Security: Update dependencies and fix vulnerabilities#22
Conversation
Update @modelcontextprotocol/sdk from 1.15.1 to 1.27.1 and undici from ^7.16.0 to ^7.24.4 to address multiple CVEs. Run npm audit fix to resolve transitive vulnerabilities in minimatch, qs, ajv, and diff. https://claude.ai/code/session_01MaodopoPi78X3rxaxyN55f
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c0bfb0e287
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "license": "MIT", | ||
| "dependencies": { | ||
| "@modelcontextprotocol/sdk": "1.15.1", | ||
| "@modelcontextprotocol/sdk": "^1.27.1", |
There was a problem hiding this comment.
Updating @modelcontextprotocol/sdk to ^1.27.1 introduces a zod peer requirement of ^3.25 || ^4.0 (as reflected in the updated lockfile), but this package still declares zod as ^3.24.2. While the current lockfile resolves to a compatible 3.25.x, consumers installing from the published package.json with pinned zod@3.24.x (or with strict peer-dependency enforcement) can hit peer conflicts during install. The manifest should be updated so the declared zod range is compatible with the new SDK requirement.
Useful? React with 👍 / 👎.
2 participants
Summary
This PR updates critical dependencies to address multiple security vulnerabilities and improves the security posture of the project.
Key Changes
@modelcontextprotocol/sdkfrom 1.15.1 to 1.27.1 to fix CVE-2025-66414, CVE-2026-0621, and CVE-2026-25536undicifrom ^7.16.0 to ^7.24.4 to address security issuesminimatch,qs,ajv, anddiffvianpm audit fixNotable Details
@modelcontextprotocol/sdkdependency now uses a caret range (^1.27.1) instead of a pinned version, allowing for future patch and minor updates