fix: bump agents to resolve Dependabot XSS alerts

[jonathannorris]

Summary

• Bumps agents from ^0.2.19 to ^0.3.10 in the mcp-worker to address Dependabot alerts feature: add watch mode to generate types command #121, [feat] add target rule list, create, toggle commands #122, Add feature create #123 (Reflected XSS in AI Playground)
• Adds @modelcontextprotocol/sdk resolution to 1.27.1 to deduplicate the MCP SDK (agents 0.3.10 pins 1.25.2, root uses 1.27.1 — without the resolution the type mismatch causes build failures)

Remaining alerts

3 alerts remain that can't be addressed without upgrading oclif from 3.x to 4.x:

Alert	Package	Severity	Root cause
#151, #152	tar 6.2.1	High	All consumers request ^6.x, no 6.x patch exists, fix requires tar 7.5.11+
#150	@tootallnate/once 1.x/2.x	Low	Pulled in by http-proxy-agent 4.x/5.x via old make-fetch-happen

Both are build-time transitive deps from the npm toolchain (oclif → yeoman-environment → pacote → cacache/sigstore), not runtime deps of the CLI.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	36bdf5e	Mar 12 2026, 03:22 PM

[Copilot]

Pull request overview

This PR updates the dependency graph to address Dependabot security alerts (reflected XSS in AI Playground) by upgrading the agents package used by the MCP Cloudflare Worker and deduplicating @modelcontextprotocol/sdk across workspaces to avoid build/type mismatches.

Changes:

• Bump agents in mcp-worker from ^0.2.19 to ^0.3.10.
• Add a root Yarn resolutions override to force @modelcontextprotocol/sdk to 1.27.1 across the repo.
• Update yarn.lock to reflect the new agents dependency set and the SDK deduplication.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
yarn.lock	Reflects agents@0.3.10 and forces a single @modelcontextprotocol/sdk@1.27.1 resolution, plus associated transitive changes.
package.json	Adds a resolutions pin for @modelcontextprotocol/sdk to 1.27.1 to dedupe across workspaces.
mcp-worker/package.json	Bumps agents dependency to ^0.3.10 for the MCP worker.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.