chore(security): raise production audit gate

[dhairyashiil]

Summary

Raises the production dependency audit threshold from critical to high and updates/overrides vulnerable production dependency paths so bun audit --prod --audit-level=high passes.

Reviewer notes

• Upgrades next in apps/chat from 16.1.6 to 16.2.10. Please review this as a production framework upgrade even though the local production build passes.
• Upgrades @modelcontextprotocol/sdk in apps/mcp-server from 1.12.1 to 1.29.0. MCP tests and build pass, but reviewers should watch SDK behavior in integration/deploy checks.
• Adds root overrides for picomatch and fast-uri to clear high-severity production audit findings.
• This intentionally does not address every moderate/low advisory; it raises the CI gate to high as the next meaningful security bar.

Validation

• bun audit --prod --audit-level=high
• bun run typecheck
• bun --filter @calcom/mcp-server test
• AI_GATEWAY_API_KEY=test SLACK_CLIENT_ID=test SLACK_CLIENT_SECRET=test SLACK_SIGNING_SECRET=test SLACK_ENCRYPTION_KEY=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa REDIS_URL=redis://localhost:6379 CALCOM_WEBHOOK_SECRET=test bun --filter @calcom/chat build
• bun --filter extension build
• bun --filter @calcom/mcp-server build
• git diff --check HEAD~1..HEAD

[vercel]

@dhairyashiil is attempting to deploy a commit to the cal Team on Vercel.

A member of the Team first needs to authorize it.

[devin-ai-integration]

Devin Review found 2 potential issues.

[cubic-dev-ai]

1 issue found across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>