security: Update all dependencies to fix vulnerabilities

[kevint-cerebras]

Security Update — March 2026

Addresses critical security vulnerabilities flagged by GitHub Dependabot.

Dependency Updates

Package	From	To	Fix
@modelcontextprotocol/sdk	0.5.0	1.27.1	DNS rebinding protection, secure MCP server initialization
diff	8.0.2	8.0.3	ReDoS vulnerability in parsePatch/applyPatch
zod	4.0.17	4.1.0	Latest stable

Additional Changes

• Add publishConfig.access: "public" for npm publishing
• Bump package version to 1.3.5
• Use unscoped package name cerebras-code-mcp

Verification

• 0 vulnerabilities after update (npm audit clean)
• All MCP SDK imports resolve correctly
• Server instantiation and tool handler registration works
• Full end-to-end MCP protocol test passed (initialize → list tools → write tool)
• Already published to npm as cerebras-code-mcp@1.3.5

Priority: High — Security fix

Made with Cursor

[semgrep-app]

Legal Risk

The following dependencies were released under a license that
has been flagged by your organization for consideration.

Recommendation

While merging is not directly blocked, it's best to pause and consider what it means to use this license before continuing. If you are unsure, reach out to your security team or Semgrep admin to address this issue.

ISC

• isexe 2.0.0
• once 1.4.0
• which 2.0.2
• wrappy 1.0.2
• zod-to-json-schema 3.25.1