grok v0.2.15 — six advisories, four of which were shipping

A dependency patch. No plugin logic changed — but the interesting part was not the count of advisories, it was working out which of them actually reached anyone.

This repository ships its bundles, and esbuild inlines runtime dependencies into them. So an advisory against a transitive package is either live code in what users execute, or it is nowhere near them, and the only way to know is to look:

grep -c "node_modules/fast-uri/" dist/index.js  ->  6   inlined, shipping
grep -c "node_modules/qs/"       dist/index.js  ->  0   outside the bundle
grep -c "node_modules/express/"  dist/index.js  ->  0   outside the bundle

package	advisories	severity	patched	reached users
fast-uri	4 — two host-confusion, two SSRF	high	3.1.5 → 3.1.7	yes
qs	2 — array-limit bypass, DoS	moderate	6.15.3 → 6.16.0	no

fast-uri arrives through ajv from the MCP SDK, and it was inlined — those four highs were sitting in the code installed users run. qs and express belong to the SDK's HTTP transports, which this stdio server never loads; patched anyway, since there is no reason to leave an alert open.

Verified in the artifact, not the lockfile

A lockfile says what should have been built. The bundle is what ships. URI host is malformed. — a string that exists only in fast-uri 3.1.7 — is present at dist/index.js:4128 and absent from the previous bundle. Of 54 changed hunks, 53 land inside fast-uri and one is the version string; no plugin code moved.

Verified at this commit

npm ci, npm audit → 0 vulnerabilities, 352 tests passed / 1 skipped, typecheck clean, and both committed bundles rebuild byte-identical from the committed lockfile. The MCP SDK stayed at 1.29.0 — checked deliberately, because a past npm i --no-save in this repo silently raised a runtime dependency and nearly shipped a bundle that did not match its source.

Full detail: docs/releases/v0.2.15.md