[Snyk] Fix for 2 vulnerabilities

[chelojimenez]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• mcpjam-inspector/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Directory Traversal SNYK-JS-VITESTMOCKER-19497933
	Regular Expression Denial of Service (ReDoS) SNYK-JS-XMLDOMXMLDOM-19498551

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal
🦉 Regular Expression Denial of Service (ReDoS)

---

Note

^{Cursor Bugbot is generating a summary for commit 461887a. Configure here.}

---

Summary by cubic

Updates mcpjam-inspector to patched dependency versions, fixing a directory traversal vulnerability in vitest and a ReDoS vulnerability in @xmldom/xmldom.

Dependencies

• Upgrades vitest from 3.2.7 to 4.1.11, @xmldom/xmldom from 0.8.13 to 0.9.12, and @convex-dev/workos from 0.0.1 to 0.0.2.
• Review Vitest 4 compatibility because the upgrade may affect test configuration or APIs.

^{Written for commit 461887a. Summary will update on new commits.}

[chelojimenez]

This release includes major version upgrades for vitest and @xmldom/xmldom, both of which introduce significant breaking changes requiring configuration and code updates.

Top 3 Most Impactful Upgrades

• vitest 3.2.7 → 4.1.11 (High Risk): This major upgrade requires several updates to your configuration file.

  • Configuration: The workspace configuration is replaced by a projects field. Pool options like maxThreads are now maxWorkers.
  • Coverage: coverage.all is removed. You must now define coverage.include to specify which files to include in coverage reports.
  • Browser Mode: The browser mode API has been overhauled, requiring provider packages like @vitest/browser-playwright and a new configuration structure.
  • Recommendation: Review the official migration guide to update your vitest.config.js file, especially if you use workspaces, custom coverage settings, or browser mode testing.

• @xmldom/xmldom 0.8.15 → 0.9.12 (High Risk): This upgrade introduces stricter parsing and breaking API changes.

  • Stricter Parsing: The parser is less tolerant of non-well-formed XML and will now throw a ParseError in cases where it previously might have succeeded.
  • Mandatory mimeType: The mimeType argument for DOMParser.parseFromString(xml, mimeType) is now mandatory to differentiate between XML and HTML parsing. Code that omits this will break.
  • TypeScript Changes: The return type of parseFromString is now Document | undefined, requiring explicit handling of potential parsing failures in TypeScript.
  • Recommendation: Ensure you are passing a mimeType to all parseFromString calls and add error handling for stricter parsing rules.

• @convex-dev/workos 0.0.1 → 0.0.2 (Low Risk): This is a patch release for a pre-1.0 package. No breaking changes were documented.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_c82ce06f-c73a-4bc4-b74d-696648921fc8)

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

Internal preview

Preview URL will appear in Railway after the deploy finishes.
Deployed commit: 3629940
PR head commit: 461887a
Backend target: staging fallback.
Access is employee-only in non-production environments.

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="mcpjam-inspector/package.json">

<violation number="1" location="mcpjam-inspector/package.json:264">
P1: After the lockfile is regenerated, `test:coverage` will pair Vitest 4 with the Vitest 3 coverage provider, whose peer contract requires Vitest 3.2.7. Upgrade `@vitest/coverage-v8` to the matching 4.1.11 release as part of this major-version bump.</violation>

<violation number="2" location="mcpjam-inspector/package.json:264">
P1: `npm ci` cannot install this workspace because the root `package-lock.json` still resolves the old dependency ranges. Regenerate and commit the lockfile with these upgrades.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: After the lockfile is regenerated, test:coverage will pair Vitest 4 with the Vitest 3 coverage provider, whose peer contract requires Vitest 3.2.7. Upgrade @vitest/coverage-v8 to the matching 4.1.11 release as part of this major-version bump.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At mcpjam-inspector/package.json, line 264:

<comment>After the lockfile is regenerated, `test:coverage` will pair Vitest 4 with the Vitest 3 coverage provider, whose peer contract requires Vitest 3.2.7. Upgrade `@vitest/coverage-v8` to the matching 4.1.11 release as part of this major-version bump.</comment>

<file context>
@@ -261,7 +261,7 @@
     "vite": "^7.1.4",
     "vite-tsconfig-paths": "^6.0.4",
-    "vitest": "^3.2.7"
+    "vitest": "^4.1.11"
   },
   "overrides": {
</file context>

[cubic-dev-ai]

P1: npm ci cannot install this workspace because the root package-lock.json still resolves the old dependency ranges. Regenerate and commit the lockfile with these upgrades.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At mcpjam-inspector/package.json, line 264:

<comment>`npm ci` cannot install this workspace because the root `package-lock.json` still resolves the old dependency ranges. Regenerate and commit the lockfile with these upgrades.</comment>

<file context>
@@ -261,7 +261,7 @@
     "vite": "^7.1.4",
     "vite-tsconfig-paths": "^6.0.4",
-    "vitest": "^3.2.7"
+    "vitest": "^4.1.11"
   },
   "overrides": {
</file context>