fix(deps): clear 6 advisories in the MCP SDK's transitive tree - #5
Merged
Conversation
All six arrive through @modelcontextprotocol/sdk@1.30.0 and all six are in-range patch bumps — no direct dependency moves: fast-uri 3.1.4 -> 3.1.5 GHSA-7p8r-x3mc-p8w7 (high) host confusion via a backslash authority introducer ip-address 10.2.0 -> 10.4.0 GHSA-mwp4-54f8-5fhr (high) leading-zero octets decoded as decimal, + two SSRF / trust-boundary bypasses hono 4.12.31 -> 4.13.0 GHSA-8j4g-w8fx-2239 ReDoS in CORS middleware @hono/node-server 1.19.14 -> 2.1.0 GHSA-frvp-7c67-39w9 path traversal in serve-static on Windows via encoded `%5C` The node-server major is sanctioned upstream, not forced: the SDK declares `^1.19.9 || ^2.0.5`, so 2.x is a range the SDK already supports and 2.0.5 is where the traversal fix landed. Cooldown: hono@4.13.0 and @hono/node-server@2.1.0 both clear the 72h window today. hono has no aged alternative — 4.12.34 is the first fixed version and it shipped the same day as 4.13.0 — so waiting longer would only mean staying vulnerable. Separately, and pre-existing: esbuild@0.28.1 has been in the lockfile with no allowScripts decision recorded, so `sync --check` has been reporting drift (report-only here, so it never failed). Approved true — devDependency, needed to build, and the same call already made in grok-loop-kit. All 18 scenarios pass, npm audit reports 0 vulnerabilities. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All six arrive through @modelcontextprotocol/sdk@1.30.0 and all six are in-range
patch bumps — no direct dependency moves:
fast-uri 3.1.4 -> 3.1.5 GHSA-7p8r-x3mc-p8w7 (high) host confusion
via a backslash authority introducer
ip-address 10.2.0 -> 10.4.0 GHSA-mwp4-54f8-5fhr (high) leading-zero
octets decoded as decimal, + two SSRF /
trust-boundary bypasses
hono 4.12.31 -> 4.13.0 GHSA-8j4g-w8fx-2239 ReDoS in CORS
middleware
@hono/node-server 1.19.14 -> 2.1.0 GHSA-frvp-7c67-39w9 path traversal in
serve-static on Windows via encoded
%5CThe node-server major is sanctioned upstream, not forced: the SDK declares
^1.19.9 || ^2.0.5, so 2.x is a range the SDK already supports and 2.0.5 iswhere the traversal fix landed.
Cooldown: hono@4.13.0 and @hono/node-server@2.1.0 both clear the 72h window
today. hono has no aged alternative — 4.12.34 is the first fixed version and it
shipped the same day as 4.13.0 — so waiting longer would only mean staying
vulnerable.
Separately, and pre-existing: esbuild@0.28.1 has been in the lockfile with no
allowScripts decision recorded, so
sync --checkhas been reporting drift(report-only here, so it never failed). Approved true — devDependency, needed
to build, and the same call already made in grok-loop-kit.
All 18 scenarios pass, npm audit reports 0 vulnerabilities.
Co-Authored-By: Claude Opus 5 noreply@anthropic.com