[yultyyev]

What

Bumps npm dependencies to their latest minor/patch versions, staying inside each current major:

Package	From	To
hono	4.13.14	4.13.18
@hono/node-server	2.1.5	2.1.7
@biomejs/biome (dev)	2.6.4	2.6.7
vite (dev)	8.3.5	8.3.8
@vitejs/plugin-react (dev)	6.1.2	6.3.0
vitest (dev)	5.0.5	5.1.0

Two config lines follow the biome bump:

• biome.json: $schema now points at 2.6.7. Without it, biome 2.6.7 prints a schema-version mismatch on every run.
• pnpm-workspace.yaml: removed the minimumReleaseAgeExclude entries for @biomejs/*@2.6.4. They only let the same-day 2.6.4 install through, and 2.6.7 is past pnpm's one-day minimumReleaseAge, so nothing resolves to 2.6.4 anymore.

Everything else was already on its latest in-range version (@types/node 24.19.2 is the latest 24.x, @xmldom/xmldom 0.9.12 is the latest 0.9.x, and @anthropic-ai/mcpb stays pinned at 2.1.2, which is the latest 2.x). pnpm 12.16.1, Node 24 and engines are unchanged. All targets match each package's latest dist-tag.

Why

Routine dependency upkeep: minor and patch versions only, no prereleases.

Held back / out of scope

• None held back inside the current majors.
• 2 major upgrades remain and are out of scope: @types/node 24 → 26 (we stay on Node 24) and typescript 6 → 7.

Release impact

No release. The commit is typed build(deps) rather than chore(deps), because .releaserc.json maps chore(deps) to a patch release. The angular preset doesn't release on build, and the custom rules only map chore(deps) and chore(security). Any merge method lands without a release. There's no version bump, changeset or tag.

Checks

Run locally on Node 24.22.2 and pnpm 12.16.1, after a fresh pnpm install --frozen-lockfile:

• pnpm install --frozen-lockfile: pass (lockfile passes pnpm's supply-chain policy)
• pnpm lint: pass, 0 errors. The same 7 warnings as on biome 2.6.4 (noAccumulatingSpread and noNonNullAssertion in tests/speed.test.ts and tests/transition.test.ts).
• pnpm type-check: pass
• pnpm test: pass, 775 passed and 24 skipped (52 files). An earlier run while the machine was under heavy load had 5s timeouts in the document-store and timeline-verbs tests. Those files passed 3 out of 3 times on their own, and the full suite passed once load dropped.
• pnpm build (tsup + Vite UI): pass
• pnpm build:mcpb: pass
• Codex review (codex review --base main, gpt-6.1-sol): no actionable regressions found and no findings to fix or rebut. Its gate reads "unverified" only because a clean review has no severity tags.

How to test

pnpm install --frozen-lockfile && pnpm lint && pnpm type-check && pnpm test && pnpm build && pnpm build:mcpb

[github-actions]

🎉 This PR is included in version 0.4.2 🎉

The release is available on:

• v0.4.2
• GitHub release

Your semantic-release bot 📦🚀