From bdbe65950c914b7f7649c4a82e3968bf22b42614 Mon Sep 17 00:00:00 2001 From: Szymon Chmal Date: Thu, 22 Oct 2026 17:18:54 +0200 Subject: [PATCH 1/2] chore(deps): update ws, hono and the MCP SDK past their advisories ws 8.18.3 -> 8.22.0, hono ^4.13.5 -> ^4.13.13, @modelcontextprotocol/sdk 1.29.0 -> 1.32.1. The lockfile also moves the SDK's vulnerable transitive deps within their ranges: proxy-addr 2.0.8, qs 6.16.1, fast-uri 3.1.9, ip-address 10.7.4. pnpm audit --prod now reports no advisories. --- package.json | 6 ++-- pnpm-lock.yaml | 86 +++++++++++++++++++++++++------------------------- 2 files changed, 46 insertions(+), 46 deletions(-) diff --git a/package.json b/package.json index 9748a5a7..9c46a33e 100644 --- a/package.json +++ b/package.json @@ -71,10 +71,10 @@ "@agent-device/proxy": "0.21.28", "@hono/node-server": "2.0.10", "@hono/zod-openapi": "1.6.3", - "@modelcontextprotocol/sdk": "1.29.0", - "hono": "^4.13.5", + "@modelcontextprotocol/sdk": "1.32.1", + "hono": "^4.13.13", "jose": "6.2.9", - "ws": "8.18.3", + "ws": "8.22.0", "zod": "^4.6.5" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4a0b6671..c1c67a3b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -218,22 +218,22 @@ importers: version: 0.21.28 '@hono/node-server': specifier: 2.0.10 - version: 2.0.10(hono@4.13.5) + version: 2.0.10(hono@4.13.13) '@hono/zod-openapi': specifier: 1.6.3 - version: 1.6.3(hono@4.13.5)(zod@4.6.5) + version: 1.6.3(hono@4.13.13)(zod@4.6.5) '@modelcontextprotocol/sdk': - specifier: 1.29.0 - version: 1.29.0(supports-color@7.2.0)(zod@4.6.5) + specifier: 1.32.1 + version: 1.32.1(supports-color@7.2.0)(zod@4.6.5) hono: - specifier: ^4.13.5 - version: 4.13.5 + specifier: ^4.13.13 + version: 4.13.13 jose: specifier: 6.2.9 version: 6.2.9 ws: - specifier: 8.18.3 - version: 8.18.3 + specifier: 8.22.0 + version: 8.22.0 zod: specifier: ^4.6.5 version: 4.6.5 @@ -803,8 +803,8 @@ packages: '@jridgewell/trace-mapping@0.3.31': resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==} - '@modelcontextprotocol/sdk@1.29.0': - resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==} + '@modelcontextprotocol/sdk@1.32.1': + resolution: {integrity: sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -1829,8 +1829,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.9: + resolution: {integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -1911,8 +1911,8 @@ packages: resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} engines: {node: '>= 0.4'} - hono@4.13.5: - resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==} + hono@4.13.13: + resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==} engines: {node: '>=16.9.0'} http-errors@2.0.1: @@ -1952,8 +1952,8 @@ packages: resolution: {integrity: sha512-6xwYfHbajpoF0xLW+iwLkhwgvLoZDfjYfoFNu8ftMoXINzwuymNLd9u/KmwtdT2GbR+/Cz66otEGEVVUHX9QLQ==} engines: {node: '>=10.13.0'} - ip-address@10.5.0: - resolution: {integrity: sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==} + ip-address@10.7.4: + resolution: {integrity: sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2359,16 +2359,16 @@ packages: resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==} engines: {node: '>= 6'} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} qs@6.15.1: resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==} engines: {node: '>=0.6'} - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.1: + resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} engines: {node: '>=0.6'} range-parser@1.3.0: @@ -2763,8 +2763,8 @@ packages: wrappy@1.0.2: resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==} - ws@8.18.3: - resolution: {integrity: sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==} + ws@8.22.0: + resolution: {integrity: sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 @@ -3116,21 +3116,21 @@ snapshots: '@fontsource-variable/geist@5.3.0': {} - '@hono/node-server@2.0.10(hono@4.13.5)': + '@hono/node-server@2.0.10(hono@4.13.13)': dependencies: - hono: 4.13.5 + hono: 4.13.13 - '@hono/zod-openapi@1.6.3(hono@4.13.5)(zod@4.6.5)': + '@hono/zod-openapi@1.6.3(hono@4.13.13)(zod@4.6.5)': dependencies: '@asteasolutions/zod-to-openapi': 9.1.0(zod@4.6.5) - '@hono/zod-validator': 0.9.1(hono@4.13.5)(zod@4.6.5) - hono: 4.13.5 + '@hono/zod-validator': 0.9.1(hono@4.13.13)(zod@4.6.5) + hono: 4.13.13 openapi3-ts: 4.6.2 zod: 4.6.5 - '@hono/zod-validator@0.9.1(hono@4.13.5)(zod@4.6.5)': + '@hono/zod-validator@0.9.1(hono@4.13.13)(zod@4.6.5)': dependencies: - hono: 4.13.5 + hono: 4.13.13 zod: 4.6.5 '@humanwhocodes/momoa@2.0.4': {} @@ -3270,9 +3270,9 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.5 - '@modelcontextprotocol/sdk@1.29.0(supports-color@7.2.0)(zod@4.6.5)': + '@modelcontextprotocol/sdk@1.32.1(supports-color@7.2.0)(zod@4.6.5)': dependencies: - '@hono/node-server': 2.0.10(hono@4.13.5) + '@hono/node-server': 2.0.10(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -3282,7 +3282,7 @@ snapshots: eventsource-parser: 3.1.1 express: 5.2.1(supports-color@7.2.0) express-rate-limit: 8.6.2(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0) - hono: 4.13.5 + hono: 4.13.13 jose: 6.2.9 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -3793,7 +3793,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.9 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -3821,7 +3821,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.1 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: @@ -4054,7 +4054,7 @@ snapshots: dependencies: debug: 4.4.3(supports-color@7.2.0) express: 5.2.1(supports-color@7.2.0) - ip-address: 10.5.0 + ip-address: 10.7.4 transitivePeerDependencies: - supports-color @@ -4079,8 +4079,8 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 - qs: 6.15.3 + proxy-addr: 2.0.8 + qs: 6.16.1 range-parser: 1.3.0 router: 2.2.0(supports-color@7.2.0) send: 1.2.1(supports-color@7.2.0) @@ -4112,7 +4112,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.5: {} + fast-uri@3.1.9: {} fast-wrap-ansi@0.2.2: dependencies: @@ -4189,7 +4189,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.13.5: {} + hono@4.13.13: {} http-errors@2.0.1: dependencies: @@ -4219,7 +4219,7 @@ snapshots: interpret@3.1.1: {} - ip-address@10.5.0: {} + ip-address@10.7.4: {} ipaddr.js@1.9.1: {} @@ -4531,7 +4531,7 @@ snapshots: kleur: 3.0.3 sisteransi: 1.0.5 - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -4540,7 +4540,7 @@ snapshots: dependencies: side-channel: 1.1.1 - qs@6.15.3: + qs@6.16.1: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -4924,7 +4924,7 @@ snapshots: wrappy@1.0.2: {} - ws@8.18.3: {} + ws@8.22.0: {} yaml@2.9.1: {} From 963d90547e8d2933459f2a755f029b888eee5b85 Mon Sep 17 00:00:00 2001 From: Szymon Chmal Date: Thu, 22 Oct 2026 17:19:16 +0200 Subject: [PATCH 2/2] chore(ci): let Dependabot open weekly npm updates, minor and patch grouped --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 93fe874e..c31b0f51 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,3 +13,17 @@ updates: groups: github-actions: patterns: ["*"] + + # Without this, runtime and dev dependencies only move when someone bumps + # them by hand, so they drift past security advisories. Minor and patch + # bumps share one weekly PR; each major still gets its own. + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + commit-message: + prefix: chore(deps) + groups: + npm-minor-and-patch: + patterns: ["*"] + update-types: ["minor", "patch"]