mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
50c002712b
Resolves all 13 Dependabot alerts on src/McpServer/autopilot-monitor-mcp (1 critical, 4 high, 8 medium): npm audit fix (no --force) lifted these transitively, all within existing parent semver ranges: - protobufjs 7.5.4 -> 7.5.5 (CRITICAL: arbitrary code execution, GHSA-xq3m-2v4x-88gg, transitive via @huggingface/transformers -> onnxruntime-web; the over-pinned protobufjs override I had planned turned out to be unnecessary) - hono 4.12.9 -> 4.12.15 (6 advisories: serveStatic bypass, cookie name validation, IP matching, JSX SSR, toSSG path traversal) - @hono/node-server 1.19.11 -> 1.19.14 (serveStatic bypass mirror) - path-to-regexp 8.3.0 -> 8.4.2 (high: ReDoS x2) - vite 8.0.3 -> 8.0.10 (high x3, transitive via vitest) - postcss 8.5.8 -> 8.5.10 (transitive via vite) Also bumped: - @anthropic-ai/sdk ^0.80.0 -> ^0.91.0 (medium: Memory Tool path validation; we don't use the Memory Tool, but bumping anyway to clear the alert. Verified agents/query.ts still compiles -- only standard Messages API used: client.messages.create, Anthropic.Tool, Anthropic.MessageParam, Anthropic.ToolUseBlock, Anthropic.TextBlock.) Verified: - npm audit -> 0 vulnerabilities - npm run build (tsc) -> green - npm test gated on AUTOPILOT_API_TOKEN env var (pre-existing setup, not affected by this change)