fix: update hono to resolve CVE-2026-84363, CVE-2026-84365, CVE-2026-84364

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

Bumped hono from 4.13.1 to 4.13.8 (patched: 4.13.5+) in package-lock.json. hono is a transitive dep (via @modelcontextprotocol/sdk and @hono/node-server, both accept ^4/^4.11.4), so no package.json change needed.

• Dependency: hono updated to 4.13.8
• Advisories: CVE-2026-84363 (query parser reads params after URL fragment), CVE-2026-84365 (incomplete fix for CVE-2026-39408, toSSG() path traversal), CVE-2026-84364 (unbounded dot-notation nesting in parseBody() causes memory exhaustion)
• Dependabot alerts: https://github.com/warpdotdev/oz-workspace/security/dependabot/171, https://github.com/warpdotdev/oz-workspace/security/dependabot/172, https://github.com/warpdotdev/oz-workspace/security/dependabot/173
• Verification: npm audit --package-lock-only no longer flags hono; npm install resolves cleanly with no other lockfile drift; npm run lint passes (0 errors, pre-existing warnings only)

Highlight the risky code / where the dependency was used

No direct usage in app code found (hono isn't a direct dependency); it's pulled in transitively by @modelcontextprotocol/sdk's bundled @hono/node-server.

Special instructions for this PR

None.

AFTER YOU MERGE

None.