[finding] upgrading a consumer from 17.4.0 to 17.5.0 keeps `hono@4.13.3` on the `@objectstack/cli` → `@objectstack/mcp` → `@modelcontextprotocol/sdk` path — the raised `hono` floor does not reach it

[hotlong]

Observed on a real upgrade: HotCRM 17.4.0 → 17.5.0, 2026-09-29

After bumping every @objectstack/* to 17.5.0 and running a plain pnpm install (lockfile-preserving), pnpm why hono shows two copies:

• hono@4.13.11 via @objectstack/plugin-hono-server, the raised floor from ca31ff6;
• hono@4.13.3 via @objectstack/cli → @objectstack/mcp → @modelcontextprotocol/sdk@1.30.0, which declares ^4.11.4.

The monorepo's pnpm-workspace.yaml overrides do not ship to consumers. An app that upgrades therefore keeps the older hono on the MCP/CLI path. An upgrader could reasonably read the release note "floors raised to clear OSV advisories" as covering their whole tree.

Ask

Do one of the following:

• declare a direct hono floor on @objectstack/mcp (or cli) so a consumer's install dedupes onto the patched line;
• tell upgraders to run pnpm update hono (or the equivalent for their package manager) in the release notes.

---

Generated by Claude Code

[objectstack-fleet]

Path: the road's upgrade step — an upgrader's tree is as clean as the release note says | 缺项 (a lockfile-preserving upgrade keeps hono@4.13.3 under @modelcontextprotocol/sdk, a copy objectstack never loads) | P3

Triage: first grade — documentation · dependencies · priority:p3 · domain:devx · area:devpath · pm:on-hold. Direction: one upgrade line, not a dependency declaration. It rides the maintainer's 17.5.0-aftercare call

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T10:05Z. ⛔ Not a claim, ⛔ not a dispatch. tooling comes off: the card names no Unblocks: target, and its deliverable is text for upgraders.

Measured on the published 17.5.0 packages

• The dependency path.

  • @objectstack/cli@17.5.0 depends on @objectstack/mcp@17.5.0, which declares @modelcontextprotocol/sdk ^1.30.0.
  • The SDK (1.30.0 and 1.31.0 alike) declares hono ^4.11.4.
  • @objectstack/plugin-hono-server@17.5.0 declares hono ^4.13.5.

• The advisories (npm's bulk advisory endpoint). hono below 4.13.5 carries three moderate advisories:

  • GHSA-gqvv-2mrq-wpjv (toSSG() path traversal);
  • GHSA-g6gw-c38x-mqfc (parseBody() nesting);
  • GHSA-crvj-82cr-hjcx (the query parser reading past the fragment).

  4.13.5 and 4.13.11 answer none.

• Installed, never loaded.

  • The published @objectstack/mcp@17.5.0 dist imports only the SDK's server/mcp.js, server/stdio.js, server/webStandardStreamableHttp.js and types.js.
  • In the SDK 1.30.0 tarball, the only modules that import hono or @hono/node-server are server/streamableHttp.js and an example, and objectstack imports neither.
  • ⇒ No objectstack code path loads the stale copy, so there is no security label. The harm is a consumer's own scanner going red, plus a release note an upgrader reads as covering their whole tree.

• Only a preserved lockfile keeps it. A fresh install resolves ^4.11.4 to 4.13.11.

Direction

• ⛔ Not the first ask.
  • A direct hono floor on @objectstack/mcp would declare a dependency the package never imports.
  • pnpm resolves the SDK's own hono range for the SDK. So under a preserved lockfile, the SDK's entry is not expected to move.
• Take the second ask, as one line for upgraders. In substance: the raised floors cover what objectstack loads. A lockfile-preserving upgrade can keep an older hono under @modelcontextprotocol/sdk, which objectstack never loads. pnpm update hono, or the equivalent for your package manager, clears a scanner.
• The vehicle is the maintainer's open 17.5.0-aftercare call ([finding] release.yml: every main landing between the version-PR merge and the approval queues a new publish deployment, evicts the waiting one, and ships main's head instead of the version commit — ADR-0125 D1's premise does not hold #20613): annotate the 17.5.0 notes, or cut 17.5.1 with the unconsumed changesets. Both are one line, and this card must not pick between them.

Restart-when: the maintainer's 17.5.0-aftercare call is recorded. If the call is to annotate, this line joins that annotation. If it is 17.5.1, this line goes into that release's changeset text.

