Repository navigation
chore(deps): widen @modelcontextprotocol/sdk to ^1.30.0 - #6
Merged
Merged
Conversation
The exact 1.29.0 pin froze @hono/node-server below 2.0.5, leaving GHSA-frvp-7c67-39w9 unreachable for consumers without a release from us. A caret range excludes breaking majors by semver contract, which is the protection the ADR risk row actually called for, and lets consumers pick up patched minors on their own. SDK 1.30.0 widens its @hono/node-server range to ^1.19.9 || ^2.0.5. Refreshed the lock file to clear the remaining advisories, all within existing package.json ranges, so npm run audit (a PR and publish gate) passes clean. Release as 1.3.1. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks GHSA-frvp-7c67-39w9 for consumers of this package. The exact
1.29.0pin held@hono/node-serverbelow2.0.5, so downstream repos could not reach the patched version without a release from us —apm-betterlife-frontendhas been carrying an.nsprcexception since 2026-07-22 as a result.@modelcontextprotocol/sdk1.29.0→^1.30.0. 1.30.0 widens its own@hono/node-serverrange to^1.19.9 || ^2.0.5. The caret still excludes breaking majors by semver contract — the protection the ADR risk row was actually after — while letting consumers pick up patched minors themselves.npm audit fix(no--force, nopackage.jsonrange edits): 11 advisories → 0.npm run auditgates bothpr.ymlandpublish.yml, so this had to be clean for the release to ship.technology-stack-selection.mdupdated to match — it previously prescribed the pin that caused this.src/reformatted to satisfyprettier --check, which was already failing onmainbefore this branch. No behaviour change.playwrightandbetter-sqlite3stay pinned — Playwright's browser binaries are version-matched, and better-sqlite3 ships per-version native prebuilds.Merging this publishes
@makerx/csp-analyser@1.3.1to npm viapublish.yml.Verification: typecheck, lint, format:check, build and
npm run auditall clean; 1153 tests across 41 files pass;docs:buildsucceeds (checked because the lock refresh moved vite/rolldown).Follow-up for consumers: bumping to 1.3.1 alone won't fix their audit —
@hono/node-server@1.19.14is already in their lock files and still satisfies the new range, so it needsnpm update @hono/node-serveralongside. After that theGHSA-frvp-7c67-39w9exception can be dropped from both.nsprcfiles.