Release Release v2.2.2 · aywengo/kafka-schema-reg-mcp

Release v2.2.2

Pin setuptools>=78.1.1 in Docker builder stage to address CVE-2025-47273 (path traversal in PackageIndex).
Pin msgpack>=1.2.1 to address GHSA-6v7p-g79w-8964 (transitive via pydocket/redis stack).
Strip pip/setuptools/wheel from production Docker image to eliminate pip-vendored msgpack scan noise.
Consolidated dependency floor bumps from Dependabot PRs #147–#166 (superseded by this release).

Sync requirements.txt and pyproject.toml dependency floors (aiohttp, requests, fastmcp, cryptography, python-dotenv, jsonschema, jaraco-context, fastapi).
Bump GitHub Actions: checkout v7, configure-pages v6, deploy-pages v5, github-script v9, upload-pages-artifact v5, action-gh-release v3, codecov-action v7.
Demo MCP bridge: bump FastAPI, uvicorn, and python-multipart in demo/requirements-bridge.txt.
Dependabot: group pip dependency updates into weekly consolidated PRs.
Docker security scan workflow: comment on existing open security issue instead of creating duplicates; auto-close when scan is clean.
Follow-on Dependabot merges #171–#176: fastapi >=0.141.1, starlette >=0.52.1, safety >=3.8.1, pip-audit >=2.10.1; demo bridge stack updated; actions/setup-python@v7, actions/setup-node@v7.

CI check script scripts/check-deps-parity.py to keep requirements.txt and pyproject.toml pins aligned.

For complete version history, see CHANGELOG.md.