From fbe3b9e532e23e91a7a02cb105c73a1a8ced7f81 Mon Sep 17 00:00:00 2001 From: Chris Bartholomew Date: Sat, 31 Oct 2026 11:42:43 -0400 Subject: [PATCH] chore(security): bump HIGH-severity deps in package-lock.json Clears open HIGH Dependabot alerts (overrides were pinning vulnerable versions): - @modelcontextprotocol/sdk 1.29.0 -> 1.32.2 (fix >=1.32.0) (#78 #86 #90) - brace-expansion 1.1.18 -> 1.1.20 (#82 #83) - body-parser 2.3.0 -> 2.4.0 (#93) Also bumps the 2.x brace-expansion override pin 2.1.4 -> 2.1.6 (same advisory family) to avoid re-leaving a known-vulnerable pin while editing this file. Regenerated with npm 11 (--package-lock-only), no --force. Claude-Session: https://claude.ai/code/session_014J7s5yzoVEqoZ8LmnD8bQd --- package-lock.json | 58 +++++++++++++++++++++++------------------------ package.json | 8 +++---- 2 files changed, 33 insertions(+), 33 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8bd607b..8a234f8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "0.4.3", "license": "ISC", "dependencies": { - "@modelcontextprotocol/sdk": "^1.29.0", + "@modelcontextprotocol/sdk": "^1.32.0", "@vectorize-io/vectorize-client": "^0.1.3", "dotenv": "^16.4.7", "p-queue": "^8.0.1", @@ -106,9 +106,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.20", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.20.tgz", + "integrity": "sha512-5/qk29RyvatwgzNMrvGjkIhKYzpJ0OUnPK+9TU+zS/CMJqzmb+UD0irWu42JfpUvO636fxd8IstgiydZRM/76A==", "dev": true, "license": "MIT", "dependencies": { @@ -166,9 +166,9 @@ } }, "node_modules/@humanwhocodes/config-array/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.20", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.20.tgz", + "integrity": "sha512-5/qk29RyvatwgzNMrvGjkIhKYzpJ0OUnPK+9TU+zS/CMJqzmb+UD0irWu42JfpUvO636fxd8IstgiydZRM/76A==", "dev": true, "license": "MIT", "dependencies": { @@ -251,12 +251,12 @@ } }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.29.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz", - "integrity": "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==", + "version": "1.32.2", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.2.tgz", + "integrity": "sha512-SWsVtH/0vULSQStoZ6xxH2K09Li8fXYTMC64ZeogCdpZ3XSi1eCPOByV1OpuJxuI3OcmHhosDWYyii07tpPsLw==", "license": "MIT", "dependencies": { - "@hono/node-server": "^1.19.9", + "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", @@ -750,18 +750,18 @@ "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==" }, "node_modules/body-parser": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -787,9 +787,9 @@ } }, "node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "version": "2.1.6", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.6.tgz", + "integrity": "sha512-pi/WFpBvCBmB/NsURt7hW5sDvuOqvJaDMDai7CrlT9xoehzWRzo/dhQRKqOhpPvlnicVaTzHCbzGnnTgpvMTFw==", "dev": true, "license": "MIT", "dependencies": { @@ -1226,9 +1226,9 @@ } }, "node_modules/eslint/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.20", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.20.tgz", + "integrity": "sha512-5/qk29RyvatwgzNMrvGjkIhKYzpJ0OUnPK+9TU+zS/CMJqzmb+UD0irWu42JfpUvO636fxd8IstgiydZRM/76A==", "dev": true, "license": "MIT", "dependencies": { @@ -1671,9 +1671,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "1.1.20", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.20.tgz", + "integrity": "sha512-5/qk29RyvatwgzNMrvGjkIhKYzpJ0OUnPK+9TU+zS/CMJqzmb+UD0irWu42JfpUvO636fxd8IstgiydZRM/76A==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -1813,9 +1813,9 @@ } }, "node_modules/iconv-lite": { - "version": "0.7.2", - "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz", - "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==", + "version": "0.7.3", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz", + "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==", "license": "MIT", "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" diff --git a/package.json b/package.json index b22ed02..c08c475 100644 --- a/package.json +++ b/package.json @@ -23,10 +23,10 @@ }, "license": "ISC", "overrides": { - "brace-expansion@^1.1.0": "1.1.18", - "brace-expansion@^2.0.0": "2.1.4", + "brace-expansion@^1.1.0": "1.1.20", + "brace-expansion@^2.0.0": "2.1.6", "@hono/node-server": "1.19.15", - "body-parser": "2.3.0", + "body-parser": "2.4.0", "fast-uri": "^3.1.6", "hono": "^4.13.5", "ip-address": "10.3.1", @@ -35,7 +35,7 @@ "qs": "^6.16.0" }, "dependencies": { - "@modelcontextprotocol/sdk": "^1.29.0", + "@modelcontextprotocol/sdk": "^1.32.0", "@vectorize-io/vectorize-client": "^0.1.3", "dotenv": "^16.4.7", "p-queue": "^8.0.1",