From a7c875eb3e0ca01f379b453c70b0cfa40d77632e Mon Sep 17 00:00:00 2001 From: Tom Riglar Date: Wed, 22 Jul 2026 14:06:02 +0100 Subject: [PATCH 1/3] fix(deps): resolve pnpm audit failures in transitive dependencies - bump hono 4.12.26 -> 4.12.31 and fast-uri 3.1.2 -> 3.1.4 (lockfile only) - update brace-expansion overrides: the pins added for the previous advisory (1.1.13 / 5.0.6) are exactly the versions flagged by GHSA-3jxr-9vmj-r5cp; now pin 1.1.16 / 5.0.7 - ignore GHSA-frvp-7c67-39w9 (@hono/node-server serve-static path traversal on Windows): the fix is a major (2.0.5) outside the MCP SDK's ^1.19.9 range, and dcd-mcp is stdio-only and never serves static files. Remove the exemption when the SDK adopts 2.x. Co-Authored-By: Claude Fable 5 --- package.json | 9 +++++++-- pnpm-lock.yaml | 46 +++++++++++++++++++++++----------------------- 2 files changed, 30 insertions(+), 25 deletions(-) diff --git a/package.json b/package.json index 47e3b7c..8d24f9c 100644 --- a/package.json +++ b/package.json @@ -103,13 +103,18 @@ "ajv@<7.0.0": "6.14.0", "diff@>=4.0.0 <6.0.0": "4.0.4", "diff@>=6.0.0": "8.0.3", - "brace-expansion@<1.1.13": "1.1.13", + "brace-expansion@<1.1.16": "1.1.16", "brace-expansion@>=2.0.0 <2.0.3": "2.0.3", - "brace-expansion@>=4.0.0 <5.0.6": "5.0.6", + "brace-expansion@>=3.0.0 <5.0.7": "5.0.7", "ws@>=8.0.0 <8.21.0": "8.21.0", "esbuild@<0.28.1": ">=0.28.1", "micromatch>picomatch": "^2.3.2", "tinyglobby>picomatch": "^4.0.4" + }, + "auditConfig": { + "ignoreGhsas": [ + "GHSA-frvp-7c67-39w9" + ] } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 43ccd66..7904438 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -23,9 +23,9 @@ overrides: ajv@<7.0.0: 6.14.0 diff@>=4.0.0 <6.0.0: 4.0.4 diff@>=6.0.0: 8.0.3 - brace-expansion@<1.1.13: 1.1.13 + brace-expansion@<1.1.16: 1.1.16 brace-expansion@>=2.0.0 <2.0.3: 2.0.3 - brace-expansion@>=4.0.0 <5.0.6: 5.0.6 + brace-expansion@>=3.0.0 <5.0.7: 5.0.7 ws@>=8.0.0 <8.21.0: 8.21.0 esbuild@<0.28.1: '>=0.28.1' micromatch>picomatch: ^2.3.2 @@ -632,11 +632,11 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@1.1.13: - resolution: {integrity: sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -1037,8 +1037,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@3.1.4: + resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -1200,8 +1200,8 @@ packages: resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==} hasBin: true - hono@4.12.26: - resolution: {integrity: sha512-uyZtpnYxM9CmQ7QsQknM4zN8EftNqhON1qYeIKM0Se67CCEe2c44xyGURwB0axX2fBDu1dqHrHAc1hmNT8ITkw==} + hono@4.12.31: + resolution: {integrity: sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==} engines: {node: '>=16.9.0'} http-errors@2.0.1: @@ -2264,9 +2264,9 @@ snapshots: '@eslint/core': 1.2.1 levn: 0.4.1 - '@hono/node-server@1.19.14(hono@4.12.26)': + '@hono/node-server@1.19.14(hono@4.12.31)': dependencies: - hono: 4.12.26 + hono: 4.12.31 '@humanfs/core@0.19.2': dependencies: @@ -2299,7 +2299,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.26) + '@hono/node-server': 1.19.14(hono@4.12.31) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -2309,7 +2309,7 @@ snapshots: eventsource-parser: 3.1.0 express: 5.2.1 express-rate-limit: 8.5.2(express@5.2.1) - hono: 4.12.26 + hono: 4.12.31 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -2513,7 +2513,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.4 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2613,12 +2613,12 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@1.1.13: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.6: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -3153,7 +3153,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.2: {} + fast-uri@3.1.4: {} fast-wrap-ansi@0.2.2: dependencies: @@ -3318,7 +3318,7 @@ snapshots: he@1.2.0: {} - hono@4.12.26: {} + hono@4.12.31: {} http-errors@2.0.1: dependencies: @@ -3589,19 +3589,19 @@ snapshots: minimatch@10.2.3: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.7 minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.7 minimatch@3.1.4: dependencies: - brace-expansion: 1.1.13 + brace-expansion: 1.1.16 minimatch@9.0.7: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.7 minimist@1.2.8: {} From c61643dd628143698e817eb344aa32b96fb1ee30 Mon Sep 17 00:00:00 2001 From: Tom Riglar Date: Wed, 22 Jul 2026 14:24:19 +0100 Subject: [PATCH 2/3] ci: temporarily show full claude-review output to surface the hidden error MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Debug commit — will be reverted once the failure cause is captured. Co-Authored-By: Claude Fable 5 --- .github/workflows/claude-code-review.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 1eac5d0..6eca577 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -38,6 +38,7 @@ jobs: uses: anthropics/claude-code-action@v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + show_full_output: true plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' plugins: 'code-review@claude-code-plugins' # --comment is required for the review to be posted to the PR: the From 671441f40a908ae82cda410c0e1c56cf9ac73537 Mon Sep 17 00:00:00 2001 From: Tom Riglar Date: Wed, 22 Jul 2026 14:25:37 +0100 Subject: [PATCH 3/3] Revert "ci: temporarily show full claude-review output to surface the hidden error" This reverts commit c61643dd628143698e817eb344aa32b96fb1ee30. --- .github/workflows/claude-code-review.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 6eca577..1eac5d0 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -38,7 +38,6 @@ jobs: uses: anthropics/claude-code-action@v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - show_full_output: true plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' plugins: 'code-review@claude-code-plugins' # --comment is required for the review to be posted to the PR: the