Update dependencies to clear npm audit findings - #793
Merged
Merged
Conversation
Bump solid-js in basic-server-solid from the exact 1.9.10 to 1.9.15. 1.9.10 depends on seroval ~1.3, which has open advisories (fixed in 1.5.3), so anyone installing the published @modelcontextprotocol/server-basic-solid gets it. The root overrides that pinned seroval 1.4.1 and seroval-plugins 1.4.2 are removed because solid-js 1.9.15 needs seroval ~1.5.4, and the solid-js override moves to 1.9.15. The lockfile is refreshed with npm audit fix (patch and minor updates only), which clears the remaining findings in hono, qs, undici, postcss, nanoid, devalue, sharp, brace-expansion and fflate. npm audit now reports 0 vulnerabilities.
@modelcontextprotocol/ext-apps
@modelcontextprotocol/server-basic-preact
@modelcontextprotocol/server-basic-react
@modelcontextprotocol/server-basic-solid
@modelcontextprotocol/server-basic-svelte
@modelcontextprotocol/server-basic-vanillajs
@modelcontextprotocol/server-basic-vue
@modelcontextprotocol/server-budget-allocator
@modelcontextprotocol/server-cohort-heatmap
@modelcontextprotocol/server-customer-segmentation
@modelcontextprotocol/server-debug
@modelcontextprotocol/server-lazy-auth
@modelcontextprotocol/server-map
@modelcontextprotocol/server-pdf
@modelcontextprotocol/server-scenario-modeler
@modelcontextprotocol/server-shadertoy
@modelcontextprotocol/server-sheet-music
@modelcontextprotocol/server-system-monitor
@modelcontextprotocol/server-threejs
@modelcontextprotocol/server-transcript
@modelcontextprotocol/server-video-resource
@modelcontextprotocol/server-wiki-explorer
commit: |
Merged
ochafik
added a commit
that referenced
this pull request
Sep 25, 2026
Patch release that pins @cantoo/pdf-lib to 2.6.5 for @modelcontextprotocol/server-pdf (#792) and moves solid-js to 1.9.15 for @modelcontextprotocol/server-basic-solid along with the other npm audit fixes (#793), so a fresh install of every published package resolves a dependency tree that passes supply-chain and vulnerability scans.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears every
npm auditfinding (16 packages, 6 critical before; 0 now).solid-jsinbasic-server-solid: exact1.9.10to1.9.15. This is the one that reaches users. 1.9.10 depends onseroval ~1.3, which has open advisories (fixed in 1.5.3), so anyone installing the published@modelcontextprotocol/server-basic-solidgets it whatever their own lockfile says.overrides. Theseroval(1.4.1) andseroval-plugins(1.4.2) overrides are removed:solid-js1.9.15 needsseroval ~1.5.4, so they would now force a vulnerable version. Thesolid-jsoverride moves to 1.9.15 so the plugins keep a single copy.package-lock.jsonis refreshed withnpm audit fix(44 patch or minor bumps, no majors, nothing added or removed):hono,qs,undici,postcss,nanoid,devalue,sharp,brace-expansion,fflate.Test plan
npm ci:npm auditreports 0 vulnerabilities,build:allandnpm testpass (438 pass, 2 skip), prettier is clean.servers.spec.ts(every example's screenshot) plus the pdf specs pass: 60 passed. The only retries are a cold-start timeout that also occurs onmain.