chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 6 open Dependabot security alerts by bumping vulnerable dependencies via yarn resolutions

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#277	fast-uri	high	Bumped to 3.1.4 via resolution
#276	sharp	high	Bumped to 0.35.0 via resolution
#275	fast-uri	high	Bumped to 3.1.4 via resolution
#274	@hono/node-server	medium	Bumped to 2.0.5 via resolution
#273	shell-quote	high	Bumped to 1.9.0 via resolution
#263	sigstore	high	Bumped to 4.1.1 via resolution

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	6e6e8d6	Jul 27 2026, 05:59 PM

[Copilot]

Pull request overview

Resolves multiple Dependabot security alerts by updating vulnerable transitive dependencies, primarily via Yarn lockfile updates and package.json resolutions.

Changes:

• Updated package.json Yarn resolutions to bump shell-quote, @hono/node-server, fast-uri, sharp, and sigstore.
• Regenerated yarn.lock to reflect upgraded dependency graph (notably sharp/@img/*, fast-uri, sigstore ecosystem packages).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates Yarn resolutions intended to force patched dependency versions.
yarn.lock	Captures the resolved versions after the dependency bumps (including platform-specific sharp artifacts).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JamieSinn]

You'll need to update the exception rule here too for libvips/sharp https://github.com/devcyclehq/license-action