fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x, clearing the last two runtime advisories - #68
fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x, clearing the last two runtime advisories#68yakimoto wants to merge 2 commits into
Conversation
…st two runtime advisories @hono/node-server is not a direct dependency. it is pinned by @modelcontextprotocol/sdk, which declared ^1.19.9 through 1.29.0, so forcing 2.x onto the old sdk would mean overriding a dependency own declared range. that is the shape claude-workstation#554 documents, where a patched version broke its consumer while npm audit reported zero vulnerabilities and 195 of 195 tests passed. sdk 1.30.0, published 2026-07-27, widened the range to ^1.19.9 || ^2.0.5. the root already declares ^1.0.0, so both moves are reachable with npm update --package-lock-only and no manifest edit. the peer @modelcontextprotocol/sdk ^1.29.0 from @anthropic-ai/claude-agent-sdk is still satisfied. @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 @hono/node-server 1.19.14 -> 2.0.12 audit, dev scope included: main 7 (3 high, 2 mod), here 5 (3 high, 0 mod). both moderates clear, since the sdk was only ever flagged transitively via @hono/node-server. this repo has no test suite (#64), so a green build proves nothing about runtime. spawned the built binary over stdio and completed a real MCP handshake: initialize returns wave-mcp-server protocol 2025-06-18 and tools/list still enumerates all 18 tools. src/server.ts imports only StdioServerTransport, so node-server sits off this code path entirely. build, tsc --noEmit and eslint all clean. CI cannot run.
|
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_b916bc9e-2d4d-46e3-bef4-71ffb3ea7f30) |
|
Companion PR opened on the other repo carrying the same two-package move: wave-av/sdks#50 (closes wave-av/sdks#49). One deliberate difference, flagged so it doesn't read as an oversight. sdks#50 also narrows a manifest range, The reason is that a declared range only protects downstream consumers of a published package, and these two repos differ on that point. If #66 lands and this repo later becomes the genuine publisher, the range should be narrowed here too. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_3d8de40f-0968-46a1-9971-0b76d861aa4f) |
1 participant
Clears the last two runtime-scope advisories on this repo, lockfile only.
The interesting part: why this needs no
overrides@hono/node-serveris not a direct dependency. It's pinned by the MCP SDK:So the obvious remediation — force 2.0.5 with an
overridesentry — would mean overriding a dependency's own declared range. That's exactly the failure documented in claude-workstation#554, where the "fix" broke the consumer whilenpm auditreported 0 vulnerabilities and 195/195 tests passed.It isn't necessary.
@modelcontextprotocol/sdk@1.30.0, published 2026-07-27, widened its range to^1.19.9 || ^2.0.5. The root already declares^1.0.0, so both moves come fromnpm update --package-lock-onlywith no manifest edit at all:NODE_ENV=development npm update @modelcontextprotocol/sdk --package-lock-only NODE_ENV=development npm update @hono/node-server --package-lock-only git status --short # → " M package-lock.json" (nothing else)Eight lines of lockfile. The peer requirement
@modelcontextprotocol/sdk@^1.29.0from@anthropic-ai/claude-agent-sdk@0.3.168is still satisfied.Advisory delta
Dev scope included, against
main@a199245:mainBoth moderates clear together because
@modelcontextprotocol/sdkwas only ever flagged transitively —via: ["@hono/node-server"]. One root cause, two entries.Verified against runtime, not just the build
This repo has no test suite (#64), so build + type-check green is precisely the evidence #554 proved worthless. So I spawned the actual built binary over stdio and completed a real MCP handshake:
main(SDK 1.29.0 / node-server 1.19.14)initializewave-mcp-server, protocol2025-06-18tools/listByte-identical behaviour on the exercised surface. Plus
npm run build→ success,tsc --noEmit→ clean,eslint --max-warnings 0→ clean.Reachability note that lowers the risk further:
src/server.tsimports onlyStdioServerTransport. This repo never constructs an HTTP transport, so@hono/node-serveris present in the tree but sits off the code path entirely — the major bump has no exercised surface here at all.Measurement caveat
npm auditin this environment inheritsomit=devfromNODE_ENV=production, silently reporting 5 advisories instead of 7 and hiding the dev-scope entries. Every figure above was taken withNODE_ENV=developmentset explicitly.What's left after this
With #59 (hono), #58 (fast-uri), #55 (body-parser), #67 (brace-expansion) and this one, the repo goes from 14 open Dependabot alerts to 1:
esbuild0.27.3 - 0.28.0, low, dev-only. Same class as the dev-only tail on wave-av/sdks#48.Supersedes the need for a mcp-server equivalent of wave-av/sdks#49, which described this bump as needing a breaking-change assessment — that was true against SDK 1.29.0 and stopped being true when 1.30.0 shipped.
CI cannot run — Actions are refusing every job org-wide on an account-level billing lock (
plan=free,locked=yes, confirmed live this morning onadkanddispatch-edge). All verification above is local.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is enabled.Note
Low Risk
Lockfile-only semver updates with no source changes; HTTP/node-server stack is not used by this package’s stdio server.
Overview
Lockfile-only dependency refresh that bumps
@modelcontextprotocol/sdkto 1.30.0 and transitively resolves@hono/node-serverto 2.0.12, clearing the last two runtime npm advisories tied tonode-server< 2.0.5. Rootpackage.jsonis unchanged (@modelcontextprotocol/sdkstays^1.0.0).SDK 1.30.0 widens its
@hono/node-serverrange to^1.19.9 || ^2.0.5, so the major bump lands withoutoverridesor application code edits. This server uses stdio MCP transport only, so@hono/node-serverremains off the exercised path here.Reviewed by Cursor Bugbot for commit 794b0b0. Configure here.
Summary by cubic
Updates
@modelcontextprotocol/sdkto 1.30.0, which lets@hono/node-serverresolve to 2.x and clears the last two runtime advisories via a lockfile-only update. No overrides or code changes; runtime behavior unchanged (stdio transport only).@modelcontextprotocol/sdk1.29.0 → 1.30.0 (widens@hono/node-serverto^1.19.9 || ^2.0.5)@hono/node-server1.19.14 → 2.0.12 (Node>=20)Written for commit bda11b6. Summary will update on new commits.