ENG-1048: Bump CVE'd deps + reshuffle pnpm overrides (consolidated)

[mjohnsonsu]

🔧 Change Summary

Consolidates #23 and #24.

CVE bumps in both workspaces (typescript, modelcontextprotocol):

package	before	after	CVE
path-to-regexp	8.3.0	8.4.2	CVE-2026-4926
express-rate-limit	8.2.1	8.3.2	CVE-2026-30827
@hono/node-server	1.19.9	1.19.14	CVE-2026-29087
hono	4.12.8	4.12.14	CVE-2026-29045
flatted	3.3.4	3.4.2	CVE-2026-33228 + CVE-2026-32141

pnpm.overrides reshuffle in typescript/package.json:

change	reason
+ flatted: ">=3.4.2"	required — flat-cache@4.0.1 pins flatted: 3.3.4 exactly in the pnpm lockfile and refuses to move without an override
− handlebars: "^4.7.9"	no longer load-bearing — natural resolution is already 4.7.9
− hono: ">=4.12.7"	no longer load-bearing — natural matches the cluster-4 bump

langsmith >=0.4.6 override stays — without it, 0.3.87 reappears alongside 0.5.x.

Also reverted incidental cosmetic devDep bumps that pnpm update tried to make to modelcontextprotocol/package.json — keeps the diff focused on security fixes.

📋 Linked Linear Ticket

• references ENG-1048

🧪 How Was This Tested?

• Verified all 5 CVE'd packages resolve to patched versions in both typescript/pnpm-lock.yaml and modelcontextprotocol/pnpm-lock.yaml.
• For each dropped override, verified resolved version still ≥ original CVE floor.

🔐 Security Consideration

Direct CVE remediation. No regression on dropped overrides.

🚀 Deployment & Validation Plan

• Deployment Method: Merge → existing release pipeline for @subtotal-inc/ai-toolkit.
• Target Environment: npm publish.
• Post-Deployment Validation Steps: Vanta resync drops the 5 CVEs from this repo.

🔁 Rollback Plan

Revert this commit.

📄 Change Type

• Dependency update

🤖 Generated with Claude Code