fix(security): resolve Dependabot and token-permission alerts

.github/workflows/codeql.yml

@@ -20,10 +20,11 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   analyze:
+    permissions:
+      security-events: write
     runs-on: ubuntu-latest
     timeout-minutes: 15
     strategy:

.github/workflows/docker.yml

@@ -18,14 +18,16 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   build-and-push:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-bookworm-slim
+FROM node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
 WORKDIR /app
 COPY package.json package-lock.json* .npmrc* ./
 COPY packages ./packages

package.json

@@ -67,6 +67,8 @@
     "@hono/node-server": "2.0.12",
     "@modelcontextprotocol/sdk": {
       "@hono/node-server": "2.0.12"
-    }
+    },
+    "fast-uri": "3.1.7",
+    "qs": "6.16.0"
   }
 }