Repository navigation
fix(deps): resolve Dependabot advisories - #246
Merged
Merged
Conversation
Override three packages pinned to vulnerable versions by the @deepseek-ai/dsh-mcp-client peer tree: - zod 4.4.3 -> 4.6.7 (GHSA-mrhx-c7xc-m3w5) under dsh-llm, dsh-sandbox-policy and dsh-session-projection - undici 8.11.2 -> 8.12.3 (GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472) under dsh-http-proxy - @modelcontextprotocol/client 2.2.0 -> 2.4.0 (GHSA-6prh-2h8m-c8cw) under dsh-mcp-client The replacements keep the APIs these packages use and dedupe onto versions already present in the workspace. These are dev/CI-only DSH peer dependencies: they are not part of the published @mebular/core tarball or the desktop artifact. Root and desktop npm audit now report 0. Refs: Windsander/Mebular Dependabot alerts 80, 81, 92, 93, 94.
Record each root override, the vulnerable transitive path it replaces, the advisory, compatibility evidence, shipped scope, and the upstream versions that allow removing it. Refs: Windsander/Mebular Dependabot alerts 80, 81, 92, 93, 94.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(deps): resolve Dependabot advisories
背景
独立安全清理，不改变 v0.1.0 已发布内容。基线
origin/main@38b7e43。当前 12 条 open Dependabot alerts 分类结果：
@mebular/core的发布依赖与桌面 lock 当前均无 shipped vulnerability。@deepseek-ai/dsh-llm/dsh-sandbox-policy/dsh-session-projection@deepseek-ai/dsh-http-proxy@modelcontextprotocol/client2.2.0 indsh-mcp-client修复
package.json增加 5 条最小范围 override：@deepseek-ai/dsh-llm -> zod: 4.6.7@deepseek-ai/dsh-sandbox-policy -> zod: 4.6.7@deepseek-ai/dsh-session-projection -> zod: 4.6.7@deepseek-ai/dsh-http-proxy -> undici: 8.12.3@deepseek-ai/dsh-mcp-client -> @modelcontextprotocol/client: 2.4.0package-lock.json只做对应最小变更。新增docs/operations/DEPENDENCY_OVERRIDES.md记录路径、兼容性、shipped 范围与移除条件。边界
overrides，因此 root override 不能修复 DSH host 用户侧；上游@deepseek-ai/dsh-mcp-client仍需在后续版本提升其固定依赖。已在文档记录。验证
npm ci：通过npm run build：通过npm run lint：通过npm run verify:dsh-plugin：129/129npm test -- --runInBand tests/dsh tests/desktop：14 suites / 316 testsnpm run test:coverage：185 suites / 1739 testsnpm audit --omit=dev（root）：0npm audit（root）：0npm audit（apps/desktop）：0check:deps/check:docs/check:cleanliness：通过合并时机
v0.1.0 已发布完成；本 PR 可独立评审/合并。合并后观察 Dependabot 扫描，7 条 stale 告警应自动关闭；DSH host 侧风险保留为上游依赖事项。