From d95da2eeabd8b46a3c418196b0375ae10cb7bd3a Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Wed, 4 Nov 2026 15:29:26 +0100 Subject: [PATCH] MCP: @hono/node-server 2.1.6 closes the open Dependabot alert GHSA-rmxm-3fg6-px4f The mcp group bump (#196) moved @modelcontextprotocol/node to 2.1.2, which widens its @hono/node-server range from ^1.19.9 to ^1.19.9 || ^2.1.3, but it kept the locked 1.19.17. This moves it to 2.1.6 and raises the declared @modelcontextprotocol/server range to ^2.4.0, the peer range node 2.1.2 requires (the lockfile already had 2.4.0). 2.1.3 already fixes GHSA-rmxm-3fg6-px4f (serveStatic decodes the path twice). 2.1.6 is two days old and inside the 7-day cooldown, but it is the security release for GHSA-jpvv-r467-5p4w, GHSA-7v5p-43qr-wch5 and GHSA-qv5m-9pm6-hqp3, which hono has published but the advisory database does not list yet; 2.1.5 would raise those alerts as soon as it does. Lockfile written with npm 11.21.1. npm audit: the remaining 11 moderate findings are all minimatch < 11.0.1 (GHSA-g3hv-75wg-m249) under eslint and typescript-eslint, which no parent allows yet. MCP: tsc, build, lint (0 warnings), knip clean; 1064 tests pass. Co-Authored-By: Claude Opus 5.5 --- .../autopilot-monitor-mcp/package-lock.json | 26 +++++++++---------- .../autopilot-monitor-mcp/package.json | 2 +- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/src/McpServer/autopilot-monitor-mcp/package-lock.json b/src/McpServer/autopilot-monitor-mcp/package-lock.json index 79bc86cec..0cc9bb69e 100644 --- a/src/McpServer/autopilot-monitor-mcp/package-lock.json +++ b/src/McpServer/autopilot-monitor-mcp/package-lock.json @@ -10,7 +10,7 @@ "dependencies": { "@huggingface/transformers": "^3.8.1", "@modelcontextprotocol/node": "^2.1.2", - "@modelcontextprotocol/server": "^2.3.1", + "@modelcontextprotocol/server": "^2.4.0", "ajv": "^8.20.0", "ajv-formats": "^3.0.1", "compression": "^1.8.2", @@ -683,6 +683,18 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, + "node_modules/@hono/node-server": { + "version": "2.1.6", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.6.tgz", + "integrity": "sha512-p/KH9MnfNcsm3sR6x4lNgm5j+QN4Et8srKredl9DZfXiyZ1UQ3aQ2YVpFLbqktYN5JI+DB+VZFKM2PqE5hLKjQ==", + "license": "MIT", + "engines": { + "node": ">=20" + }, + "peerDependencies": { + "hono": "^4 || ^5.0.0-0" + } + }, "node_modules/@huggingface/jinja": { "version": "0.5.6", "resolved": "https://registry.npmjs.org/@huggingface/jinja/-/jinja-0.5.6.tgz", @@ -1336,18 +1348,6 @@ "@modelcontextprotocol/server": "^2.4.0" } }, - "node_modules/@modelcontextprotocol/node/node_modules/@hono/node-server": { - "version": "1.19.17", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz", - "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==", - "license": "MIT", - "engines": { - "node": ">=18.14.1" - }, - "peerDependencies": { - "hono": "^4" - } - }, "node_modules/@modelcontextprotocol/server": { "version": "2.4.0", "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server/-/server-2.4.0.tgz", diff --git a/src/McpServer/autopilot-monitor-mcp/package.json b/src/McpServer/autopilot-monitor-mcp/package.json index 959ba3c4d..94e9a8e82 100644 --- a/src/McpServer/autopilot-monitor-mcp/package.json +++ b/src/McpServer/autopilot-monitor-mcp/package.json @@ -23,7 +23,7 @@ "dependencies": { "@huggingface/transformers": "^3.8.1", "@modelcontextprotocol/node": "^2.1.2", - "@modelcontextprotocol/server": "^2.3.1", + "@modelcontextprotocol/server": "^2.4.0", "ajv": "^8.20.0", "ajv-formats": "^3.0.1", "compression": "^1.8.2",