Security
- Raised the MCP client and server minimum to 2.3.1, including fixes for credential forwarding, cross-session message delivery, request validation, and bearer-token audience checks.
- Refreshed Vitest, Vite, and
source-map-jsto patched releases. - Pinned system-trash support to
trash9.0.0, removing the dependency chain with the current high-severitybracesadvisory.
Four moderate advisories remain in gray-matter's installed js-yaml 3.x chain. npm offers only a breaking downgrade for those findings.