fix: bump transitive deps to clear npm audit CI gate - #78
Merged
Conversation
CI runs `npm audit --omit=dev --audit-level=high`, which has been failing on main and therefore on every open PR. The blocking advisory is the high severity brace-expansion DoS (GHSA-mh99-v99m-4gvg), reached via @earendil-works/pi-coding-agent -> minimatch -> brace-expansion@5.0.7. `npm audit fix` resolves it as a lockfile-only change: - brace-expansion 5.0.7 -> 5.0.9 (the high advisory) - @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 (satisfies existing ^1.29.0) - @hono/node-server 1.19.14 -> 2.0.12 (moderate path traversal advisory; the major bump is within the SDK's own declared ^1.19.9 || ^2.0.5 range, not a forced override) package.json is unchanged and no overrides were added. Verified: audit gate exits 0, build clean, 270/270 tests pass, and the MCP server still completes an initialize + tools/list handshake against the bumped SDK. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
CI runs
npm audit --omit=dev --audit-level=high. That step has been failing onmain, so every open PR shows red CI regardless of its own content — including #77.The blocking advisory is the one high:
brace-expansionDoS via unbounded expansion, reached transitively:This also clears the two dependabot alerts on the default branch.
Fix
npm audit fix— lockfile-only,package.jsonuntouched, nooverridesadded:brace-expansion@modelcontextprotocol/sdk^1.29.0@hono/node-serverThe
@hono/node-servermajor bump is transitive and worth a second look — but it is within the MCP SDK's own declared range (^1.19.9 || ^2.0.5in@modelcontextprotocol/sdk@1.30.0), so it's a supported combination rather than a forced upgrade.Verification
npm audit --omit=dev --audit-level=high→ exit 0 (found 0 vulnerabilities)npm run build→ cleannpm test→ 270/270 passinitializehandshake andtools/listboth return correctly over stdioMerge order
Merge this first, then update #77 — its CI should go green without any change to its own content.
🤖 Generated with Claude Code