deps: consolidated security update and dependency refresh

[SamMorrowDrums]

Summary

Consolidated dependency update to resolve all open Dependabot security alerts and bring dependencies up to date.

Dependabot PRs merged in step 2

None. All three open Dependabot PRs (#58 cryptography, #59 anyio, #60 pyjwt) had a failing mcp-diff check, so per the task instructions they were not merged directly — their updates are folded into this PR instead. Root cause of the mcp-diff failures: that workflow installs via pip install -e . (bypassing uv.lock), which resolved the unbounded mcp>=1.28.1 constraint to the new mcp 2.x line. mcp 2.x renames FastMCP to MCPServer, so the server crashed on import with ModuleNotFoundError. This is fixed here (see below) and verified locally against pip install -e ..

Alerts fixed (18 open alerts, all now resolved)

• critical: anyio TLS/IDNA hostname spoofing (anyio < 4.14.2)
• critical: PyJWT asymmetric-PEM detection bypass (PyJWT <= 2.13.0)
• high (x8): PyJWT JWKS/redirect/DER/HMAC/BOM issues (PyJWT <= 2.13.0, two fixed at 2.14.0)
• high (x3): cryptography path-building, PKCS#7 Bleichenbacher oracle (cryptography < 49.0.0/50.0.0)
• medium (x6): PyJWT ReDoS/recursion/options-mutation issues, anyio stderr blocking, cryptography wildcard DNS

Fixed by:

• mcp: >=1.28.1 → >=1.30.0,<2 (also adds an explicit upper bound — see root-cause note above)
• pyjwt (transitive via mcp[crypto]): 2.13.0 → 2.15.1
• cryptography (transitive): 48.0.1 → 50.0.2
• anyio: >=4.13.0 → >=4.14.2 (direct bump), lockfile resolves to 4.15.1
• starlette, pydantic, pydantic-settings, python-multipart, etc. bumped transitively along with mcp

Verified with check_dependency_vulnerabilities: 0 vulnerable out of 18 checked packages/actions.

Other updates

• Dev tooling bumped to latest stable: ruff 0.14.11→0.16.10, pytest 9.0.3→9.1.1, pyright 1.1.408→1.1.414, watchfiles 1.1.1→1.3.0
• astral-sh/setup-uv GitHub Action: v7 → v10.2.0 (latest; no floating major tags exist beyond v7 for this action, so pinned to the exact latest release, consistent with how mcp-conformance-action/mcp-server-diff are already pinned in this repo)
• uv.lock fully refreshed

Deferred

• mcp 2.x (major, breaking FastMCP→MCPServer rename) — deferred. Not required to fix any alert, and migrating the server code is a non-trivial breaking change out of scope for a dependency-hygiene PR. An explicit <2 upper bound now prevents accidentally picking it up until a deliberate migration is done.

Validation

• uv run ruff check . — pass
• uv run ruff format --check . — pass
• uv run pyright — same 4 pre-existing errors as on main (unrelated to this change, confirmed by running pyright against a clean clone of main)
• No test suite exists in this template repo
• Verified python -m mcp_starter.server --http starts successfully with the updated lockfile
• Verified pip install -e . (as used by the mcp-diff CI workflow) now resolves to mcp 1.x and the server starts, fixing the previously-failing check

Dependabot config

.github/dependabot.yml already covers both ecosystems in use (github-actions and pip/uv) — no changes needed there.