[devin-ai-integration]

Summary

Brings the SDK's dependencies up to date. bun audit goes from 6 findings (1 high, 5 moderate) to 0.

• protobufjs ^8.0.3 → ^8.8.1, fflate ^0.8.2 → ^0.8.3
• csv-parse ^6.2.1 → ^7.0.3: a major bump, but the existing parse calls are unchanged and the GTFS parsing tests pass
• @types/bun pinned to 1.4.4 instead of latest
• typescript peer ^5 → >=5 <7, so projects on TS 6 (like mta-api) don't get a peer warning

Package version is unchanged.

Testing: bun test 15 passed and 1 skipped (hosted-integration.test.ts needs MTA_API_KEY), and bun run typecheck passes. generate:types ran against a synthetic snapshot, because the real snapshot URL env var isn't set here.

Link to Devin session: https://app.devin.ai/sessions/0c4a45aeae754724bd092a6abc7e1004
Open in Devin Desktop: https://app.devin.ai/desktop/session/0c4a45aeae754724bd092a6abc7e1004?variant=devin
Requested by: @gtokman

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring