Harden public validation

Author: jvogan

.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           languages: javascript-typescript
 
@@ -40,4 +40,4 @@ jobs:
           bun install --frozen-lockfile --ignore-scripts
 
       - name: Analyze
-        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

bridge/bun.lock

@@ -22,6 +22,7 @@
     "fast-uri": "^3.1.2",
     "hono": "^4.12.18",
     "ip-address": "^10.2.0",
-    "path-to-regexp": "^8.4.2"
+    "path-to-regexp": "^8.4.2",
+    "qs": "^6.15.2"
   }
 }

bridge/package.json

@@ -130,7 +130,8 @@ if [[ "$with_bridge" == "1" && -f "bridge/package.json" ]]; then
   echo "Typechecking MCP bridge"
   (
     cd bridge
-    bun install --frozen-lockfile
+    bun install --frozen-lockfile --ignore-scripts
+    bun audit --audit-level=moderate
     bun run typecheck
   )
 fi