fix(deps): remediate HIGH Dependabot alerts via lockfile updates

[pkaeding]

Related issues

Open Dependabot alerts on launchdarkly/mcp-server (60 open, all against package-lock.json; no CRITICAL, 13 distinct HIGH).

Describe the solution you've provided

package-lock.json only — no package.json constraint changes were needed; every fix was reachable inside the existing semver ranges via npm audit fix (no lockfile hand-editing, no overrides/resolutions).

Key bumps (all transitive):

package	before → after	source
hono / @hono/node-server	4.12.3 → 4.13.2 / 1.19.9 → 1.19.17	@modelcontextprotocol/sdk
fast-uri	3.1.0 → 3.1.5	ajv
express-rate-limit / ip-address	8.2.1 → 8.6.2 / 10.0.1 → 10.5.0	@modelcontextprotocol/sdk
path-to-regexp	0.1.12 → 0.1.13, 8.3.x → 8.4.2	express 4 / router
js-yaml	4.1.0 → 4.3.1	eslint
flatted	3.3.3 → 3.4.4	eslint
glob / minimatch / brace-expansion	10.4.5 → 10.5.0, 3.1.2/9.0.5 → 3.1.5/9.0.9, → 1.1.18/2.1.4	tshy, eslint, typescript-eslint
picomatch	2.3.1 → 2.3.2	chokidar, micromatch
qs / body-parser	→ 6.15.3 / 1.20.6, 2.3.0	express

Remediated HIGH GHSAs: GHSA-5j98-mcp5-4vw2 (glob), GHSA-7r86-cg39-jmmj (minimatch), GHSA-wc8c-qw6v-h7f6 (@hono/node-server), GHSA-q5qw-h33p-qvwr + GHSA-88fw-hqm2-52qc (hono), GHSA-46wh-pxpv-q5gq (express-rate-limit), GHSA-rf6f-7fwh-wjgh (flatted), GHSA-j3q9-mxjg-w52f + GHSA-37ch-88jc-xwx2 (path-to-regexp), GHSA-4c8g-83qw-93j6 / GHSA-v2hh-gcrm-f6hx / GHSA-7p8r-x3mc-p8w7 / GHSA-q3j6-qgpj-74h6 / GHSA-v39h-62p7-jpjc (fast-uri), GHSA-52cp-r559-cp3m + GHSA-5p4m-2wfm-xmqj (js-yaml), GHSA-3jxr-9vmj-r5cp (brace-expansion), GHSA-mwp4-54f8-5fhr (ip-address).

The MODERATE/LOW alerts (hono advisory chain up to 4.12.34, qs, picomatch, body-parser, ip-address, js-yaml 4.2.0) came along for free with the same upgrades. npm audit now reports 0 vulnerabilities.

No HIGH/CRITICAL alert was left unremediated.

Describe alternatives you've considered

Bumping @modelcontextprotocol/sdk to 1.30.0 or express (dev dep) to 5.x — unnecessary, since the vulnerable transitives resolve to patched versions with the current direct dependency ranges. Kept the diff to the lockfile to minimize risk.

Additional context

Verified locally: npm install clean, npm run lint clean, npm run build (bun build + tshy) succeeds. The repo has no test script.

Link to Devin session: https://app.devin.ai/sessions/a4e331be04834dc2a6e7bee92c8bb8f5
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring