Skip to content

fix: pin examples MCP SDK to audited graph - #3

Merged
sjungwon03 merged 1 commit into
devfrom
fix/2-audit-clean-mcp-sdk
Jul 28, 2026
Merged

fix: pin examples MCP SDK to audited graph#3
sjungwon03 merged 1 commit into
devfrom
fix/2-audit-clean-mcp-sdk

Conversation

@sjungwon03

@sjungwon03 sjungwon03 commented Jul 28, 2026

Copy link
Copy Markdown
Member

Summary

  • Pin this examples application through npm overrides to @modelcontextprotocol/sdk@1.30.0.
  • Resolve the lockfile to @hono/node-server@2.0.12, outside GHSA-frvp-7c67-39w9's affected range.
  • Add a production dependency-graph test and make npm audit --omit=dev --audit-level=low a local and CI gate.
  • Document the scope: this is an examples-app lockfile mitigation, not a remediation for downstream TypeMCP consumers. Upstream work remains fix(deps): remediate MCP SDK transitive @hono/node-server advisory type-mcp#93.

Verification

  • npm ci ✅
  • npm run check ✅ — format, typecheck, 5 tests, production audit
  • All four npm run example:* commands ✅
  • npm audit --omit=dev --audit-level=low — 0 vulnerabilities ✅
  • git diff --check ✅

Closes #2

@sjungwon03 sjungwon03 added dependencies Dependency management security Security remediation labels Jul 28, 2026
@sjungwon03 sjungwon03 self-assigned this Jul 28, 2026
@sjungwon03
sjungwon03 requested a review from sjungwon03-ai July 28, 2026 17:33
sjungwon03-ai
sjungwon03-ai approved these changes Jul 28, 2026
View reviewed changes

@sjungwon03-ai sjungwon03-ai left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Independent review at exact head 17b8f01. Application-scoped npm override correctly resolves the examples lockfile to MCP SDK 1.30.0 and @hono/node-server 2.0.12 (outside GHSA-frvp-7c67-39w9). Scope documentation, dependency test, CI audit gate, and upstream issue reference are all accurate. No unrelated regressions. Exact-head CI passes.

Comment thread package.json
Comment thread test/dependency-security.test.ts
Comment thread README.md
Comment thread .github/workflows/verify.yml
@sjungwon03
sjungwon03 merged commit 3155e9c into dev Jul 28, 2026
1 check passed
@sjungwon03
sjungwon03 deleted the fix/2-audit-clean-mcp-sdk branch July 28, 2026 17:38
sjungwon03 added a commit that referenced this pull request Jul 28, 2026
@sjungwon03
release: promote audited MCP SDK graph to production (#5)
59cff94 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
chore: reconcile main release history into dev (#11)
eff78ed 
* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote TypeMCP 0.2.2 examples remediation (#14)
3d07fa8 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

---------

Co-authored-by: sjungwon03 <>
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote Swagger Petstore examples (#20)
a74b30a 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

* feat: add read-only Swagger Petstore agent examples (#16)

* docs(planning): add Swagger Petstore agent plan

* feat: add read-only Swagger Petstore client

* feat: wrap read-only Petstore API in TypeMCP

* feat: add TypeChain Petstore agent workflow

* feat: add live Swagger Petstore demonstrations

---------

Co-authored-by: sjungwon03 <>
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote real TypeChain Petstore agent (#26)
3ef010f 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

* feat: add read-only Swagger Petstore agent examples (#16)

* docs(planning): add Swagger Petstore agent plan

* feat: add read-only Swagger Petstore client

* feat: wrap read-only Petstore API in TypeMCP

* feat: add TypeChain Petstore agent workflow

* feat: add live Swagger Petstore demonstrations

* feat: add real TypeChain Petstore agent factory (#22)

* docs(planning): define real Petstore agent delivery

* feat: add real TypeChain Petstore agent factory

* docs: explain application-owned Petstore agent runtime

---------

Co-authored-by: sjungwon03 <>
sjungwon03 added a commit that referenced this pull request Jul 29, 2026
@sjungwon03
release: promote Petstore MCP HTTP agent example (#32)
0fc09cc 
* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

* fix(deps): adopt TypeMCP 0.2.2 remediation (#7)

* chore: reconcile main release history into dev (#11)

* release: publish verified TypeChain and TypeMCP examples (#1)

Co-authored-by: sjungwon03 <>

* release: promote audited MCP SDK graph to production (#5)

* ci: require verified dev-to-main promotions

* fix: pin examples MCP SDK to audited graph (#3)

Co-authored-by: sjungwon03 <>

---------

Co-authored-by: sjungwon03 <>

* fix: retain published TypeMCP dependency contract

* fix: remove obsolete reconciliation override

* feat: add read-only Swagger Petstore agent examples (#16)

* docs(planning): add Swagger Petstore agent plan

* feat: add read-only Swagger Petstore client

* feat: wrap read-only Petstore API in TypeMCP

* feat: add TypeChain Petstore agent workflow

* feat: add live Swagger Petstore demonstrations

* feat: add real TypeChain Petstore agent factory (#22)

* docs(planning): define real Petstore agent delivery

* feat: add real TypeChain Petstore agent factory

* docs: explain application-owned Petstore agent runtime

* refactor: build Petstore TypeMCP HTTP agent example (#28)

* docs: design real Petstore MCP agent example

* docs(planning): detail Petstore MCP agent rewrite

* feat: add loopback Petstore MCP runtime and client

* feat: add TypeChain Petstore MCP agent

* refactor: center examples on Petstore MCP agent

* ci: verify Petstore MCP fixtures

---------

Co-authored-by: sjungwon03 <>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sjungwon03-ai sjungwon03-ai sjungwon03-ai approved these changes

Assignees

@sjungwon03 sjungwon03

Labels

dependencies Dependency management security Security remediation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Pin the examples application to an audit-clean MCP SDK graph

2 participants

@sjungwon03 @sjungwon03-ai