1.3.7 - Dependency security updates

Security maintenance

Resolves all open npm audit advisories by bumping transitive dependencies. npm audit --audit-level=high now reports zero vulnerabilities.

GHSAs resolved

Production dependency chain (@modelcontextprotocol/sdk → express → router → path-to-regexp):

• path-to-regexp DoS via sequential optional groups (GHSA-j3q9-mxjg-w52f)
• path-to-regexp ReDoS via multiple wildcards (GHSA-27v5-c462-wpq7)

These were not exploitable in practice because mcp-ssh uses the SDK over STDIO and never touches the HTTP routing code paths the advisories apply to — but they are fixed anyway.

Development dependency chain (vitest / test tooling):

• hono — 6 advisories (prototype pollution, cookie handling, IP matching, path traversal, middleware bypass)
• @hono/node-server — middleware bypass via repeated slashes
• node-forge — 4 high-severity crypto advisories
• brace-expansion — DoS via zero-step sequence
• picomatch — method injection + ReDoS
• vite — path traversal, server.fs.deny bypass, arbitrary file read

The vite fix required a minor bump of vitest and @vitest/coverage-v8 from 4.0.18 to 4.1.4.

Verification

• npm audit --audit-level=high → 0 vulnerabilities
• vitest run → 99/99 tests green

Upgrade

npm install -g @aiondadotcom/mcp-ssh@1.3.7 or update your client config to use npx @aiondadotcom/mcp-ssh@latest.