Skip to content

0.2.2 — Dependency hygiene (npm audit fix)

Choose a tag to compare

View all tags
@wasomma wasomma released this 16 Aug 23:18
· 17 commits to main since this release
v0.2.2
0395afb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

No engine or tool behavior changes; golden fixtures unchanged. Dependency
hygiene only.

Security

  • npm audit fix (no --force): four transitive dependencies of
    @modelcontextprotocol/sdk bumped within their existing semver ranges
    to clear all reported advisories — hono 4.12.31 → 4.13.2 (ReDoS in
    CORS middleware, SSR memo() cross-request retention, proxy-helper
    Connection header handling, language-middleware complexity),
    @hono/node-server 1.19.14 → 1.19.17 (serve-static path traversal
    on Windows), fast-uri 3.1.4 → 3.1.5 (host confusion via backslash
    authority), ip-address 10.2.0 → 10.5.0 (leading-zero / CIDR /
    IPv4-mapped misclassification enabling SSRF bypasses). None of these
    code paths are exercised by this server (it uses node:http directly
    and the SDK's Streamable HTTP transport, no CORS/static/proxy
    middleware), so this is hygiene, not a fix for an exposure. SDK stays
    at 1.29.0; no dependency ranges changed. npm audit is clean
    afterwards.
Assets 2
Loading