[AviPeltz]

Summary

Bumps dependencies to patched versions. Also raises the root overrides for @modelcontextprotocol/sdk (1.31.0 → 1.32.0) and hono (4.13.7 → 4.13.11); without it the override would pin every workspace to the vulnerable version.

Closes Dependabot alerts:

storybook → 10.6.2 (with @storybook/* packages on the same version) in packages/ui, apps/desktop, apps/mobile

• Misc bug fixes and notifs #396, Add dropdown create modal #391, chore(desktop): bump version to 0.0.24 #392 (critical): Missing origin validation in Storybook preview allows code injection from malicious websites

@modelcontextprotocol/sdk → 1.32.0 in packages/cli, apps/docs, apps/api

• refactor (Desktop): Make it so when you make a new terminal it makes it in your screen #381, chore(all): update readme with env shit #379, chore(desktop): bump version to 0.0.22 #375 (high): One HTTP request within the default size limit could exhaust server memory during validation
• feat(desktop): add description to presets #380, add bun dev:app to run dev #378, feat(desktop): add PostHog feature flag to gate auth requirement #374 (medium): Server bearer authentication accepted tokens issued for another service
• fix(clerk): remove unnecessary domain and isSatellite props #367, Use vscode theme defaults #362, feat(desktop): add non worktree tabs for different branches that arent worktrees #359 (high): Experimental tasks were not tied to the session that created them
• feat(desktop): replace keychain storage with encrypted file storage #366, Stage/unstage all changes #361, Copy path in changes #358 (medium): HTTP client transports and OAuth requests followed cross-origin redirects

hono → 4.13.11 in packages/host-service, apps/relay, apps/realtime

• chore(desktop): bump version to 0.0.18 #368, chore(desktop): bump version to 0.0.17 #364, clamp values #363 (medium): serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Not included, already covered by open Dependabot PRs: #8695 (hono usercontent), #8693/#8696 (MCP SDK trpc/mcp), #8738/#8694 (vite), #8739 (electron 41 → 42 major), #8740 (storybook chat-ui). Those PRs will conflict with the root override bump on rebase.

Test plan

• bun install (lockfile refreshed)
• bun run lint:fix clean
• bun run typecheck passes in apps/api, apps/desktop, apps/docs, apps/relay, apps/realtime, packages/cli, packages/host-service, packages/ui
• apps/mobile typecheck fails with the same 12 errors on unmodified main (unref on number in packages/port-scanner and packages/workspace-fs); not caused by this change
• Smoke-test Storybook in packages/ui and apps/desktop

---

Summary by cubic

Bumps storybook to 10.6.2, @modelcontextprotocol/sdk to 1.32.0, and hono to 4.13.11 across affected workspaces to resolve Dependabot alerts. Also raises the root overrides for @modelcontextprotocol/sdk and hono to the patched versions; without this, the override would pin every workspace to the vulnerable version.

What each bump fixes

• storybook 10.6.2 (packages/ui, apps/desktop, apps/mobile): closes a critical missing origin validation in the Storybook preview that allowed code injection from malicious sites.
• @modelcontextprotocol/sdk 1.32.0 (packages/cli, apps/docs, apps/api): fixes memory exhaustion during validation, bearer tokens accepted across services, experimental tasks not tied to their creating session, and cross-origin redirects in HTTP client transports and OAuth requests.
• hono 4.13.11 (packages/host-service, apps/relay, apps/realtime): fixes serveStatic double-decoding the request path, which let requests bypass middleware on static paths.

Lockfile refreshed; lint and typecheck pass except in apps/mobile, which fails with the same 12 pre-existing errors as unmodified main. Open Dependabot PRs for related upgrades (electron 42, vite, MCP SDK trpc/mcp, storybook chat-ui) are kept separate and will conflict with the root override bump on rebase.

^{Written for commit 8b02d72. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Updated supporting components used across the API, documentation, command-line tools, and service features.
  • Refreshed the components used to build and preview desktop, mobile, and shared UI experiences.
  • These updates do not describe changes to user-facing features or behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2668221e-3880-41fa-95a8-dceb6c14f20d

📥 Commits

Reviewing files that changed from the base of the PR and between bdf1e2e and 8b02d72.

⛔ Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 10

• apps/api/package.json
• apps/desktop/package.json
• apps/docs/package.json
• apps/mobile/package.json
• apps/realtime/package.json
• apps/relay/package.json
• package.json
• packages/cli/package.json
• packages/host-service/package.json
• packages/ui/package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The PR updates the declared versions of the MCP SDK, Storybook packages, and Hono across the root, application, and package manifests.

Changes: MCP SDK version update

Layer / File(s)	Summary
MCP SDK dependency versions package.json, apps/api/package.json, apps/docs/package.json, packages/cli/package.json	The MCP SDK dependency declarations and root override change from 1.31.0 to 1.32.0.

Storybook version update

Layer / File(s)	Summary
Storybook package versions apps/desktop/package.json, apps/mobile/package.json, packages/ui/package.json	Storybook packages change from 10.4.2 to 10.6.2.

Hono version update

Layer / File(s)	Summary
Hono dependency versions package.json, apps/realtime/package.json, apps/relay/package.json, packages/host-service/package.json	Hono dependency declarations and the root override change from 4.13.7 to 4.13.11.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: saddlepaddle

Merge Risk: ⚪ Minimal · up to 8b02d

This change updates the MCP SDK, Storybook and Hono to patched versions. The manifests, root overrides and lockfile agree, so no merge-blocking issue was found. The author notes that a Storybook smoke test is still unchecked, which is a routine verification step.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title uses conventional commit format and clearly identifies the dependency upgrades and their purpose of resolving Dependabot alerts.
Description check		The description explains the dependency updates, affected workspaces, security issues addressed, test results, pre-existing mobile typecheck failures, and excluded alerts. The Storybook smoke test rem…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the dependency updates, affected workspaces, security issues addressed, test results, pre-existing mobile typecheck failures, and excluded alerts. The Storybook smoke test remains unchecked, but the description is sufficiently complete.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (10 skipped: 10 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
start hook: the runner asked host-service once the push landed/ start hook: the runner asked host-service once the push landed	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

🚀 Preview Deployment

🔗 Preview Links

Service	Status	Link
Database (Neon)	✅	View Branch
API (Vercel)	✅	Open Preview
Web (Vercel)	✅	Open Preview
Marketing (Vercel)	✅	Open Preview
Docs (Vercel)	✅	Open Preview

---

Preview updates automatically with new commits

[expo]

Preview update published for development build f943abc4 (fingerprint e28b4b490ccc). Open the build on your phone and scan:

Update group 40b995ca

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable regression was found.

Summary

Updates dependencies to address the listed Dependabot alerts.

• Storybook tools in the UI, desktop, and mobile workspaces move to version 10.6.2.
• The API, docs, and CLI workspaces use MCP SDK 1.32.0.
• Host-service, relay, and realtime use Hono 4.13.11.

Review checks were limited to source and lockfile inspection. No install, build, typecheck, or Storybook smoke test was run.

Acknowledged scope and existing issues:

• AviPeltz explicitly deferred the remaining Storybook upgrade in packages/chat-ui to chore(deps-dev): bump storybook from 10.4.2 to 10.6.2 in /packages/chat-ui #8740.
• AviPeltz identified the existing 12 mobile typecheck errors as unchanged from main; they are not attributed to this PR.

_{Reviews (1) · Last reviewed commit: "fix(deps): bump storybook, @modelcontext..." · Reviewed by Greptile}