Summary

• resolve runtime Dependabot alerts 66, 68, 69, 70, 71, and 75 by refreshing the transitive Hono, @hono/node-server, and fast-uri resolutions
• resolve build-time alert 74 by refreshing postcss; the lock refresh also brings in the patched nanoid release reported by npm audit
• keep this lockfile-only: @modelcontextprotocol/sdk@1.30.0 already permits @hono/node-server ^1.19.9 || ^2.0.5 and hono ^4.11.4, and @hono/node-server@2.1.1 accepts hono ^4

PR #3007's merged diff updated the MCP SDK and ip-address, but did not contain its advertised Hono resolution. This refresh preserves those updates and resolves the current graph without reintroducing older dependency state.

Validation

• npm ci
• npm audit --json and npm audit --omit=dev --json (zero findings)
• npm run typecheck and npm run build
• repeated production builds and a build from the pre-fix lockfile produced byte-identical static HTML
• script/lint, script/test, and script/licenses-check
• Docker build and container --help smoke test