Security patch for a transitive dependency of the MCP SDK, plus routine dependency updates. No feature or behavior changes — safe drop-in upgrade.