[aagarwal1012]

Security remediation from the devops image-scan (source-repo rows, run 39671619428).

Changes (one commit per lockfile tree)

• root: overrides.ws ^8.21.0 (miniflare pins ws 8.18.0); bun.lock regenerated (js-yaml 3.15.x).
• packages/template/server: @modelcontextprotocol/sdk 1.25.2 → 1.32.1 (CVE-2026-111767/111768/111770 + earlier sdk HIGHs); in-range refresh of hono, fast-uri, proxy-addr (CRITICAL).
• packages/template/cloudflare-worker + deployments/dodopayments/cloudflare-worker: sdk → 1.32.1, overrides forcing the nested sdk pin of agents (1.23.0) to the direct version, ws ^8.21.0; in-range refresh of protobufjs (CRITICAL), proxy-addr (CRITICAL), lodash, fast-uri, js-yaml, nanoid, path-to-regexp, picomatch, @hono/node-server.
• packages/website: next 16.1.1 → 16.4.2 (same major; 2 CRITICAL + many HIGH), eslint-config-next in lockstep; package-lock + bun.lock regenerated.

Trivy fs (HIGH+CRITICAL): before 9C / 135H → after 0C / 0H.

Verification: root npm ci && npm run lint && npm run typecheck && npm test (308 tests pass); template/server npm ci && typecheck && test (31 pass) && build; both workers tsc --noEmit + wrangler deploy --dry-run OK; website next build OK. format:check failures are pre-existing on main (changed files pass prettier).

No CLI release needed: packages/cli deps are untouched. The Cloudflare worker picks up the fix on its next deploy.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
context-mcp	Ready	Preview	Oct 21, 2026 9:52pm UTC

[dodo-squirrels]

Reviewed the manifest and lockfile changes across all five trees. They are consistent with the PR description: the SDK bumps to 1.32.1, the ws override in the root and both workers, and next/eslint-config-next 16.4.2 in lockstep. The $@modelcontextprotocol/sdk override syntax is valid npm, and it correctly removes the nested 1.23.0 copy under agents from the worker lockfiles. Lockfile changes are limited to the intended resolutions; the only incidental changes are @types/three added to the website bun.lock (it was already in package.json) and @cloudflare/workers-types losing its dev flag in the template worker lock.

One non-blocking note: forcing agents (used via McpAgent in the dodopayments worker) onto SDK 1.32.1 instead of its pinned 1.23.0 is a cross-minor override. tsc and wrangler deploy --dry-run don't exercise it at runtime, so a quick smoke test of the MCP endpoint after the next deploy would be worth doing.

LGTM.

[aagarwal1012]

@greptileai review

[aagarwal1012]

Re squirrels' note on the agents → SDK 1.32.1 override: acknowledged. The worker is not deployed by this PR. The next deploy-cloudflare-worker run should be followed by a quick MCP smoke test (initialize + tools/list + one search call) against the endpoint. If McpAgent misbehaves, the override can be dropped for the dodopayments worker alone.