v1.36.4 — Dependency security update

Dependency update release. No API, schema, or MCP contract changes.

Security

• mcp / mcp-types 2.1.1 → 2.2.0 — picks up the fix for CVE-2026-59951
  (unbounded session retention in the SDK's stateful Streamable HTTP
  transport). ContrastAPI serves MCP in stateless mode, so the vulnerable
  path was not reachable; upgraded as a precaution.

Dependencies

• starlette 1.6.0 → 1.8.0
• uvicorn 0.52.4 → 0.54.0
• phonenumbers 9.0.39 → 9.0.40

Behaviour note

• GET /mcp/ responses now carry Vary: Accept, Origin (was Vary: Accept),
  from starlette's CORS middleware. Caches keyed on Vary stay correct.

Counts

• MCP: 55 tools · 7 resources · 3 prompts (unchanged)
• Tests: 3021 passing (unchanged)