[cablate]

What

Security dependency upgrade (production dependencies only, no --force).

Targeted

• @modelcontextprotocol/sdk ^1.27.1 -> ^1.32.0 (lock resolves 1.32.1). Same major, no code changes.
• proxy-addr 2.0.7 -> 2.0.8 (critical, transitive via express), via npm update proxy-addr.

npm audit fix (lockfile-only): hono, @hono/node-server, axios, path-to-regexp, ip-address, express-rate-limit, fast-uri, form-data, follow-redirects, @grpc/grpc-js, brace-expansion, body-parser, @tootallnate/once.

• @hono/node-server pinned to ^1.19.15 as a new direct dependency (second commit). @modelcontextprotocol/sdk@1.32 allows ^1.19.9 || ^2.0.5, so npm audit fix moved it to 2.x, which needs Node >= 20; on Node 18 the HTTP transport returned 400 on initialize and the node18 CI job failed (apiKeyIsolation.unit.test.ts, reproduced locally on Node 18.20.8). A direct dep keeps fresh installs on 1.x too (overrides would not). If you would rather drop Node 18 support, remove this line instead.

No major-version bumps. No overrides used. Lockfile stays at lockfileVersion 2 (unchanged).

npm audit --omit=dev

	critical	high	moderate	low
before	1	9	6	2
after	0	0	3	0

Verification (local, Node 22 / npm 10)

• npm ci - OK
• npm run build - OK
• npm run lint - 0 errors (201 pre-existing warnings)
• npm run test:unit - 37/37 pass on Node 22 and on Node 18.20.8
• npm test (smoke, no GOOGLE_MAPS_API_KEY) - 114 passed, 0 failed; API-key tests skipped. This exercises the HTTP/session path on the new SDK + express.
• npm run format:check - passes with LF line endings (local Windows checkout uses CRLF, so it only fails there); CI is the authority.
• Not run locally: package:claude-plugin / plugin validate (left to CI), tests needing a real Google Maps key.

Left unfixed (moderate, not blocking)

• qs 6.14.2 under express@4.22.x (GHSA-q8mj-m7cp-5q26 and others; fixed in qs >= 6.16.0). express@4 pins qs ~6.14.0, so it cannot be raised without an overrides entry or moving to express 5. The SDK's own express 5 copy is already on qs 6.16.1.
• decode-uri-component 0.2.2 -> query-string@7 -> @googlemaps/google-maps-services-js@3.4.2 (pins query-string <8.x). Needs an upstream release or an override.
• An overrides entry would not protect people who install the package from npm (overrides only apply to the root project), so I left these for a separate decision.

Release note

release.yml runs on every push to main (not on tags): it builds, lints, runs E2E, bumps the patch version, publishes to npm and the MCP Registry, tags and creates the GitHub release. Merging this PR will therefore publish the next patch version automatically; no manual version bump is needed in this PR.

🤖 Generated with Claude Code