Repository navigation
fix(website): update MCP server SDK and Vite to patched releases - #201
Merged
Merged
Conversation
Refresh @farming-labs/docs to 0.2.125 so it resolves @modelcontextprotocol/server 2.3.0, raise the Vite 7 override to 7.3.7, and override Farm's vite-rolldown alias to vite 8.1.6.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Kinfe123
approved these changes
Oct 24, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Clears the three open Dependabot alerts for
@modelcontextprotocol/serverinwebsite/pnpm-lock.yaml, plus five newer Vite advisories that makepnpm auditfail on main right now.Changes
@farming-labs/docs(pulled in by@farm.js/core) is refreshed within its existing^0.2.116range, 0.2.118 to 0.2.125. That release pins@modelcontextprotocol/serverand@modelcontextprotocol/core2.3.0 instead of 2.0.0. The refresh also picked up in-range patch updates of a few other transitive packages (@types/node,undici,zod).vite@<7.3.6override is nowvite@<7.3.7and selects 7.3.7.@farm.js/core@0.1.0>vite-rolldownselectsnpm:vite@8.1.6. Farm pins itsvite-rolldownalias tonpm:vite@8.1.5, and a plainvite@range override doesn't reach an aliased dependency, so this one is scoped to the alias like the existing Farm overrides.DEPENDENCIES.mdlists both Vite overrides.Advisories fixed:
@modelcontextprotocol/server2.0.0osv-scanner on
website/pnpm-lock.yamlreports no issues after this change.Verification
Website checks job, run locally with Node 22 and pnpm 10.9.0 as in CI:
cargo fmt --all -- --check(no Rust changes)cargo clippy --workspace --all-targets --all-features -- -D warnings(no Rust changes)cargo test --workspace --all-features(no Rust changes)pnpm --dir website type-checkpnpm --dir website buildAlso passing:
pnpm install --frozen-lockfile,pnpm audit(no known vulnerabilities),pnpm test(48 passed) andpnpm test:build(9 passed).Risk and compatibility
Dependency-only change to the website. This conflicts with #198 and #192 in
website/pnpm-lock.yaml. Landing this first and letting Dependabot rebase #198 is simplest. #192 already fails its website checks and also has to move the@farm.js/core@0.1.0scoped overrides and patches to 0.1.1.Review checklist