chore: resolve dependabot security advisories for transitive deps

[jonathannorris]

Summary

• Pin patched versions for transitive packages called out by Dependabot (undici, flatted, tar, @tootallnate/once, diff).
• Bump direct axios and lodash to versions that clear npm audit.

Why

Dependabot flagged multiple CVEs/GHSAs in the lockfile; Yarn resolutions force safe versions where upstream ranges still resolve to vulnerable builds. Axios and lodash were direct deps still in vulnerable ranges per yarn npm audit.

Tests: yarn test:ci and yarn npm audit (clean).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	876b847	Mar 24 2026, 09:16 AM

[Copilot]

Pull request overview

Updates dependency versions to address Dependabot / npm audit security advisories by bumping direct dependencies and adding Yarn resolutions to force patched transitive versions.

Changes:

• Bump direct deps axios and lodash to newer versions.
• Add Yarn resolutions entries for vulnerable transitive packages (e.g., undici, flatted, tar, @tootallnate/once, diff).
• Regenerate yarn.lock to reflect the new dependency graph.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
package.json	Bumps direct deps and adds resolutions to force patched transitive versions.
yarn.lock	Lockfile updates reflecting the new direct versions and forced transitive resolutions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

PR description says these transitive deps are being “pinned”, but several new resolutions entries use caret ranges (e.g., flatted: ^3.4.2, undici: ^7.24.0, tar: ^7.5.11, @tootallnate/once: ^3.0.1). If the intent is strict pinning for supply-chain safety and reproducible future lock updates, consider using exact versions here (as is already done for some other resolutions like tmp).