From a34bf179d52d16569c7174fcb31d537d0b2c9403 Mon Sep 17 00:00:00 2001 From: James Sesler Date: Sun, 2 Aug 2026 12:02:16 -0400 Subject: [PATCH] fix: bump transitive deps to clear npm audit gate CI runs `npm audit --omit=dev --audit-level=high`, which has been failing on main and therefore on every open PR. The blocking advisory is the high severity brace-expansion DoS (GHSA-mh99-v99m-4gvg), reached via @earendil-works/pi-coding-agent -> minimatch -> brace-expansion@5.0.7. `npm audit fix` resolves it as a lockfile-only change: - brace-expansion 5.0.7 -> 5.0.9 (the high advisory) - @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 (satisfies existing ^1.29.0) - @hono/node-server 1.19.14 -> 2.0.12 (moderate path traversal advisory; the major bump is within the SDK's own declared ^1.19.9 || ^2.0.5 range, not a forced override) package.json is unchanged and no overrides were added. Verified: audit gate exits 0, build clean, 270/270 tests pass, and the MCP server still completes an initialize + tools/list handshake against the bumped SDK. Co-Authored-By: Claude Opus 5 --- package-lock.json | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/package-lock.json b/package-lock.json index cc1ae34..0bcc66a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -633,12 +633,12 @@ } }, "node_modules/@hono/node-server": { - "version": "1.19.14", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz", - "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==", + "version": "2.0.12", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.12.tgz", + "integrity": "sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==", "license": "MIT", "engines": { - "node": ">=18.14.1" + "node": ">=20" }, "peerDependencies": { "hono": "^4" @@ -871,12 +871,12 @@ } }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.29.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz", - "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==", + "version": "1.30.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", + "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", "license": "MIT", "dependencies": { - "@hono/node-server": "^1.19.9", + "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", @@ -1297,16 +1297,16 @@ "peer": true }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "peer": true, "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/buffer-equal-constant-time": {