chore(deps)(deps): bump @modelcontextprotocol/hono from 2.0.0-alpha.2 to 2.0.0-alpha.3

[dependabot]

Bumps @modelcontextprotocol/hono from 2.0.0-alpha.2 to 2.0.0-alpha.3.

Commits

• e4227d1 Version Packages (alpha) (#1845)
• 0fb8406 v2: codemod iterations, canonical zod schema exports from sdk-shared (#2354)
• 7ea6fde test(client): cover refresh retry after invalid token 401 (#2367)
• ee732d6 chore: switch to module ESNext + moduleResolution bundler (#2095)
• c59dc3a feat(server): expose icons on registerTool/registerPrompt (McpServer) (#2353)
• 6312f2a fix(middleware): stop bundling workspace type graphs into .d.ts (avoids dts-g...
• 5e0249f test(integration): stop the cloudflare workers test from rewriting workspace ...
• 78fbe27 feat(core): reserved trace context _meta keys and propagation docs (SEP-414) ...
• e84c3e9 fix(server,client): non-SEP draft spec conformance (eager list handlers, pagi...
• 49c0a71 feat: deprecate roots, sampling, and logging runtime APIs (SEP-2577) (#2268)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Lockfile and version pin only; MCP integration code is unchanged, though the alpha SDK bump could affect runtime behavior at the MCP HTTP layer.

Overview
Bumps @modelcontextprotocol/hono in apps/api from 2.0.0-alpha.2 to 2.0.0-alpha.3, with the matching pnpm-lock.yaml resolution update.

@modelcontextprotocol/server remains pinned at 2.0.0-alpha.2; the new hono release declares a peer on @modelcontextprotocol/server ^2.0.0-alpha.3, so reviewers may want to confirm install/peer warnings and MCP behavior still look correct. No application source files change in this PR.

^{Reviewed by Cursor Bugbot for commit 1657ab4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

No concrete threat-surface issues found in this PR.

Checked:

• MCP endpoint auth: no route/auth code changed; existing /mcp/:slug/... path still authenticates the bearer token and project association before MCP server/tool setup.
• Query execution sandboxing: no changes to execute_query, scoped model access, SQL validation, DuckDB hardening, timeout, or row-limit code.
• Admin auth / Better Auth: no auth config or CSRF/cookie handling changes.
• API input validation and environment secrets: no route handler or env handling changes; no secrets added to the changed files.
• Dependency exposure: the only changed package is @modelcontextprotocol/hono 2.0.0-alpha.2 -> 2.0.0-alpha.3. Package metadata points to the maintained MCP TypeScript SDK repo, and pnpm audit --prod did not identify a new MCP Hono advisory. Existing audit findings are through unrelated dependencies and appear pre-existing. pnpm --filter @archmax/api typecheck passes.

Non-blocking note: alpha.3 declares a peer on @modelcontextprotocol/server@^2.0.0-alpha.3 while this app still pins @modelcontextprotocol/server at alpha.2. I did not flag this as a security finding because the adapter code diff is effectively metadata-only and the API typecheck passes, but aligning both SDK packages in a follow-up would reduce alpha-version skew.

  

_{Sent by Cursor Automation: archmax Security Review}

[github-actions]

Docker image ready

docker pull ghcr.io/archmaxai/archmax:pr-77