fix(triage): bump deps to address 20 Dependabot security alerts

[ryanmac]

Summary

• Bumps 8 direct dependencies to resolve 20 Dependabot security alerts (9 high, 10 medium, 1 low)
• Patches: undici, hono, @hono/node-server, express-rate-limit, minimatch, flatted, js-yaml, picomatch
• All CVEs addressed — npm audit reports 0 vulnerabilities

Verification

• npm audit: 0 vulnerabilities (528 packages audited)
• Build (tsc): PASSED
• Tests (jest): 12 passed, 4 skipped (pre-existing)

CVEs Resolved

Package	CVEs
undici ^7.18.2	CVE-2026-1526, CVE-2026-2229, CVE-2026-1528, CVE-2026-1527, CVE-2026-1525, CVE-2025-47279
hono ^4.12.7	CVE-2026-29045, CVE-2026-29086, CVE-2026-29085, prototype pollution
@hono/node-server ^1.19.10	CVE-2026-29087
express-rate-limit ^8.2.2	CVE-2026-30827
minimatch ^10.2.3	CVE-2026-27903
flatted ^3.4.2	CVE-2026-33228
js-yaml ^4.1.1	CVE-2025-64718
picomatch ^4.0.4	CVE-2026-33672

Ref: agent-twitter-client-mcp_dependabot_2026-03-30.md

🤖 Generated with Claude Code

---

Note

Medium Risk
Medium risk because it upgrades multiple runtime HTTP/server/matching libraries (undici, hono, express-rate-limit, minimatch, picomatch), which can introduce subtle behavior changes despite being a security-focused bump.

Overview
Security maintenance update: bumps several direct dependencies (and refreshes package-lock.json) to address reported vulnerabilities, including undici, hono/@hono/node-server, express-rate-limit, minimatch, picomatch, js-yaml, and flatted.

Also updates .gitignore to properly ignore *.tsbuildinfo and adds .omc/ state to ignored files.

^{Written by Cursor Bugbot for commit 0979a75. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Dev-only packages incorrectly added as production dependencies

Medium Severity

flatted, js-yaml, minimatch, and picomatch are transitive dependencies exclusively of dev tooling (eslint, jest, @typescript-eslint) — none are imported in the source code or required by any production dependency. Adding them to dependencies instead of devDependencies means anyone installing this published package (publishConfig: { access: "public" }) gets four unnecessary dependency trees, including a major-version-bumped minimatch v10 and picomatch v4. Moving them to devDependencies would still fix the dev-tool CVEs while keeping the production install clean.