One entryMerged PR· StuMason/coolify-mcp· TypeScript
PR #222 merged: fix(deps): clear all high/moderate npm advisories + enforce audit gate
additions
+5
deletions
-4
files changed
2
Summary
Clears all high and moderate npm audit advisories (32 vulns → 1 low) by pinning vulnerable transitive deps to patched versions via overrides, and flips the CI audit step from continue-on-error to an enforced gate at --audit-level=high.
Overrides added
Runtime path (via @modelcontextprotocol/sdk → express/hono stack):
| pkg | → | advisory |
|---|---|---|
| qs | 6.15.2 | DoS GHSA-q8mj-m7cp-5q26 / GHSA-w7fw-mjwx-w883 |
| hono | 4.12.25 | multiple (JSX injection, path traversal, CORS) |
| @hono/node-server | 2.0.5 | serveStatic auth bypass |
| express-rate-limit | 8.5.2 | IPv6 rate-limit bypass |
| path-to-regexp | 8.4.2 | ReDoS |
| ajv | 8.20.0 (scoped to SDK) | $data ReDoS |
| fast-uri | 4.0.0 | path traversal |
| ip-address | 10.2.0 | XSS in Address6 |
Dev tooling: flatted 3.4.2, brace-expansion 5.0.6, picomatch 4.0.4, js-yaml 4.2.0, markdown-it 14.2.0
Notes
ajvis scoped to the SDK only — eslint 10 requiresajv ^6.14.0(not in the advisory range) and breaks on ajv 8.18+ (json-schema-draft-04.jsonremoved). A global override brokenpm run lint; scoping fixes both.- Remaining: 1 low (
@babel/core, dev-only, only fixable via a Babel 8 major that breaks ts-jest) — accepted.
Verification
prettier ✅ · lint ✅ (0 errors) · build ✅ · 361/361 tests ✅ · clean stdio boot ✅ · npm audit --audit-level=high exits 0