[objectstack-fleet]

Triage: pm:on-hold → pm:queue, regraded p3 → p2. The 17.5.0-aftercare call is made; this card now carries the next release's aftercare changeset

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T15:31Z. ⛔ Not a claim, ⛔ not a dispatch.

Provenance. This is executed on the maintainer's call. In the triage seat's chat (session session_01AavokzJ5DndAwitDXvKy4U), asked "annotate the 17.5.0 notes, or cut 17.5.1", the maintainer replied, verbatim: 「可以发 17.5.1 ，但是你应该统一看一下有哪些遗留问题需要发版本之前解决」. So this card's Restart-when: is met: the call is a follow-up release, and the hono line goes into that release's changeset text.

Measured: the next version is 17.6.0, not a patch. The open Version Packages PR #20639 computes 17.6.0 for the whole fixed group. main carries 44 pending changesets.

• 16 of them already shipped inside 17.5.0, unannounced. They were added between the version commit 8c87d26a5d and the published head 0f6dcac5e9 ([finding] release.yml: every main landing between the version-PR merge and the approval queues a new publish deployment, evicts the waiting one, and ships main's head instead of the version commit — ADR-0125 D1's premise does not hold #20613's defect, fixed by PR fix(release): queue the publish only on the push that carries the version commit, and publish that commit (ADR-0125 D1 amended) #20625). 6 are minor, and 3 carry breaking notes (PR feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458, PR fix(spec,driver-turso)!: refuse a forced mode replica with no syncUrl at authoring and at construction (#20437) #20504, PR feat(spec)!: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (#20288) #20567).
• 28 are new. 8 of them are minor, which is why the computed version is 17.6.0. The maintainer is being told the number in chat; ⛔ this card does not pick it.

The deliverable: one patch changeset, so it rides whichever version the maintainer ships, in two parts:

1. An upgrade line (the original ask). In substance: the raised dependency floors cover what objectstack loads. A lockfile-preserving upgrade can keep an older hono under @modelcontextprotocol/sdk, which objectstack never loads, and pnpm update hono (or the equivalent) clears a scanner.

2. A "shipped in 17.5.0 without notes" section. It names these 16 entries by their PRs, so a reader of the new CHANGELOG knows they were already live in 17.5.0. The 3 with breaking notes are called out first:

   • PR feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458, PR fix(spec,driver-turso)!: refuse a forced mode replica with no syncUrl at authoring and at construction (#20437) #20504, PR feat(spec)!: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (#20288) #20567 (breaking);
   • PR fix(spec,cli): os validate / os build read the ADR-0087 conversions defineStack applied — --json conversions and --strict see the producer's record #20579, PR feat(sdui-parser): the manifest marks the html tier's intrinsic tags tier: 'html', ported from objectui's lockstep copy #20582, PR fix(service-automation,metadata-protocol,metadata,runtime): withhold a flow's inbound-hook secret from every served definition, and keep it on a round trip (#20552) #20585;
   • PR fix(spec): os migrate meta guidance for fourteen more migration-entry families states each lesson in words, not tracker numbers (stage 7) #20568, PR refactor(spec): step 18 rationale as key-sorted fragments, conversionIds derived, so two retirements merge clean #20572, PR docs(spec): re-anchor the dead tracker citations in ui/ and two freed sites to the commits that decided them (stage 5) #20576, PR fix(spec,objectql): name the aggregated column at having, PostgreSQL only at where #20577, PR fix(plugin-security): an organization-less permission-set read resolves organization-less rows only #20584, PR fix(spec): nextUtcCalendarDay and utcInstantMs read years 0001..0099 as written, not as 1900..1999 (#20550) #20591, PR fix(plugin-security): security/explain answers enforcement's refusal for a row-level policy comparing two fields of no shared comparison class #20598, PR fix(plugin-audit): describe sys_comment reactions and mentions by the shape they store (#20558) #20605, PR docs(spec): re-anchor the dead tracker citations in the packages/spec/src remainder to the commits and ADRs that decided them (stage 6) #20606.

   PR feat(spec)!: RealtimeEventType names the emitted data.record.* / data.records.* vocabulary (#20288) #20567 carries two changesets.

• ⛔ Don't edit or delete the 16 changesets. Their own text is correct; only their release was early. ⛔ No security detail beyond the PR titles.

Why p2. It gates the release: the notes must be true when the version ships. It lands before the Version Packages PR merges.