diff --git a/.changeset/zesty-seals-click.md b/.changeset/zesty-seals-click.md
new file mode 100644
index 000000000..7cc2694e1
--- /dev/null
+++ b/.changeset/zesty-seals-click.md
@@ -0,0 +1,5 @@
+---
+type: Security
+pr: 0
+---
+**Pinned the transitive `hono` dependency to `>=4.13.5`** — fixes a moderate-severity path-traversal/DoS advisory chain (GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc, GHSA-crvj-82cr-hjcx) in `hono <4.13.5`, pulled in transitively via `@anthropic-ai/claude-agent-sdk` -> `@modelcontextprotocol/sdk`. Discovered as a newly-published advisory blocking `tests/npm-integrity-gate.test.cjs` while verifying an unrelated PR; fixed inline per this repo's no-defer policy rather than left for a separate PR. (#4513)
diff --git a/package-lock.json b/package-lock.json
index fce181925..38a77f2a1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3615,9 +3615,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.0",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
-      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
+      "version": "4.13.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
+      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
diff --git a/package.json b/package.json
index 99019bdcc..e3cc83000 100644
--- a/package.json
+++ b/package.json
@@ -85,7 +85,8 @@
   "overrides": {
     "qs": ">=6.15.2",
     "body-parser": ">=2.3.0",
-    "@hono/node-server": ">=2.0.5"
+    "@hono/node-server": ">=2.0.5",
+    "hono": ">=4.13.5"
   },
   "optionalDependencies": {
     "fallow": "^2.70.0"