chore(deps): bump hono, fast-uri, ip-address to patched versions

Resolves 8 advisories surfaced by `pnpm audit --prod` (2 high, 5 moderate,
1 low) via pnpm.overrides updates and direct hono dep bumps.

- hono: >=4.12.12 -> >=4.12.18 (CVE-2026-44455/56/57/58/59)
- fast-uri@<3.1.2: >=3.1.2 (CVE-2026-6321/6322)
- ip-address@<=10.1.0: >=10.1.1 (CVE-2026-42338)

Direct hono deps in apps/api, apps/sandbox-issuer, packages/server
bumped from ^4.12.15 to ^4.12.18 to match the override floor. archive/
left untouched.

Verified locally: pnpm audit --prod reports 0 high / 0 moderate / 0 low.

Author: jithinraj

apps/api/package.json

@@ -38,7 +38,7 @@
     "@peac/receipts": "workspace:*",
     "@peac/resolver-http": "workspace:*",
     "@peac/schema": "workspace:*",
-    "hono": "^4.12.15",
+    "hono": "^4.12.18",
     "zod": "^4.3.6"
   },
   "devDependencies": {

apps/sandbox-issuer/package.json

@@ -20,7 +20,7 @@
     "@peac/middleware-core": "workspace:*",
     "@peac/protocol": "workspace:*",
     "@peac/schema": "workspace:*",
-    "hono": "^4.12.15",
+    "hono": "^4.12.18",
     "zod": "^4.3.6"
   },
   "devDependencies": {

package.json

@@ -157,7 +157,9 @@
       "path-to-regexp@>=8.0.0": ">=8.4.0",
       "yaml": "2.8.3",
       "@hono/node-server": ">=1.19.13",
-      "hono": ">=4.12.12",
+      "hono": ">=4.12.18",
+      "fast-uri@<3.1.2": ">=3.1.2",
+      "ip-address@<=10.1.0": ">=10.1.1",
       "protobufjs": ">=8.0.1",
       "defu": ">=6.1.5",
       "esbuild@<0.25.0": ">=0.25.0",
@@ -180,7 +182,10 @@
       "esbuild@<0.25.0": "Range-scoped to <0.25.0 only (forces patched 0.25.0+, fixes GHSA-67mh-4wv8-2f99 dev-server CORS bypass). Dev-only via wrangler / @esbuild-plugins/node-globals-polyfill peer / @esbuild-plugins/node-modules-polyfill peer (all ship esbuild 0.17.19). Newer esbuild instances at 0.25.12+ already pulled by vitest/tsx are unaffected.",
       "undici@<6.24.0": "Range-scoped to <6.24.0 only (forces patched 6.24.0+, fixes GHSA-4992-7rv2-5pvq CRLF injection via upgrade and GHSA-2mjp-6q6p-2qxm HTTP request/response smuggling). Dev-only via wrangler -> miniflare which bundles undici 5.29.0. @peac/net-node already uses undici 6.24.0+ (production path unaffected).",
       "postcss@<8.5.10": "Range-scoped to <8.5.10 only (forces patched 8.5.10+, fixes GHSA-qx2v-qp2m-jg93 XSS via unescaped </style> in CSS Stringify output). Dev-only via next 15.5.x (bundles postcss 8.4.31 internally) and vite. Workspace doesn't import postcss directly; affects build tooling only.",
-      "vite@<6.4.2": "Range-scoped to <6.4.2 only (forces patched 6.4.2+, fixes GHSA-p9ff-h696-f583 arbitrary file read via dev server WebSocket and GHSA-4w7w-66w2-5vf9 path traversal in optimized deps .map handling). Dev-only via vitest/@vitest/coverage-v8. pnpm resolves the override to vite 8.0.10 in practice; full test suite passes."
+      "vite@<6.4.2": "Range-scoped to <6.4.2 only (forces patched 6.4.2+, fixes GHSA-p9ff-h696-f583 arbitrary file read via dev server WebSocket and GHSA-4w7w-66w2-5vf9 path traversal in optimized deps .map handling). Dev-only via vitest/@vitest/coverage-v8. pnpm resolves the override to vite 8.0.10 in practice; full test suite passes.",
+      "hono": "Bumped from >=4.12.12 to >=4.12.18 to pull patches for CVE-2026-44455 (bodyLimit() bypass for chunked / unknown-length requests), CVE-2026-44456 (hono/jsx unvalidated JSX tag names), CVE-2026-44457 (CSS declaration injection via Style Object Values in JSX SSR), CVE-2026-44458 (Cache Middleware ignores Vary: Authorization / Vary: Cookie), and CVE-2026-44459 (improper validation of NumericDate JWT claims). Prod dep via apps/api, apps/sandbox-issuer, packages/mcp-server, packages/server.",
+      "fast-uri@<3.1.2": "Range-scoped to <3.1.2 only (forces patched 3.1.2+, fixes CVE-2026-6321 path traversal via percent-encoded dot segments and CVE-2026-6322 host confusion via percent-encoded authority delimiters). Transitive prod dep via ajv / ajv-formats (in @peac/protocol, @peac/receipts, apps/api) and @modelcontextprotocol/sdk (in @peac/mcp-server).",
+      "ip-address@<=10.1.0": "Range-scoped to <=10.1.0 only (forces patched 10.1.1+, fixes CVE-2026-42338 XSS in Address6 HTML-emitting methods). Transitive prod dep via @modelcontextprotocol/sdk -> express-rate-limit."
     }
   },
   "lint-staged": {

packages/server/package.json

@@ -37,7 +37,7 @@
     "@hono/node-server": "^1.19.13",
     "@peac/protocol": "workspace:*",
     "@peac/schema": "workspace:*",
-    "hono": "^4.12.15"
+    "hono": "^4.12.18"
   },
   "devDependencies": {
     "@types/node": "^22.19.11",