From c05ae42323747cff78aef28ad1ec7d660b5c5ec3 Mon Sep 17 00:00:00 2001 From: idapixl Date: Thu, 8 Oct 2026 09:16:18 -0700 Subject: [PATCH] fix(deps): bump @modelcontextprotocol/sdk to 1.31.0 in the lockfile GHSA-6qxp-vccf-f47h (high): the SDK's OAuth client could send credentials to an authorization server chosen by the MCP server. Fixed in 1.31.0. Dev scope only (the SDK arrives through the @fozikio/cortex-engine devDependency); this package has no runtime dependencies, so consumers were never exposed. Dependabot has no config here, so it did not raise this. Lockfile entry edited by hand (version, resolved, integrity; 1.31.0 widens @hono/node-server to ^1.19.9 || ^2.0.5, which the locked 1.19.x still satisfies). npm ci --ignore-scripts, build and npm audit (0 vulnerabilities) pass locally. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4b95556..ae19126 100644 --- a/package-lock.json +++ b/package-lock.json @@ -113,9 +113,9 @@ } }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.30.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", - "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", + "version": "1.31.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.31.0.tgz", + "integrity": "sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==", "dev": true, "license": "MIT", "dependencies": {