chore(deps): consolidated bump of Python, npm, and Actions dependencies (#84)

* chore(deps): bump Python deps to latest minor/patch

Consolidates dependabot PRs #69, #70, #74-78, #80-82. Versions landed via
``uv lock --upgrade-package``:

- urllib3 2.6.3 → 2.7.0 (security: decompression-bomb safeguards, header
  stripping on redirect via ProxyManager)
- pydantic 2.13.3 → 2.13.4
- tox 4.53.1 → 4.54.0
- ruff 0.15.12 → 0.15.13
- openapi-python-client 0.28.3 → 0.28.4
- datamodel-code-generator 0.56.1 → 0.57.0
- poethepoet 0.45.0 → 0.46.0
- ty 0.0.34 → 0.0.38
- fastmcp 3.2.4 → 3.3.1
- idna 3.12 → 3.15
- pymdown-extensions 10.21.2 → 10.21.3
- authlib 1.7.0 → 1.7.2
- types-pyyaml 6.0.12.20260408 → 20260518
- types-jsonschema 4.26.0.20260408 → 20260518
- types-python-dateutil 2.9.0.20260408 → 20260518
- gitpython 3.1.47 → 3.1.50 (security advisory)
- python-multipart 0.0.26 → 0.0.29

All tests pass (299/299) including the new prefab UI tests.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(ts)(deps-dev): bump npm packages to latest minor/patch

Consolidates dependabot PR #79. Versions landed via ``pnpm update``:

- @biomejs/biome 2.4.14 → 2.4.15
- @hey-api/openapi-ts 0.97.1 → 0.97.2
- @semantic-release/github 12.0.6 → 12.0.8
- @semantic-release/release-notes-generator 14.1.0 → 14.1.1
- @types/node 25.6.0 → 25.9.1
- @vitest/coverage-v8 4.1.5 → 4.1.7
- vitest 4.1.5 → 4.1.7

All TS tests pass (104/104) + biome lint + tsc typecheck clean.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(actions)(deps): bump GitHub Actions to latest

Consolidates dependabot PR #71.

- actions/setup-python v5 → v6 (release-mcp.yml)
- actions/setup-node v5 → v6 (release-mcp.yml)
- actions/dependency-review-action v4 → v5 (security.yml)

setup-node v6 has a breaking change ("Limit automatic caching to npm")
that only affects callers passing ``cache:`` for non-npm package
managers. The bumped workflow doesn't pass ``cache:`` to setup-node, so
no migration needed.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: dougborg

.github/workflows/release-mcp.yml

@@ -80,12 +80,12 @@ jobs:
       # instead of setup-uv so we don't pull in a project venv resolution we
       # don't use.
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.14"
 
       - name: Install Node.js (for mcpb CLI)
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
 

.github/workflows/security.yml

@@ -60,4 +60,4 @@ jobs:
     if: github.event_name == 'pull_request'
     steps:
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5

packages/statuspro-client/package.json

@@ -59,24 +59,24 @@
   },
   "homepage": "https://github.com/dougborg/statuspro-openapi-client/tree/main/packages/statuspro-client#readme",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.14",
-    "@hey-api/openapi-ts": "^0.97.1",
+    "@biomejs/biome": "^2.4.15",
+    "@hey-api/openapi-ts": "^0.97.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/github": "^12.0.8",
     "@semantic-release/npm": "^13.1.5",
-    "@semantic-release/release-notes-generator": "^14.1.0",
-    "@types/node": "^25.6.0",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.1",
+    "@types/node": "^25.9.1",
+    "@vitest/coverage-v8": "^4.1.7",
     "conventional-changelog-conventionalcommits": "^9.3.1",
     "semantic-release": "^25.0.3",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.7"
   },
   "sideEffects": false
 }