chore(deps): update upstash/context7 digest to dedb03d

[renovate]

This PR contains the following updates:

Package	Update	Change
upstash/context7	digest	6f42b66 → dedb03d

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ context7-mcp

• Status: Passed
• Findings: 2

---

Summary: Completed 1 of 1 skill scan(s), all passed security checks. ✅

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[danbarr]

Security triage: no exclusions added.

• LLM_SUPPLY_CHAIN_ATTACK (context7-cli) remains blocking. This is not a false positive: references/skills.md permits installing arbitrary /owner/repo skills, including --all and global installation, without source verification or user approval. Upstash is a trusted publisher, but that does not constrain the third-party repositories this capability retrieves.
• context7-mcp has no blocking finding; its single non-blocking result requires no allowlist entry.

Validated against the failed Trusted Skill Scan run: https://github.com/stacklok/dockyard/actions/runs/35348035109

[danbarr]

Deferred skills/context7-cli/spec.yaml to its PR-base ref/version (6f42b66… / 0.3.0); the context7-mcp update remains.

Validation passed: task validate-skill -- skills/context7-mcp; task scan-skill -- skills/context7-mcp passed with no blocking security issues.