v1: release 1.0.2 with the pending security and audit fixes

[cliffhall]

Summary

Bump v1/main from 1.0.1 to 1.0.2 to release the pending security and hygiene fixes.

v1 receives security fixes only, and three are queued but unreleased. 1.0.2 is the vehicle for shipping them to @modelcontextprotocol/inspector consumers on the v1-latest dist-tag.

What 1.0.2 should contain

Issue	Change
#2072	js-yaml overrides bumped to patched 3.15.1 / 4.3.1 — the previous pins sat inside the advisory range, making npm audit fix a no-op
#2074	Remaining audit advisories cleared: ip-address, hono, @hono/node-server, fast-uri, brace-expansion (+ dev-only nanoid, postcss)
#2079	allowScripts denials for esbuild / fsevents, silencing the npm 11.19 install-script warning

Net effect for the release: npm audit goes from 8 advisories to 0, with no install-script warning on install.

Of those, only ip-address was assessed as genuinely reachable in production code (rate-limit key bypass on /sandbox via express-rate-limit's IPv6 subnet keying). The rest were either present-but-unexercised or dev-only — see #2074 for the per-package analysis. So this is a hygiene release rather than a response to an actively exploitable defect.

Scope

Version fields only — no functional change:

• version in package.json, client/, server/, cli/
• the three @modelcontextprotocol/inspector-* workspace dependency ranges in the root package.json (^1.0.1 -> ^1.0.2)
• the matching version fields in package-lock.json

Note on the version tooling

npm run update-version 1.0.2 performs the correct package.json edits, but finishes with a bare npm install, which re-resolves the whole tree. On this branch that produces a ~2450-line lockfile diff touching 164 packages, including production dependencies (@modelcontextprotocol/sdk, hono, @hono/node-server 1.x -> 2.x major, jose, ws) — exactly the churn that #2072 and #2074 were careful to avoid.

For a deprecated branch the lockfile version fields should be edited directly instead, keeping the diff to the 8 fields that actually change. Worth fixing in the script for v2, but out of scope here.

Verification

node scripts/check-version-consistency.js passes. npm ci accepts the lockfile without modifying it. Build, lint/prettier, and all suites pass (539 client + 37 server + 85 CLI). npm audit reports 0 vulnerabilities and npm install-scripts ls reports no unreviewed scripts. The app starts, serves the client, and gates proxy auth correctly.

Release checklist

Publishing is npm run publish-all, which pushes to the v1-latest dist-tag (v1 is rejected by npm as a version-like tag — see #1829). Tag as v1.0.2 after merge.