fix(security): bump hono, fast-uri, form-data (4 HIGH)

[andriy-sudo]

Vulnerability Fixes

All changes are limited to manifest/lock file version bumps — no functional source code changes.

Package	Old	New	Advisory	CVSS	Status
hono	4.12.14	4.12.27	GHSA-88fw-hqm2-52qc	7.1	✅ Fixed
fast-uri	≤3.1.1	3.1.2	GHSA-v39h-62p7-jpjc + GHSA-q3j6-qgpj-74h6	7.5	✅ Fixed
form-data	<4.0.6	4.0.6	GHSA-hmw2-7cc7-3qxx	7.5	✅ Fixed

Changelog impact summary

Package	Old	New	Classification	Key changes
hono	4.12.14	4.12.27	Patch/security	CVE fix only — no API changes
fast-uri	≤3.1.1	3.1.2	Patch/security	Security fix — no API changes
form-data	<4.0.6	4.0.6	Patch/security	Security fix — no API changes

Fixes Dependabot alerts #70, #67, #57, #55.

[andriy-sudo]

@colriot — SPOC review request. Reviewer assignment API returned empty (team-access-only repo). All CI green expected. Please review, approve, and merge when ready.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e98a68e5-13ff-4709-91ac-abe288ced65f

📥 Commits

Reviewing files that changed from the base of the PR and between 4acd231 and 48d29fe.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

package.json was updated to add the form-data and fast-uri runtime dependencies and to bump hono from ^4.12.14 to ^4.12.25. The remaining listed dependencies were unchanged.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the security dependency bumps in the PR.
Description check	✅ Passed	The description matches the dependency security updates shown in the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andriy/secfix-agentql-mcp-deps

---

_{Comment @coderabbitai help to get the list of available commands.}