chore(deps): bump @hono/node-server from 2.0.8 to 2.0.10 in /packages/x402-facilitator-node

[dependabot]

Bumps @hono/node-server from 2.0.8 to 2.0.10.

Release notes

Sourced from @​hono/node-server's releases.

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in honojs/node-server#371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in honojs/node-server#372
• fix: recover complete request bodies after client disconnect by @​usualoma in honojs/node-server#375

New Contributors

• @​otnc made their first contribution in honojs/node-server#371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

Commits

• 7c1457e 2.0.10
• 3a21938 Merge commit from fork
• 9842021 2.0.9
• 51f3bf5 fix: recover complete request bodies after client disconnect (#375)
• fdb87ba fix(serve-static): correct Range header parsing edge cases (#372)
• 912e3fd fix(websocket): polyfill missing ErrorEvent global (#371)
• See full diff in compare view

[clestons]

PR-Daemon Review (2-round, pure dependency bump)

Change: @hono/node-server 2.0.8→2.0.10 (x402-facilitator-node)

Diff is limited to lockfile/manifest (or a single pinned-version bump in a workflow file, YAML-validated) — no source/logic/config touched. Per pr-daemon-loop policy, pure version bumps skip the Codex PK round.

Verdict: APPROVE

[clestons]

✅ APPROVE — [2-round]

纯依赖 bump，@hono/node-server 2.0.8 → 2.0.10（patch），只动 package.json 的 specifier 和 pnpm-lock.yaml 对应的三处（importer specifier/version、包 resolution、snapshot key）。无源码改动。

机械核验

• integrity 与 npm registry 官方值逐字节一致：sha512-ZcnNVhKTmyDJeg0UlnZjvM73JBsTAuhrH/J4fjwGOw59PwOW51r4J+p6CsKZWXdKSme4MFqU62CZMOsdDrU4CA== ↔ registry.npmjs.org/@hono/node-server/2.0.10 返回的 dist.integrity 相同，tarball 指向 https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.10.tgz。
• registry 没被换：整个 diff 里出现的 host 只有 registry.npmjs.org（这条专门查过——compress_diff 默认会丢掉 lockfile，历史上就漏过一次 npmmirror→npmjs 的 registry 切换，所以这里是把 lockfile hunk 原样看过的）。
• 约束语义没变：^2.0.8 → ^2.0.10，caret 范围收窄不放宽；engines: {node: '>=20'} 和 peerDependencies: hono ^4 都未变动，hono@4.12.34 不受影响。
• 没有传递依赖漂移：lockfile 里除 @hono/node-server 自身的三行外没有任何其他包变化。

一条提醒（不阻塞）：#366（all-dependencies group，5 updates）改的是同一个 packages/x402-facilitator-node/pnpm-lock.yaml。两个 PR 谁先合，另一个的 lockfile 都会冲突，dependabot 会自动 rebase——注意别在 rebase 完成前合第二个。

_{2-round：R1a/R1b DeepSeek-v4-flash（均无 finding）+ 执行器裁决。纯版本号 bump 无 finding 可挑战，按既定规则跳过 Codex PK；改为用 registry 实查 integrity 作为机械证据。}