[leehack]

Summary

• Update the private legacy TypeScript fixture override for @hono/node-server from 2.1.3 to 2.1.8.
• Resolve transitive hono from 4.13.13 to 4.13.18 within the SDK’s existing range, without a new direct dependency or override.
• Correct the fixture README security-version documentation.

Addresses Dependabot alerts 94 and 95, plus pre-existing Hono audit findings. The existing repository override prevented Dependabot from applying a fix.

Approved CI compatibility follow-up

The first CI run exposed unrelated stable-toolchain drift: Dart 3.14 cannot resolve the current Jaspr build graph, and Flutter 3.50 flags the existing Material imports as deprecated. Pin only the formatter and Flutter-example jobs to Flutter 3.47.9, and the Jaspr job to Dart 3.13.7, matching the last-green exact-base run.

SDK, CLI, platform, API-compatibility and other Dart-example jobs continue their existing stable coverage; minimum-SDK jobs stay unchanged. This intentionally defers latest-toolchain example migration. No steps, checks, action hashes or permissions are removed or weakened.

Scope

Four files: three fixture files and the Core workflow. All 208 lock entries retained; no packages added or removed. SDK pin, public API, Node/Dart floors and MIT licenses stay unchanged. Adapter peer widening is published metadata. The fixtures are not dependencies of the published Dart SDK or CLI. No release/version change is needed.

Validation

Security patch:

• npm ci, build, lint, format check, dependency compatibility: passed (4/4)
• Full npm audit: zero vulnerabilities
• Root format: 322 files, zero changes; SDK/CLI analysis: no issues
• Full SDK suite: 2,030 passed; full CLI suite: 139 passed
• Tagged legacy interoperability: 26 passed; local CLI conformance gate: passed
• All 18 platform smoke programs compiled

CI follow-up:

• Six release/workflow guard scripts, YAML semantic comparison and diff check: passed
• Jaspr dependencies, analysis and production build on Dart 3.13.7: passed
• Independent artifact, security-diff and workflow-diff reviews: no findings

Fresh hosted CI on the updated head remains required. Merging and any further workflow reruns require separate approval.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.91%. Comparing base (d1bb49d) to head (581065d).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #457      +/-   ##
==========================================
- Coverage   88.36%   85.91%   -2.45%     
==========================================
  Files          60       82      +22     
  Lines       15662    20565    +4903     
==========================================
+ Hits        13839    17668    +3829     
- Misses       1823     2897    +1074     

Flag	Coverage Δ
cli	78.11% <ø> (?)
unittests	88.35% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.