- Upgrade @cyanheads/mcp-ts-core ^0.8.19 → ^0.9.1; inherits Workers nodejs_compat boot, SSRF DNS validation + IPv6 blocklist on every fetch, cross-vendor JSON Schema portability lint family, build-time-only definition linting
- Adopt createApp({ instructions }) in src/index.ts — server-level orientation forwarded to the model on initialize: endpoint coverage, query-string syntax, openfda.* cross-product prefix
- Dev dep refresh: @biomejs/biome ^2.4.14 → ^2.4.15, @types/node ^25.6.2 → ^25.8.0, vitest ^4.1.5 → ^4.1.6, @vitest/coverage-istanbul ^4.1.5 → ^4.1.6
- scripts/devcheck.ts: fix bun outdated markdown-row parser (read index [1], strip workspace marker); aligns with framework 0.9.1
- scripts/build-changelog.ts + changelog/template.md: SUMMARY_MAX_LENGTH 250 → 350
- Sync 13 framework skills (api-linter portability rule reference, api-workers instructions resolver, polish-docs-meta OTEL_ENABLED link, agent-observed correctness in add-tool/tool-defs-analysis/design-mcp-server/field-test, condensed prose across api-auth/api-config/api-errors)
- CLAUDE.md: add security-pass to the What's Next list