Triage existing npm audit advisories in web and MCP dependency tree #95
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
How found: clean npm ci and npm audit --json during PR90 independent review at49f72305ba04e0694e472a03fc80949252921a59. Confidence: high for registry audit report, unverified exploitability. Eight affected packages: @modelcontextprotocol/sdk high GHSA-6qxp-vccf-f47h; devalue high (six advisories); dompurify low (two); fast-uri moderate GHSA-hrr3-gc8f-f4qj; hono moderate GHSA-hxh3-vqpv-xpqv; ip-address moderate (two); proxy-addr critical GHSA-jqcg-44mw-7w3h; source-map-js high GHSA-68fv-2mgg-jv7q. Counts 1low/3moderate/3high/1critical. PR90 does not change package.json or package-lock.json, so these are pre-existing and separate from cycle feature defects. Repro: npm ci then npm audit --json at pinned tree. Assess actual shipped/runtime reachability and advisory credibility, then narrowly repair affected dependencies with regression tests in separate work. Do not infer exploitation or perform unrelated dependency updates in PR90. Local full report /tmp/opencode/bb100-audit.json.