chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 5 open Dependabot security alerts by bumping vulnerable dependencies

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#357	shell-quote	critical	Resolution bumped to ^1.11.0 (locked 1.12.0)
#354	proxy-addr	critical	Added resolution ^2.0.8 (locked 2.0.8)
#359	@modelcontextprotocol/sdk	high	Bumped to 1.31.0 (direct dep and agents resolution)
#358	sharp	high	Resolution bumped to ^0.35.5 (locked 0.35.5)
#355	source-map-js	high	Added resolution ^1.2.2 (locked 1.2.2)

Notes

• Build passes. The 30 failing tests in cleanup/diff/usages and the existing lint errors are identical on main.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	9c9e4ee	Oct 13 2026, 01:38 AM

[Copilot]

🟢 Approval recommended

The manifest and lockfile updates are consistent and address the listed vulnerable dependencies.

0 open findings

What changed in this PR

Updates dependency constraints and lockfile entries to resolve five Dependabot security alerts.

Changes:

• Upgrades the MCP SDK and vulnerable transitive dependencies.
• Refreshes Sharp and its platform-specific packages.

File	Description
package.json	Updates dependency resolutions and the MCP SDK version.
yarn.lock	Locks patched versions and related transitive packages.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.