Repository navigation
Security: bump solid-js override to 1.9.17 and refresh vulnerable transitives - #827
Merged
Merged
Conversation
…nsitives npm audit went red again since the Sep 25 cleanup (#793): 24 advisories, 8 critical, mostly in-range transitive fixes. - solid-js override 1.9.15 -> 1.9.17 (seroval fromJSON/TypedArray advisories; same mechanism as the #793 pin, new advisory) - sharp ^0.35.3 -> ^0.35.5 (librsvg CVE-2026-96889) - lockfile-only refresh of the other vulnerable transitives within existing ranges: shell-quote 1.12.0, proxy-addr 2.0.8, body-parser 2.4.0, zod 4.6.6, source-map-js 1.2.2, ip-address 10.7.4, hono 4.13.13, vite 6.4.4, @vue/server-renderer 3.5.43 and their solid toolchain companions Not included: undici 7.30.1, fast-uri 3.1.9, markdown-it 14.3.3 (releases too fresh to validate in this environment) and the @modelcontextprotocol/* 2.x pin bumps, which deserve their own PR. Validated: npm install from the updated lockfile, npm run build, and the SDK unit suite (349 tests) all pass. Co-authored-by: ochafik <ochafik@anthropic.com>
npm requires a direct dependency and its override to share the same spec; bumping only the root override left the workspace pinned at 1.9.15, so npm ci rejected the lockfile (missing solid-js@1.9.15, seroval@1.5.6) and every CI job failed at install. Verified npm ci --dry-run passes on both npm 10 and npm 11. Co-authored-by: ochafik <ochafik@anthropic.com>
@modelcontextprotocol/ext-apps
@modelcontextprotocol/server-basic-preact
@modelcontextprotocol/server-basic-react
@modelcontextprotocol/server-basic-solid
@modelcontextprotocol/server-basic-svelte
@modelcontextprotocol/server-basic-vanillajs
@modelcontextprotocol/server-basic-vue
@modelcontextprotocol/server-budget-allocator
@modelcontextprotocol/server-cohort-heatmap
@modelcontextprotocol/server-customer-segmentation
@modelcontextprotocol/server-debug
@modelcontextprotocol/server-lazy-auth
@modelcontextprotocol/server-map
@modelcontextprotocol/server-pdf
@modelcontextprotocol/server-scenario-modeler
@modelcontextprotocol/server-shadertoy
@modelcontextprotocol/server-sheet-music
@modelcontextprotocol/server-system-monitor
@modelcontextprotocol/server-threejs
@modelcontextprotocol/server-transcript
@modelcontextprotocol/server-video-resource
@modelcontextprotocol/server-wiki-explorer
commit: |
Contributor
PreviewPreview deployments for this PR have been cleaned up. |
Merged
ochafik
added a commit
that referenced
this pull request
Oct 27, 2026
Patch release: the pdf-server example defaults to a single interact app tool with the per-action tools behind --split-app-tools (#830), the map-server example gains a get-screenshot app tool (#821), the pdf-server viewer restores the saved page on tool-result re-delivery (#828), and the dependency refresh clears the open npm audit findings (solid-js 1.9.17, sharp ^0.35.5 and in-range transitive updates, #827). Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm auditis red again since the Sep 25 cleanup (#793): 24 advisories (8 critical, 12 high, 4 moderate), almost all fixable within existing semver ranges. This PR takes the sweep:solid-jsoverride 1.9.15 → 1.9.17 — fixes the criticalserovaladvisories (fromJSON()thenable assimilation, TypedArray memory exhaustion) and the dependentsolid-refresh/vite-plugin-solid/babel-preset-solidchain. Same mechanism as the pin Update dependencies to clear npm audit findings #793 introduced, new advisories.sharp^0.35.3 → ^0.35.5 — librsvg CVE-2026-96889.shell-quote1.12.0 (command injection, critical),proxy-addr2.0.8 (IP spoofing, critical),body-parser2.4.0,zod4.6.6,source-map-js1.2.2,ip-address10.7.4,hono4.13.13,vite6.4.4,@vue/server-renderer3.5.43,fast-uripartial,concurrently.No source changes;
package.jsonchanges are the two range/override bumps only.Not included (follow-ups)
undici7.30.1,fast-uri3.1.9,markdown-it14.3.3 — the patched releases are very fresh and could not be validated in this environment; a follow-upnpm audit fixrun will pick them up.@modelcontextprotocol/{client,server,sdk,express}advisories (OAuth credential redirect, cross-client message delivery, memory exhaustion): those are exact-pinned at 2.0.0 across the root and all example manifests, so bumping them to 2.4.0/2.0.2/1.32.2 is a separate mechanical PR with its own validation (check-dependency-isolationetc.).Validation
npm installfrom the updated lockfile — cleannpm run build— cleanbun test src(SDK unit suite, 349 tests) — 0 failuresresolvedURLs in the standard registry formGenerated by Claude Code