chore(deps): bring main's rc-series bumps to v2/main (@hono/node-server 2.x, vite 8.1.5) - #1881
Merged
Merged
Conversation
…8.1.5) The 2.0.0-rc series shipped these dependency bumps to `main` only, so `v2/main` was developing against older versions and would have met them for the first time at the milestone merge. - `@hono/node-server` ^1.19.14 -> ^2.0.12 (root, clients/web) — a major. v2.0.0's only breaking changes are dropping Node 18 (the repo already requires >=22.19.0) and removing the `@hono/node-server/vercel` adapter (unused here). The used surface — `serve()`, `serveStatic`, `ServerType` — is unchanged, so no source edits were needed. - `vite` ^8.0.0 -> ^8.1.5 (root, clients/web) and ^8.0.16 -> ^8.1.5 (clients/tui) — the security bumps from #1841. `npm install` at the root (postinstall cascades into every client) regenerated the three touched lockfiles. `npm run ci` passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
There was a problem hiding this comment.
Pull request overview
Syncs v2/main with main’s earlier rc-series dependency upgrades so the v2 development branch doesn’t first encounter the @hono/node-server 2.x major and Vite 8.1.5+ changes at the milestone merge.
Changes:
- Bump
@hono/node-serverfrom^1.19.14→^2.0.12(root + web). - Bump
vitefrom^8.0.x→^8.1.5(root + web + tui), resulting invite@8.2.0in lockfiles. - Regenerate and commit the impacted lockfiles (root, web, tui) after a root
npm installcascade.
Reviewed changes
Copilot reviewed 3 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Updates root @hono/node-server and vite version ranges to match main. |
| package-lock.json | Records re-resolved dependency graph for the updated root ranges (incl. vite@8.2.0, @hono/node-server@2.0.12). |
| clients/web/package.json | Updates web client’s @hono/node-server and vite version ranges to match main. |
| clients/web/package-lock.json | Records updated web dependency resolution for the new ranges. |
| clients/tui/package.json | Updates TUI’s vite range to ^8.1.5. |
| clients/tui/package-lock.json | Records updated TUI dependency resolution for the new vite range. |
Files not reviewed (2)
- clients/tui/package-lock.json: Generated file
- clients/web/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1875
Step 3 of the ordered plan in #1821. The 2.0.0-rc series shipped these dependency bumps to
mainonly, sov2/mainwas developing against older versions and would have met them for the first time at the milestone merge. This brings them across.Version changes, per manifest
package.json(root)@hono/node-server^1.19.14^2.0.12package.json(root)vite^8.0.0^8.1.5clients/web/package.json@hono/node-server^1.19.14^2.0.12clients/web/package.jsonvite^8.0.0^8.1.5clients/tui/package.jsonvite^8.0.16^8.1.5These are exactly the manifests that declare either package (
clients/cliandclients/launcherdeclare neither), and the resulting ranges matchmain.npm installwas then run at the repo root (itspostinstallcascades into every client), and the three touched lockfiles — root,clients/web,clients/tui— are committed.viteresolves to8.2.0within the new^8.1.5range;@hono/node-serverresolves to2.0.12.The
@hono/node-servermajorThis is the one real decision in the change. v2.0.0 has exactly two breaking changes:
>=22.19.0, so this is a no-op here.@hono/node-server/verceladapter was removed. Nothing in the repo imports it (grepoverclients,core,scriptsfinds no match).The release notes state "the public API stays the same," and the only surface this repo uses is
serve(),serveStatic(from@hono/node-server/serve-static), and theServerTypetype — all unchanged. Call sites areclients/web/server/server.tsplus thecore/mcp/remote/nodeintegration tests, and none needed edits.Gate
npm run cifrom the repo root — passed. Nothing broke; no source changes were needed beyond the manifest/lockfile updates.Out of scope (transitive, deliberately not chased)
@modelcontextprotocol/sdk1.29 → 1.30 is not our dependency. v2's direct SDK dependencies are the split packages pinned exactly at2.0.0-beta.5(@modelcontextprotocol/{client,core,server,server-legacy}). The v1 SDK is present only as an auto-installed peer of@modelcontextprotocol/ext-apps@1.7.4, which still declares"@modelcontextprotocol/sdk": "^1.29.0". Any movement in the lockfile is a re-resolution within that caret range — nothing here pins or edits it.@oxc-project/typeslikewise floats transitively under vite/rolldown.Both appear in the lockfile diff as install side effects only.