♻️ Pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
@eslint/js (source)	devDependencies	pin	^9.26.0 → 9.39.4
@modelcontextprotocol/sdk (source)	dependencies	pin	^1.26.0 → 1.26.0
@stricli/core (source)	devDependencies	pin	^1.1.1 → 1.1.1
@types/express (source)	devDependencies	pin	^4.17.21 → 4.17.25
decimal.js	dependencies	pin	^10.4.3 → 10.6.0
eslint (source)	devDependencies	pin	^9.26.0 → 9.39.4
express (source)	devDependencies	pin	^4.21.2 → 4.22.1
globals	devDependencies	pin	^15.14.0 → 15.15.0
typescript (source)	devDependencies	pin	~5.8.3 → 5.8.3
typescript-eslint (source)	devDependencies	pin	^8.26.0 → 8.59.0
zod (source)	dependencies	pin	^3.25.0 || ^4.0.0 → 3.25.76

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • "after 2pm every weekday,before 5am every weekday,every weekend"
• Automerge
  • "after 6pm every weekday,before 9am every weekday,every weekend"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit baa0724. Configure here.}

[cursor]

bun.lock not updated to match pinned versions

Medium Severity

package.json and package-lock.json were pinned to exact versions, but bun.lock was not regenerated. Its workspace block still records the old caret/tilde ranges, and several resolved entries (e.g. @modelcontextprotocol/sdk@1.29.0, eslint@9.39.4, @eslint/js@9.39.4, typescript-eslint@8.46.2) no longer satisfy the new exact pins. Since the build, test setup, and bun src/mcp-server/build.mts flow rely on bun install, npm and bun consumers will end up on different dependency graphs.

 

^{Reviewed by Cursor Bugbot for commit baa0724. Configure here.}

[cursor]

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.

[cursor]

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.