Skip to content

v2.6.1

Choose a tag to compare

View all tags
@nokhodian nokhodian released this 23 Jul 19:30
v2.6.1
2938194

Security

Fixed 6 of 7 open Dependabot alerts via dependency overrides:

  • fast-uri (high) — host confusion via literal backslash authority delimiter
  • sharp (high) — inherited libvips CVEs
  • adm-zip (high) — crafted ZIP triggers 4GB memory allocation
  • protobufjs (medium) — infinite-loop DoS + prototype mutation
  • body-parser (low) — DoS via invalid limit silently disabling size enforcement

Not fixed: @hono/node-server (medium) — its only patched release is a major
version bump (1.x→2.x) that even the latest @modelcontextprotocol/sdk hasn't
adopted yet. Forcing it would risk breaking the MCP SDK's HTTP transport with
no test coverage to catch it; needs an upstream SDK update instead of a local
pin.

Verified via the full CLI test suite (1143/1143 passing) and monograph's
eval-server test, which exercises the same express.json()/body-parser code
path now resolving to the patched version.

Assets 2
Loading