chore(security): pin MCP transitive vulnerability fixes

[mInrOz]

Summary

• Hardens transitive dependency resolution for vulnerabilities pulled through @modelcontextprotocol/sdk.
• Bumps the MCP SDK floor to ^1.27.1 and enforces patched transitive versions via overrides.
• Regenerates bun.lock so installs deterministically resolve the patched dependency set.

Changes

• Updated package.json:
  • @modelcontextprotocol/sdk from ^1.25.2 to ^1.27.1
  • Added/updated overrides for:
    • @modelcontextprotocol/sdk: ^1.27.1
    • @hono/node-server: ^1.19.10
    • hono: ^4.12.5
    • ajv: ^8.18.0
    • qs: ^6.15.0
• Updated bun.lock to reflect override-enforced resolutions.

Screenshots

N/A (dependency/config-only changes).

Testing

bun run typecheck
bun run build
bun audit
bun test src/features/skill-mcp-manager
bun test src/tools/skill

• bun run typecheck: pass
• bun run build: pass
• bun audit: no vulnerabilities found
• Targeted MCP-related tests: pass

Related Issues

Checklist

• Code follows project conventions
• bun run typecheck passes
• bun run build succeeds
• Tested locally with OpenCode
• Updated documentation if needed (N/A for dependency-only security update)
• No package release version bump in package.json (version unchanged; dependency ranges updated intentionally for security)

---

Summary by cubic

Pins @modelcontextprotocol/sdk to ^1.27.1 and enforces patched transitive versions to fix vulnerabilities. Regenerates bun.lock to ensure secure, deterministic installs.

• Dependencies
  • @modelcontextprotocol/sdk → ^1.27.1 (dep + override)
  • @hono/node-server → ^1.19.10
  • hono → ^4.12.5
  • ajv → ^8.18.0
  • qs → ^6.15.0

^{Written for commit fade192. Summary will update on new commits.}

[github-actions]

All contributors have signed the CLA. Thank you! ✅
_{Posted by the CLA Assistant Lite bot.}

[mInrOz]

I have read the CLA Document and I hereby sign the CLA

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Requires human review: Dependency overrides (especially ajv and qs) can cause breaking changes in the transitive tree; cannot be 100% sure of no regressions without full dependency tree analysis.}