fix(plugin-mcp): bump @modelcontextprotocol/sdk to 1.30.0 for GHSA-frvp-7c67-39w9 (3.x) (#17611)

Bumps `@modelcontextprotocol/sdk` from `1.27.1` to `1.30.0` to resolve
[GHSA-frvp-7c67-39w9](GHSA-frvp-7c67-39w9),
a path traversal in `@hono/node-server` affecting every `1.x` release.
`1.30.0` is the first SDK version whose `@hono/node-server` range
(`^1.19.9 || ^2.0.5`) admits the patched `>= 2.0.5`, so downstream
installs can reach it instead of being stuck on the exact pin.

The SDK bump alone fixes downstream consumers — a fresh `npm`/`pnpm
install` of the published package resolves `@hono/node-server` to
`2.0.12`. But this repo's own lockfile stayed on the vulnerable
`1.19.14`: pnpm reuses any already-resolved version that still satisfies
the union range and won't upgrade a transitive on its own. Clearing it
required three supporting changes:

- Bumps the `mcp-handler>@modelcontextprotocol/sdk` override from
`1.27.1` to `1.30.0`, dropping the duplicate `1.x`-range SDK that
`mcp-handler` otherwise pulls in.
- Bumps the dev-only `@modelcontextprotocol/sdk` in `test/package.json`
to `^1.30.0` for consistency.
- Adds a `'@hono/node-server@<2.0.5': '>=2.0.5'` override to force the
transitive onto the patched line, since no patched `1.x` exists and pnpm
won't move it otherwise. This affects only this repo's tree, not
published resolution.

Net lockfile change: `@hono/node-server` `1.19.14` → `2.0.12`, single
`@modelcontextprotocol/sdk@1.30.0`, no unrelated churn.

3.x only — `plugin-mcp@4.0` already migrated off the SDK.

Fixes #17610

Author: PatrikKozak

packages/plugin-mcp/package.json

@@ -48,7 +48,7 @@
     "pack:plugin": "pnpm build && pnpm pack"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.27.1",
+    "@modelcontextprotocol/sdk": "1.30.0",
     "@types/json-schema": "7.0.15",
     "json-schema-to-zod": "2.6.1",
     "mcp-handler": "^1.0.7",

pnpm-lock.yaml

@@ -27,13 +27,14 @@ savePrefix: ''
 verifyDepsBeforeRun: false
 
 overrides:
+  '@hono/node-server@<2.0.5': '>=2.0.5' # GHSA-frvp-7c67-39w9: no patched 1.x exists
   '@types/request>form-data': '^2.5.6'
   'amazon-cognito-identity-js>js-cookie': '^3.0.7'
   copyfiles: 'catalog:'
   cross-env: 'catalog:'
   dotenv: 'catalog:'
   graphql: '16.8.1'
-  'mcp-handler>@modelcontextprotocol/sdk': '1.27.1'
+  'mcp-handler>@modelcontextprotocol/sdk': '1.30.0'
   react: 'catalog:'
   react-dom: 'catalog:'
   typescript: 'catalog:'

pnpm-workspace.yaml

@@ -31,7 +31,7 @@
     "@date-fns/tz": "1.2.0",
     "@miniflare/d1": "2.14.4",
     "@miniflare/shared": "2.14.4",
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@next/env": "16.2.6",
     "@opennextjs/cloudflare": "1.16.1",
     "@payloadcms/admin-bar": "workspace:*",