fix: address security vulnerabilities in dependencies

[PMerlet]

Summary

• Bump sequelize to ^6.37.8 across all packages (SQL injection — CVSS 7.5)
• Bump @modelcontextprotocol/sdk to ^1.28.0 in mcp-server and ai-proxy (fixes transitive hono, @hono/node-server, express-rate-limit)
• Bump typedoc to ^0.28.18 (fixes transitive markdown-it)
• Bump forest-cli to 5.3.9 in forest-cloud (ships fixed sequelize)
• Re-resolve @aws-sdk/xml-builder to 3.972.16 (ships fixed fast-xml-parser 5.5.8)
• Remove 6 stale yarn resolutions now covered by parent package bumps
• Clean up remaining resolutions (7 kept, all still necessary)

Vulnerabilities addressed

Package	CVE/GHSA	CVSS	Fix
sequelize	SQL Injection via JSON column cast	7.5	^6.37.8
hono (4 CVEs)	File access, SSE injection, cookie injection, prototype pollution	7.5	>=4.12.7 via SDK bump
@hono/node-server	Auth bypass via encoded slashes	7.5	>=1.19.10 via SDK bump
express-rate-limit	IPv4-mapped IPv6 bypass	7.5	>=8.2.2 via SDK bump
fast-xml-parser (2 CVEs)	Entity expansion DoS	7.5	5.5.8 via xml-builder bump
markdown-it	Vulnerability fix	-	>=14.1.1 via typedoc bump

Test plan

• CI passes (no breaking changes — all bumps are semver-compatible)
• Verify GitHub security alerts are cleared after merge

🤖 Generated with Claude Code

Note

Fix security vulnerabilities by updating dependencies across packages

• Bumps sequelize to ^6.37.8 across all packages that depend on it (agent, datasource-sequelize, datasource-sql, datasource-replica, etc.)
• Bumps @modelcontextprotocol/sdk to ^1.28.0 in ai-proxy and mcp-server
• Updates tar version range to >=7.5.11 and removes version-pinning overrides for hono, markdown-it, and @aws-sdk/xml-builder in the root package.json

^{Macroscope summarized f3472fd.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.