chore: upgrade MCP SDK to v1.27.1 (security fix)#29
Merged
Conversation
The singleton McpServer was shared across all HTTP sessions, causing "Already connected to a transport" crash on the second connection. Each session now gets its own McpServer instance with tools replayed from stored config. Stdio mode unchanged (1:1 by nature). Closes #27 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Upgrade @modelcontextprotocol/sdk ^1.11.0 → ^1.27.1 - Fixes GHSA-345p-7cg4-v4c7 (cross-client response data leakage) - Protocol.connect() now enforces single-transport-per-instance - Upgrade zod ^3.24.2 → ^3.25.0 (now a peer dep of SDK v1.23+) - Pin @types/express to v4 (compatible with our express v4 dep) - Add smoke test suite (tests/smoke.test.ts): - Session initialization - Tool listing (all 7 tools) - Geocode tool call (when API key provided) - Multi-session concurrency (3 parallel sessions) - Run: npx tsx tests/smoke.test.ts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
cablate
force-pushed
the
fix/multi-session-crash
branch
from
7c930a6 to
ae1a7fd
Compare
cablate
force-pushed
the
chore/upgrade-mcp-sdk-v1.27
branch
from
0acc51a to
0df5ef7
Compare
- Add GitHub Actions CI workflow (build/lint/test on PR) - Add GitHub Actions release workflow (E2E test + auto bump + npm publish on merge to main) - Add ESLint 9 flat config with TypeScript and Prettier integration - Add Prettier config matching existing code style - Add npm scripts: test, test:e2e, lint, format, format:check - Format all source files with Prettier - Fix prefer-const and no-empty lint errors Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@modelcontextprotocol/sdkfrom ^1.11.0 to ^1.27.1 (16 versions behind)zodto ^3.25.0 (now a peer dependency of SDK v1.23+)@types/expressto v4 (compatible with our express v4 dependency)Depends on
Protocol.connect()single-transport-per-instance, which fix: create per-session McpServer to prevent multi-session crash #28 already satisfiesSmoke test suite
npx tsx tests/smoke.test.ts [--port 13579] [--apikey "AIza..."]Test plan
tsc --noEmitpassesnpm run buildsucceeds🤖 Generated with Claude Code