fix(deps): upgrade mcp 1.27.1 -> 1.28.1 (CVE-2026-52869)

[manavgup]

Problem

CVE-2026-52869 (HIGH) against mcp 1.27.1 was published to the Trivy vulnerability DB after #833 passed on July 16. Result: main's post-merge Docker build failed the CVE scan (so the #833 deploy was skipped — production is untouched), and PR #832's rebased checks fail on the same finding.

Solution

Lockfile-only bump: mcp 1.27.1 → 1.28.1 (covers the 1.27.2 fix). make verify passes locally: 2134 tests, all checks green.

Notes

• Merge before chore(ci): make staging ephemeral — provision per deploy, destroy after #832/chore(infra): scale prod web to zero when idle #831; I'll rebase chore(ci): make staging ephemeral — provision per deploy, destroy after #832 on top so its scan re-runs clean.
• This is the third newly-published-CVE block in four days. If the cadence keeps up, options are: pin Trivy to fail only on CVEs with released fixes older than N days, or accept the friction as the cost of a hard HIGH gate. Worth a think, not urgent.

🤖 Generated with Claude Code