fix(security): refresh dependencies and slim published package

[HarshCasper]

Summary

• Refreshes the stale Yarn lockfile and upgrades dockerode to 5.0.1 and xmcp to 0.6.13, closing all 95 currently open Dependabot alerts.
• Moves xmcp's build-only dependency tree out of the published runtime surface and adds only the bundled server's explicit runtime dependencies.
• Replaces the hidden eval("require") with createRequire, hardens AWS CLI input validation, refreshes the CDK fixture, and adds ongoing Dependabot/audit controls.

Incorporates and supersedes #7 — thanks @remotesynth.

Alerts closed

Critical alerts are listed first. Counts reflect the 95 open Dependabot alerts before this change.

Runtime dependency tree

Package	Final resolution	Critical	High	Medium	Low	Total
protobufjs	7.6.5	1	5	6	0	12
@protobufjs/utf8	1.1.2	0	0	1	0	1
@grpc/grpc-js	1.14.4	0	2	0	0	2
tar-fs	2.1.5	0	1	0	0	1
hono	4.12.31	0	2	24	1	27
@hono/node-server	2.0.11	0	1	2	0	3
express-rate-limit	8.6.0	0	1	0	0	1
ip-address	10.2.0	0	0	1	0	1
path-to-regexp	8.4.2	0	1	1	0	2
fast-uri	3.1.4	0	4	0	0	4
qs	6.15.3	0	0	2	1	3
body-parser	2.3.0	0	0	0	1	1
ajv	8.20.0	0	0	1	0	1
js-yaml	4.3.0 / 3.15.0	0	2	3	0	5
picomatch	2.3.2 / 4.0.5	0	1	2	0	3
uuid	removed with dockerode 5	0	0	1	0	1

This includes Critical CVE-2026-41242 in protobufjs. The ip-address resolution is required because the upstream exact 10.1.0 pin is vulnerable. The test-gated @hono/node-server 2.x resolution held through build, type-check, protocol, and clean-room runtime tests, so GHSA-frvp-7c67-39w9 is fixed rather than dismissed.

Development dependency tree

Package	Final resolution	Critical	High	Medium	Low	Total
handlebars	4.7.9	1	3	2	1	7
undici	7.28.0	0	1	4	2	7
ws	8.21.1	0	1	0	0	1
glob	10.5.0	0	1	0	0	1
minimatch	3.1.5 / 9.0.9	0	2	0	0	2
brace-expansion	1.1.16 / 2.1.2	0	2	0	0	2
@babel/core	7.29.7	0	0	0	1	1
esbuild	0.28.1	0	0	0	1	1

This includes Critical CVE-2026-33937 in handlebars.

CDK fixture

Package	Final resolution	Critical	High	Medium	Low	Total
aws-cdk-lib	2.262.0	0	1	0	0	1
brace-expansion	5.0.7	0	1	1	0	2
fast-uri	removed from the refreshed fixture tree	0	2	0	0	2

Published package surface

xmcp declares its rspack/TypeScript build toolchain as runtime dependencies, even though the generated stdio server is bundled. xmcp, posthog-node, and zod are now development-only; the published package explicitly retains dockerode, ajv, and ajv-formats as runtime dependencies.

• Clean npm install before: 236 packages
• Clean npm install after: 74 packages
• Reduction: 162 packages (68.6%)
• Packed artifact: 20 files, 966.1 kB compressed / 3.4 MB unpacked
• Literal external-require inventory across dist/*.js: no additional package requires found; dockerode remains intentionally indirect through createRequire
• docker-modem bundle marker count: 0; bundle sizes remained stable (stdio 363 KiB, chunks approximately 157–200 KiB)

Clean-room verification used npm pack, installed the tarball with npm in a fresh temporary directory, ran CLI help, and drove the installed stdio server with newline-delimited JSON-RPC through initialize, notifications/initialized, tools/list (14 tools), and LocalStack management start/status/stop. There were no MODULE_NOT_FOUND errors, and the management calls prove the external dockerode runtime path works.

Socket.dev scans the published npm artifact, so its dashboard will update only after the next release. No npm publish or package-version bump is included here.

Compatibility review

• Dockerode 5.0.0's documented changes are removal of uuid and a higher Node.js floor; this package already requires Node >=20. Version 5.0.1 contains dependency-only maintenance updates. The container list/inspect/start/stop/remove, image pull, exec, event stream, log, and modem demux APIs used here are unchanged.
• xmcp 0.6.12 and 0.6.13 are dependency/security maintenance releases with no documented breaking API changes. Build and MCP protocol tests pass.
• The refreshed Node typings removed path.PlatformPath; the equivalent stable return type is now inferred from typeof path.posix.