Skip to content

Update dependencies to clear npm audit findings - #793

Merged
ochafik merged 1 commit into
mainfrom
chore/npm-audit-fix
Sep 25, 2026
Merged

ochafik merged 1 commit into
mainfrom
chore/npm-audit-fix

Conversation

@ochafik

@ochafik ochafik commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Clears every npm audit finding (16 packages, 6 critical before; 0 now).

  • solid-js in basic-server-solid: exact 1.9.10 to 1.9.15. This is the one that reaches users. 1.9.10 depends on seroval ~1.3, which has open advisories (fixed in 1.5.3), so anyone installing the published @modelcontextprotocol/server-basic-solid gets it whatever their own lockfile says.
  • Root overrides. The seroval (1.4.1) and seroval-plugins (1.4.2) overrides are removed: solid-js 1.9.15 needs seroval ~1.5.4, so they would now force a vulnerable version. The solid-js override moves to 1.9.15 so the plugins keep a single copy.
  • package-lock.json is refreshed with npm audit fix (44 patch or minor bumps, no majors, nothing added or removed): hono, qs, undici, postcss, nanoid, devalue, sharp, brace-expansion, fflate.

Test plan

  • On a clean npm ci: npm audit reports 0 vulnerabilities, build:all and npm test pass (438 pass, 2 skip), prettier is clean.
  • Playwright: servers.spec.ts (every example's screenshot) plus the pdf specs pass: 60 passed. The only retries are a cold-start timeout that also occurs on main.
  • No non-npmjs URLs in the lockfile.

Bump solid-js in basic-server-solid from the exact 1.9.10 to 1.9.15. 1.9.10 depends on seroval ~1.3, which has open advisories (fixed in 1.5.3), so anyone installing the published @modelcontextprotocol/server-basic-solid gets it. The root overrides that pinned seroval 1.4.1 and seroval-plugins 1.4.2 are removed because solid-js 1.9.15 needs seroval ~1.5.4, and the solid-js override moves to 1.9.15.

The lockfile is refreshed with npm audit fix (patch and minor updates only), which clears the remaining findings in hono, qs, undici, postcss, nanoid, devalue, sharp, brace-expansion and fflate. npm audit now reports 0 vulnerabilities.
@pkg-pr-new

pkg-pr-new Bot commented Sep 25, 2026

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/ext-apps

npm i https://pkg.pr.new/@modelcontextprotocol/ext-apps@793

@modelcontextprotocol/server-basic-preact

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-preact@793

@modelcontextprotocol/server-basic-react

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-react@793

@modelcontextprotocol/server-basic-solid

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-solid@793

@modelcontextprotocol/server-basic-svelte

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-svelte@793

@modelcontextprotocol/server-basic-vanillajs

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-vanillajs@793

@modelcontextprotocol/server-basic-vue

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-vue@793

@modelcontextprotocol/server-budget-allocator

npm i https://pkg.pr.new/@modelcontextprotocol/server-budget-allocator@793

@modelcontextprotocol/server-cohort-heatmap

npm i https://pkg.pr.new/@modelcontextprotocol/server-cohort-heatmap@793

@modelcontextprotocol/server-customer-segmentation

npm i https://pkg.pr.new/@modelcontextprotocol/server-customer-segmentation@793

@modelcontextprotocol/server-debug

npm i https://pkg.pr.new/@modelcontextprotocol/server-debug@793

@modelcontextprotocol/server-lazy-auth

npm i https://pkg.pr.new/@modelcontextprotocol/server-lazy-auth@793

@modelcontextprotocol/server-map

npm i https://pkg.pr.new/@modelcontextprotocol/server-map@793

@modelcontextprotocol/server-pdf

npm i https://pkg.pr.new/@modelcontextprotocol/server-pdf@793

@modelcontextprotocol/server-scenario-modeler

npm i https://pkg.pr.new/@modelcontextprotocol/server-scenario-modeler@793

@modelcontextprotocol/server-shadertoy

npm i https://pkg.pr.new/@modelcontextprotocol/server-shadertoy@793

@modelcontextprotocol/server-sheet-music

npm i https://pkg.pr.new/@modelcontextprotocol/server-sheet-music@793

@modelcontextprotocol/server-system-monitor

npm i https://pkg.pr.new/@modelcontextprotocol/server-system-monitor@793

@modelcontextprotocol/server-threejs

npm i https://pkg.pr.new/@modelcontextprotocol/server-threejs@793

@modelcontextprotocol/server-transcript

npm i https://pkg.pr.new/@modelcontextprotocol/server-transcript@793

@modelcontextprotocol/server-video-resource

npm i https://pkg.pr.new/@modelcontextprotocol/server-video-resource@793

@modelcontextprotocol/server-wiki-explorer

npm i https://pkg.pr.new/@modelcontextprotocol/server-wiki-explorer@793

commit: 89b9b0d

@ochafik
ochafik merged commit f20a1ff into main Sep 25, 2026
21 checks passed
@ochafik ochafik mentioned this pull request Sep 25, 2026
ochafik added a commit that referenced this pull request Sep 25, 2026
Patch release that pins @cantoo/pdf-lib to 2.6.5 for @modelcontextprotocol/server-pdf (#792) and moves solid-js to 1.9.15 for @modelcontextprotocol/server-basic-solid along with the other npm audit fixes (#793), so a fresh install of every published package resolves a dependency tree that passes supply-chain and vulnerability scans.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant