventsource-parser: ^3.0.0
-        jose: ^6.1.1
+        jose: ^6.1.3
     runtimeServerOnly:
-        '@hono/node-server': ^1.19.8
+        '@hono/node-server': ^1.19.9
         content-type: ^1.0.5
         cors: ^2.8.5
         express: ^5.2.1
@@ -57,6 +57,8 @@ linkWorkspacePackages: deep
 minimumReleaseAge: 10080 # 7 days
 minimumReleaseAgeExclude:
     - '@modelcontextprotocol/conformance'
+    - hono@4.11.4 # fixes https://github.com/advisories/GHSA-3vhc-576x-3qv4  https://github.com/advisories/GHSA-f67f-6cw9-8mq4  
+    - '@hono/node-server@1.19.9' # https://github.com/honojs/node-server/pull/295 
 
 onlyBuiltDependencies:
     - better-sqlite3