This comment was translated automatically.

We are not using this dependency.

You're right that it's not a direct dependency — this repo never imports `@hono/node-server` in source. I've updated the PR to address that.

However, the vulnerable version is present in the resolved dependency graph via two transitive chains:

```
@hono/node-server@1.19.10
├─ @ai-sdk/devtools@0.0.17 → CherryStudio (devDependencies)
├─ @modelcontextprotocol/sdk@1.27.1
│ └─ @anthropic-ai/claude-agent-sdk@0.3.185 → CherryStudio (dependencies) ← runtime path
└─ (was also listed as direct dep — that was wrong, now removed)
```

The @anthropic-ai/claude-agent-sdk → @modelcontextprotocol/sdk → @hono/node-server chain is a runtime dependency, so the vulnerable version lands in the bundle. CVE-2026-29087 is an authorization bypass in the Serve Static Middleware — relevant if any code in that chain serves static files via hono.

What changed in the PR:

• Removed the erroneous direct entry from dependencies in package.json
• Added '@hono/node-server': '>=1.19.10' to the overrides block in pnpm-workspace.yaml — the correct pnpm mechanism for forcing a minimum transitive version without polluting the direct dependency list (consistent with how this repo already pins basic-ftp, undici, tar-fs, etc.)
• Cleaned up the bare lockfile entry that the previous approach had added

Happy to close this if you'd prefer to address it by upgrading the parent packages instead — but the override approach is the lightest-touch fix and matches what's already in pnpm-workspace.yaml for other CVEs.