chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 15 open Dependabot security alerts by bumping vulnerable transitive dependencies via resolutions and updating wrangler to bring in a newer miniflare/sharp
• Updated wrangler from ^4.72.0 to ~4.116.0; the newer miniflare (4.20260730.0) bundles sharp 0.35.2 which resolves the sharp CVE
• Extended the license-action exclusion list to cover @img/sharp-libvips-linux-x64@1.3.1 (same LGPL-licensed native binary as the previously-excluded 1.0.x/1.2.x variants)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#276	sharp	high	Updated wrangler to ~4.116.0 (miniflare 4.20260730.0 ships sharp 0.35.2)
#282	brace-expansion	high	Bumped resolution to ^2.1.4
#283	ip-address	medium	Bumped resolution to ^10.3.1
#284	ip-address	medium	Bumped resolution to ^10.3.1
#285	brace-expansion	high	Bumped resolution to ^1.1.18
#286	brace-expansion	high	Bumped resolution to ^1.1.18
#287	brace-expansion	high	Bumped resolution to ^2.1.4
#288	fast-uri	high	Bumped resolution to ^3.1.5
#289	undici	high	Bumped resolution to ^7.29.0
#290	undici	medium	Bumped resolution to ^7.29.0
#291	undici	medium	Bumped resolution to ^7.29.0
#292	undici	medium	Bumped resolution to ^7.29.0
#293	undici	medium	Bumped resolution to ^7.29.0
#294	ip-address	high	Bumped resolution to ^10.3.1
#295	hono	medium	Bumped resolution to ^4.12.34

[cloudflare-workers-and-pages]

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	ddc3494	Aug 05 2026, 02:00 PM

[Copilot]

Pull request overview

This PR addresses multiple Dependabot security alerts in the CLI monorepo by upgrading vulnerable transitive dependencies via Yarn resolutions and updating the Cloudflare wrangler toolchain used by the mcp-worker workspace.

Changes:

• Updated Yarn resolutions to force patched versions of vulnerable transitive dependencies (e.g., brace-expansion, ip-address, fast-uri, undici, hono).
• Bumped wrangler (and thus miniflare/workerd/sharp) to bring in a non-vulnerable sharp release.
• Regenerated yarn.lock to reflect the new dependency graph across the workspace.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
yarn.lock	Updates the resolved dependency graph to patched versions (notably wrangler/miniflare/workerd/sharp and security-related transitive bumps).
package.json	Adjusts Yarn resolutions to enforce patched transitive dependency versions repo-wide.
mcp-worker/package.json	Updates mcp-worker dependencies/devDependencies to align with the patched versions (hono, wrangler).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jonathannorris]

The global resolution is intentional. miniflare pins to exact 7.28.0 but so does node-gyp (via ^7.28.0), and both are covered by the global override. undici 7.29.0 is a semver patch release so API compatibility is maintained — all 189 tests pass with the updated version. This override pattern is the standard yarn approach for forcing security patches in transitive deps.