fix: upgrade hono to 4.12.25 (CVE-2026-54290) (#11023)

* fix: CVE-2026-54290 security vulnerability

Automated dependency upgrade by OrbisAI Security

Signed-off-by: orbisai0security <mediratta@gmail.com>
Signed-off-by: Anupam Mediratta <mediratta@gmail.com>

* fix(deps): override hono transitive dep to eliminate CVE-2026-54290

Add package.json `overrides` field to force hono@4.12.25 across the
entire dependency graph, including the transitive copy pulled in by
@modelcontextprotocol/sdk. Previously bun.lock retained a scoped
`@modelcontextprotocol/sdk/hono` entry resolved to the vulnerable
hono@4.12.8; the override removes that entry so only the patched
version ships.

Assisted-by: Claude Code:claude-sonnet-4-6
Signed-off-by: Anupam Mediratta <mediratta@gmail.com>

---------

Signed-off-by: orbisai0security <mediratta@gmail.com>
Signed-off-by: Anupam Mediratta <mediratta@gmail.com>

Author: anupamme

core/http/react-ui/bun.lock

@@ -15,6 +15,9 @@
     "build:coverage-v8": "COVERAGE_V8=true vite build",
     "coverage:report": "nyc report"
   },
+  "overrides": {
+    "hono": "4.12.25"
+  },
   "dependencies": {
     "@codemirror/autocomplete": "^6.18.6",
     "@codemirror/commands": "^6.8.1",
@@ -32,6 +35,7 @@
     "@modelcontextprotocol/sdk": "^1.25.1",
     "dompurify": "^3.4.12",
     "highlight.js": "^11.11.1",
+    "hono": "4.12.25",
     "i18next": "^26.0.8",
     "i18next-browser-languagedetector": "^8.2.1",
     "i18next-http-backend": "^3.0.6",