MCP Inspector raises its hono floor to close three advisories

MCP Inspector's maintainers raised the project's declared range for hono from ^4.13.1 to ^4.13.7 in pull request #2302, closing three advisories against the runtime dependency.

The reasoning matters more than the version bump. Hono is a runtime dependency of the project's core/ package. A declared range like ^4.13.1 tells npm that anything 4.13.x or higher, below 5.0, is acceptable. The team's own lockfile might pin a safe patch version, but that lockfile only protects builds done inside their repo.

A downstream consumer installing MCP Inspector fresh pulls in core/ and has npm resolve the range from the manifest again. The lockfile plays no part in that resolution. If a vulnerable 4.13.x patch sits inside the old range, a fresh install can land on it even though the maintainers' checked-in lockfile never would.

The fix itself is small: tighten the floor to ^4.13.7 so every version in range is patched. What stands out is what the maintainers didn't do. They refused to run npm audit fix. That command resolves in-range advisories automatically, but it can do so by downgrading a package to an older patched version rather than upgrading it. The team's own local:gate check has no way to catch a silent downgrade like that, so they raised the floor by hand instead and wrote down why in the pull request.