From 2eb3a3973dba91cce1961b1c664ac40508e50a3e Mon Sep 17 00:00:00 2001 From: finalerock44 Date: Tue, 4 Aug 2026 16:31:52 +0100 Subject: [PATCH] fix(deps): resolve three new transitive security advisories pnpm audit --audit-level moderate started failing CI on every branch, including a clean dev - these advisories were published after dev's last green run, so nothing in the tree had to change to break it. - brace-expansion: the existing override pinned 5.0.8, which GHSA-rgw5-rvv9-x895 now covers (vulnerable <5.0.9). Range and target bumped to 5.0.9. - fast-uri (via @modelcontextprotocol/sdk > ajv): GHSA-7p8r-x3mc-p8w7, pinned 3.1.5. - hono (via @modelcontextprotocol/sdk): GHSA-8j4g-w8fx-2239, pinned 4.12.34. All three pinned to the lowest patched version within their current major, following the existing exact-pin overrides. A first pass using open '>=' ranges pulled fast-uri 4.1.2 - a major jump inside ajv - for no benefit; these land on 3.1.5 and 4.12.34 instead. audit clean; lint, typecheck, build and all 194 tests pass. fast-uri and hono are both MCP SDK dependencies, so also smoke-tested dist/mcp/index.js over stdio: initialize and tools/list both return, all five tools registered. --- package.json | 4 +++- pnpm-lock.yaml | 40 +++++++++++++++++++++------------------- 2 files changed, 24 insertions(+), 20 deletions(-) diff --git a/package.json b/package.json index c46c51c..83e841f 100644 --- a/package.json +++ b/package.json @@ -105,9 +105,11 @@ "diff@>=6.0.0": "8.0.3", "brace-expansion@<1.1.16": "1.1.16", "brace-expansion@>=2.0.0 <2.0.3": "2.0.3", - "brace-expansion@>=3.0.0 <5.0.8": "5.0.8", + "brace-expansion@>=3.0.0 <5.0.9": "5.0.9", "ws@>=8.0.0 <8.21.0": "8.21.0", "esbuild@<0.28.1": ">=0.28.1", + "fast-uri@>=3.0.0 <3.1.5": "3.1.5", + "hono@>=4.0.0 <4.12.34": "4.12.34", "micromatch>picomatch": "^2.3.2", "tinyglobby>picomatch": "^4.0.4" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3d9a3f8..a75f3d2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -26,9 +26,11 @@ overrides: diff@>=6.0.0: 8.0.3 brace-expansion@<1.1.16: 1.1.16 brace-expansion@>=2.0.0 <2.0.3: 2.0.3 - brace-expansion@>=3.0.0 <5.0.8: 5.0.8 + brace-expansion@>=3.0.0 <5.0.9: 5.0.9 ws@>=8.0.0 <8.21.0: 8.21.0 esbuild@<0.28.1: '>=0.28.1' + fast-uri@>=3.0.0 <3.1.5: 3.1.5 + hono@>=4.0.0 <4.12.34: 4.12.34 micromatch>picomatch: ^2.3.2 tinyglobby>picomatch: ^4.0.4 @@ -344,7 +346,7 @@ packages: resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} engines: {node: '>=20'} peerDependencies: - hono: ^4 + hono: 4.12.34 '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -589,8 +591,8 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@5.0.8: - resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} engines: {node: 20 || >=22} braces@3.0.3: @@ -906,8 +908,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.4: - resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -1035,8 +1037,8 @@ packages: resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==} hasBin: true - hono@4.12.32: - resolution: {integrity: sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==} + hono@4.12.34: + resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} engines: {node: '>=16.9.0'} http-errors@2.0.1: @@ -1919,9 +1921,9 @@ snapshots: '@eslint/core': 1.2.1 levn: 0.4.1 - '@hono/node-server@2.0.12(hono@4.12.32)': + '@hono/node-server@2.0.12(hono@4.12.34)': dependencies: - hono: 4.12.32 + hono: 4.12.34 '@humanfs/core@0.19.2': dependencies: @@ -1954,7 +1956,7 @@ snapshots: '@modelcontextprotocol/sdk@1.30.0(zod@4.4.3)': dependencies: - '@hono/node-server': 2.0.12(hono@4.12.32) + '@hono/node-server': 2.0.12(hono@4.12.34) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -1964,7 +1966,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.6.1(express@5.2.1) - hono: 4.12.32 + hono: 4.12.34 jose: 6.2.5 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -2164,7 +2166,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.4 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2206,7 +2208,7 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@5.0.8: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -2575,7 +2577,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.4: {} + fast-uri@3.1.5: {} fast-wrap-ansi@0.2.2: dependencies: @@ -2697,7 +2699,7 @@ snapshots: he@1.2.0: {} - hono@4.12.32: {} + hono@4.12.34: {} http-errors@2.0.1: dependencies: @@ -2873,15 +2875,15 @@ snapshots: minimatch@10.2.3: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.9 minimatch@10.2.6: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.9 minimatch@9.0.7: dependencies: - brace-expansion: 5.0.8 + brace-expansion: 5.0.9 minimist@1.2.8: {}