chore: add CVE-2026-4926 to CHANGELOG

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## Unreleased
 
+### Security
+
+- **CVE-2026-4926**: Upgraded `@modelcontextprotocol/sdk` to `^1.29.0`, resolving `path-to-regexp` to `8.4.1` and fixing the ReDoS vulnerability [GHSA-j3q9-mxjg-w52f](https://github.com/advisories/GHSA-j3q9-mxjg-w52f); regenerated output-validation patch for the new version
+
 ### Public API
 
 - **Add `getAllTools` and `getVersionInfo` to public exports** — `getAllTools` is now re-exported from `@mapbox/mcp-devkit-server/tools` and `getVersionInfo` (plus `VersionInfo` type) from `@mapbox/mcp-devkit-server/utils`. These are needed by `hosted-mcp-server` to import server functionality via npm packages instead of submodule filesystem paths.

cspell.config.json

@@ -7,7 +7,9 @@
     "isochrone",
     "mapbox",
     "mmss",
-    "tilequery"
+    "tilequery",
+    "GHSA",
+    "mxjg"
   ],
   "ignorePaths": [
     "node_modules",