v2.1.12

Security

• Floored the transitive fast-uri override from ^3.1.5 to >=3.1.6 <4, clearing four
  open high-severity Dependabot alerts: GHSA-jqff-g426-hqxp
  (host confusion via percent-encoded scheme normalization), GHSA-fph4-wmhf-6fwf
  (SSRF via repeated hostname percent-decoding), GHSA-f65p-4m7j-42xc
  (SSRF via malformed IPv6 normalization), and GHSA-5jgf-p345-68v8
  (host confusion via skipped IDN canonicalization) — alerts #17-#20. All four are fixed
  upstream in fast-uri@3.1.6. fast-uri is reached transitively as ajv ->
  @modelcontextprotocol/sdk, and ajv is inlined into the shipped build/index.js bundle,
  so this is a real runtime exposure, not just a dev-toolchain one — Dependabot cannot open
  a PR for a transitive dependency, so the fix is a pnpm-workspace.yaml overrides: entry.
  Kept two-sided (>=3.1.6 <4), never an exact pin — see the comment above the override for
  why an exact pin previously inverted into a ceiling and re-introduced the vulnerability it
  was meant to fix.

Changed

• Supply-chain soak raised from 1 day to 7 days (minimumReleaseAge: 10080 in
  pnpm-workspace.yaml). This is a development/CI-time policy — no shipped bytes change.
  It is not redundant with Dependabot's existing 7-day cooldown: the cooldown governs only
  what Dependabot proposes (direct dependencies), while minimumReleaseAge governs
  everything a resolution installs, including transitive packages Dependabot never sees.
  Verified against this repo's committed lockfile, which needs no churn to satisfy it.
  Prompted by sweetrb/apple-mail-mcp#174
  (@anupamme), applied across all four Apple MCP repos so the value cannot drift.