fix: pin mcp deps and patch vitest audit (#98)

* fix: update vitest for security audit

* chore: lock mcp server dependency versions

* chore: pin mcp deps to declared versions

Author: dhairyashiil

apps/mcp-server/Dockerfile

@@ -2,6 +2,8 @@ FROM oven/bun:1 AS builder
 
 WORKDIR /app
 
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ && rm -rf /var/lib/apt/lists/*
+
 COPY package.json bun.lock* ./
 RUN bun install --frozen-lockfile
 
@@ -10,14 +12,13 @@ RUN bun run build
 RUN bun install --frozen-lockfile --production
 
 # ── Production stage ──
-FROM node:20-slim
+FROM node:22-slim
 
 WORKDIR /app
 
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/package.json ./
-COPY --from=builder /app/bun.lock* ./
 
 ENV NODE_ENV=production
 ENV MCP_TRANSPORT=http

apps/mcp-server/README.md

@@ -15,7 +15,7 @@ A **Model Context Protocol (MCP)** server that wraps the [Cal.com Platform API v
 
 ### Prerequisites
 
-- Node.js >= 18
+- Node.js >= 22
 - [Bun](https://bun.sh/) (for workspace install)
 - A Cal.com API key ([get one here](https://app.cal.com/settings/developer/api-keys))
 

apps/mcp-server/package.json

@@ -11,7 +11,7 @@
     "directory": "apps/mcp-server"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "files": [
     "dist"
@@ -28,15 +28,15 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1",
-    "@vercel/postgres": "^0.10.0",
-    "zod": "^3.24.4"
+    "@modelcontextprotocol/sdk": "1.12.1",
+    "@vercel/postgres": "0.10.0",
+    "zod": "3.24.4"
   },
   "devDependencies": {
     "@biomejs/biome": "2.3.10",
     "@types/node": "22.19.6",
-    "tsx": "^4.19.4",
+    "tsx": "4.19.4",
     "typescript": "5.9.3",
-    "vitest": "^3.2.1"
+    "vitest": "4.1.8"
   }
 }