fix(deps): bump zod, hono and image runtimes

.github/CONTRIBUTING.md

@@ -4,7 +4,7 @@ Thanks for taking the time. This document covers what you need to build the gate
 
 ## Setup
 
-You need [Bun](https://bun.sh) 1.4.2 or newer. Docker is optional and only needed for the container runtime and its tests.
+You need [Bun](https://bun.sh) 1.4.4 or newer. Docker is optional and only needed for the container runtime and its tests.
 
 ```sh
 bun install

.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.4.2
+          bun-version: 1.4.4
       - run: bun install --frozen-lockfile
       - run: bun run check
       - run: bun run typecheck

CHANGELOG.md

@@ -6,6 +6,13 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+### Security
+
+- **`zod` moves to 4.6.7**, closing CVE-2023-54404 (denial of service through validation of an unbounded array). Every request body the gateway accepts, including the MCP and OAuth endpoints, is validated with zod, so this was reachable.
+- **The image is rebuilt on a patched Debian base and ships uv 0.12.19, Bun 1.4.4 and npm 12.2.1**, closing the OpenSSL advisories (CVE-2026-84782 and four medium ones), CVE-2026-104843 and GHSA-2mjx-qc3c-rqvc in uv.
+- **`hono` moves to 4.13.13; `body-parser`, `fast-uri`, `ip-address` and `qs` are bumped in the lockfile**, closing CVE-2026-111757, CVE-2026-111181, CVE-2026-110306, CVE-2026-110180 and CVE-2026-111997. None of these code paths is used by the gateway (it does not use `serveStatic` and never imports `express`), the bumps clear the scanner findings.
+- **The `undici` and `ip-address` copies bundled inside npm itself stay flagged** until npm ships a release that updates them; npm only launches `npx` servers and never handles gateway traffic.
+
 ## [0.2.5] - 2026-10-08
 
 ### Security

Dockerfile

@@ -1,7 +1,7 @@
-ARG BUN_VERSION=1.4.2
+ARG BUN_VERSION=1.4.4
 ARG NODE_VERSION=22
-ARG UV_VERSION=0.12.15
-ARG NPM_VERSION=12.2.0
+ARG UV_VERSION=0.12.19
+ARG NPM_VERSION=12.2.1
 
 FROM oven/bun:${BUN_VERSION}-slim AS bun
 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv

apps/gateway/package.json

@@ -22,9 +22,9 @@
     "@modelcontextprotocol/sdk": "1.32.1",
     "@modelcontextprotocol/server": "2.3.1",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.13.7",
+    "hono": "4.13.13",
     "jose": "^6.1.0",
-    "zod": "^4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@types/bun": "^1.4.0",

apps/web/package.json

@@ -23,7 +23,7 @@
     "vue": "^3.5.42",
     "vue-router": "^5.3.1",
     "vue-sonner": "^2.0.9",
-    "zod": "^4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",

packages/schema/package.json

@@ -8,6 +8,6 @@
     ".": "./src/index.ts"
   },
   "dependencies": {
-    "zod": "^4.6.5"
+    "zod": "4.6.7"
   }
 }