1.0.3 (#44)

* chore: patch transitive dependency vulnerabilities

## Changed
- Pin patched versions of vulnerable transitive deps via pnpm.overrides (hono, @hono/node-server, vite, postcss, path-to-regexp, picomatch, brace-expansion, ip-address, fast-uri)
- Regenerate pnpm-lock.yaml so overrides take effect

## New
- Add pnpm.overrides block in package.json scoped to vulnerable version ranges

* chore: bump version to 1.0.3

## Changed
- Bump package version from 1.0.2 to 1.0.3

* chore: pin pnpm overrides to majors and declare node engines

Constrains pnpm.overrides to ^x.y.z so future lockfile regenerations
can't silently pull in breaking majors (vite was resolving to 8.x and
@hono/node-server to 2.x). Adds engines.node >=20.19.0 to match vite 7's
minimum and warn consumers on unsupported Node versions.

* chore: enable npm provenance on publish

## Changed
- Pass --provenance to pnpm publish in ops/publish-npm.sh
- Grant id-token: write permission to npm-publish workflow for OIDC signing

Author: Starllordz

.github/workflows/npm-publish.yml

@@ -10,6 +10,10 @@ jobs:
     name: Build and Publish
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      id-token: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

ops/publish-npm.sh

@@ -25,6 +25,6 @@ pnpm run build
 
 # Publish to npm
 echo "Publishing to npm..."
-pnpm publish --no-git-checks --access public
+pnpm publish --no-git-checks --access public --provenance
 
 echo "Package published successfully!" 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@translated/lara-mcp",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Lara API official MCP server",
   "author": {
     "name": "Translated",
@@ -16,6 +16,9 @@
     "url": "https://github.com/translated/lara-mcp/issues"
   },
   "type": "module",
+  "engines": {
+    "node": ">=20.19.0"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
@@ -70,5 +73,21 @@
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
+  },
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@>=1.0.0 <1.1.12": "^1.1.12",
+      "brace-expansion@>=2.0.0 <2.0.3": "^2.0.3",
+      "brace-expansion@>=3.0.0 <3.0.1": "^3.0.1",
+      "brace-expansion@>=4.0.0 <5.0.5": "^5.0.5",
+      "fast-uri@<3.1.2": "^3.1.2",
+      "picomatch@<4.0.4": "^4.0.4",
+      "path-to-regexp@>=8.0.0 <8.4.2": "^8.4.2",
+      "postcss@<8.5.10": "^8.5.10",
+      "vite@<7.3.3": "^7.3.3",
+      "hono@<4.12.18": "^4.12.18",
+      "@hono/node-server@<1.19.14": "^1.19.14",
+      "ip-address@<10.1.1": "^10.1.1"
+    }
   }
 }