chore: upgrade hono to ^4.13.2 to address CVE-2026-71848, CVE-2026-71849, CVE-2026-71850

[claude]

Refreshes the hono lockfile entry so the transitive dependency pulled in by @modelcontextprotocol/sdk resolves to a patched release.

• hono 4.12.25 -> 4.13.2 (patched floor 4.12.34)

The existing ^4.11.4 range already admitted a patched version, so no package.json change or resolutions override was needed. Only yarn.lock changes.

Advisories addressed

• CVE-2026-71848: algorithmic complexity DoS in the language detector middleware
• CVE-2026-71849: proxy helper does not remove response headers listed in the Connection header
• CVE-2026-71850: memo() retains SSR output across requests

Verification

• yarn install --immutable
• yarn why hono reports hono@npm:4.13.2 for every requester, no 4.12.x instance remains
• yarn test passes (1954 tests across queryLanguage, shared, backend, web)

Fixes SOU-2003
Fixes SOU-2004
Fixes SOU-2005

🤖 Generated with Claude Code

---

Note

^{Cursor Bugbot is generating a summary for commit 40b45ca. Configure here.}

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.