From cf9ddc636f140776ce808589f20e91aff2de1bf1 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 30 Mar 2026 09:38:32 +0000 Subject: [PATCH] fix(ci): resolve audit vulnerabilities via dependency updates Co-authored-by: Dylan Boudro --- package.json | 8 +++--- pnpm-lock.yaml | 72 ++++++++++++++++++++++++++------------------------ 2 files changed, 42 insertions(+), 38 deletions(-) diff --git a/package.json b/package.json index 4fcf85f..c708066 100644 --- a/package.json +++ b/package.json @@ -55,7 +55,7 @@ "license": "BUSL-1.1", "dependencies": { "@inkjs/ui": "^2.0.0", - "@modelcontextprotocol/sdk": "^1.27.1", + "@modelcontextprotocol/sdk": "^1.28.0", "chalk": "^5.4.1", "env-paths": "^3.0.0", "ink": "^6.0.0", @@ -63,7 +63,7 @@ "open": "^10.1.0", "ora": "^9.3.0", "react": "^19.2.4", - "yaml": "^2.7.0", + "yaml": "^2.8.3", "zod": "^4.3.6" }, "optionalDependencies": { @@ -88,7 +88,9 @@ "esbuild" ], "overrides": { - "phin@<3.7.1": ">=3.7.1" + "phin@<3.7.1": ">=3.7.1", + "hono": "^4.12.9", + "path-to-regexp": "^8.4.0" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0c3dd41..a32b461 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,8 @@ settings: overrides: phin@<3.7.1: '>=3.7.1' + hono: ^4.12.9 + path-to-regexp: ^8.4.0 importers: @@ -15,8 +17,8 @@ importers: specifier: ^2.0.0 version: 2.0.0(ink@6.8.0(@types/react@19.2.14)(react@19.2.4)) '@modelcontextprotocol/sdk': - specifier: ^1.27.1 - version: 1.27.1(zod@4.3.6) + specifier: ^1.28.0 + version: 1.28.0(zod@4.3.6) chalk: specifier: ^5.4.1 version: 5.6.2 @@ -39,8 +41,8 @@ importers: specifier: ^19.2.4 version: 19.2.4 yaml: - specifier: ^2.7.0 - version: 2.8.2 + specifier: ^2.8.3 + version: 2.8.3 zod: specifier: ^4.3.6 version: 4.3.6 @@ -62,7 +64,7 @@ importers: version: 17.3.0 tsup: specifier: ^8.3.6 - version: 8.5.1(postcss@8.5.6)(typescript@5.9.3)(yaml@2.8.2) + version: 8.5.1(postcss@8.5.6)(typescript@5.9.3)(yaml@2.8.3) typescript: specifier: ^5.7.3 version: 5.9.3 @@ -71,7 +73,7 @@ importers: version: 8.56.1(eslint@10.0.2)(typescript@5.9.3) vitest: specifier: ^4.0.18 - version: 4.0.18(@opentelemetry/api@1.9.0)(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.2) + version: 4.0.18(@opentelemetry/api@1.9.0)(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.3) optionalDependencies: keyring-node: specifier: ^1.0.1 @@ -282,7 +284,7 @@ packages: resolution: {integrity: sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==} engines: {node: '>=18.14.1'} peerDependencies: - hono: ^4 + hono: ^4.12.9 '@humanfs/core@0.19.1': resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==} @@ -322,8 +324,8 @@ packages: '@jridgewell/trace-mapping@0.3.31': resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==} - '@modelcontextprotocol/sdk@1.27.1': - resolution: {integrity: sha512-sr6GbP+4edBwFndLbM60gf07z0FQ79gaExpnsjMGePXqFcSSb7t6iscpjk9DhFhwd+mTEQrzNafGP8/iGGFYaA==} + '@modelcontextprotocol/sdk@1.28.0': + resolution: {integrity: sha512-gmloF+i+flI8ouQK7MWW4mOwuMh4RePBuPFAEPC6+pdqyWOUMDOixb6qZ69owLJpz6XmyllCouc4t8YWO+E2Nw==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -1013,8 +1015,8 @@ packages: resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==} engines: {node: '>= 0.4'} - hono@4.12.5: - resolution: {integrity: sha512-3qq+FUBtlTHhtYxbxheZgY8NIFnkkC/MR8u5TTsr7YZ3wixryQ3cCwn3iZbg8p8B88iDBBAYSfZDS75t8MN7Vg==} + hono@4.12.9: + resolution: {integrity: sha512-wy3T8Zm2bsEvxKZM5w21VdHDDcwVS1yUFFY6i8UobSsKfFceT7TOwhbhfKsDyx7tYQlmRM5FLpIuYvNFyjctiA==} engines: {node: '>=16.9.0'} http-errors@2.0.1: @@ -1283,8 +1285,8 @@ packages: resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==} engines: {node: '>=8'} - path-to-regexp@8.3.0: - resolution: {integrity: sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==} + path-to-regexp@8.4.0: + resolution: {integrity: sha512-PuseHIvAnz3bjrM2rGJtSgo1zjgxapTLZ7x2pjhzWwlp4SJQgK3f3iZIQwkpEnBaKz6seKBADpM4B4ySkuYypg==} pathe@2.0.3: resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==} @@ -1740,8 +1742,8 @@ packages: resolution: {integrity: sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw==} engines: {node: '>=18'} - yaml@2.8.2: - resolution: {integrity: sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==} + yaml@2.8.3: + resolution: {integrity: sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==} engines: {node: '>= 14.6'} hasBin: true @@ -1883,9 +1885,9 @@ snapshots: '@eslint/core': 1.1.0 levn: 0.4.1 - '@hono/node-server@1.19.11(hono@4.12.5)': + '@hono/node-server@1.19.11(hono@4.12.9)': dependencies: - hono: 4.12.5 + hono: 4.12.9 '@humanfs/core@0.19.1': {} @@ -1926,9 +1928,9 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.5 - '@modelcontextprotocol/sdk@1.27.1(zod@4.3.6)': + '@modelcontextprotocol/sdk@1.28.0(zod@4.3.6)': dependencies: - '@hono/node-server': 1.19.11(hono@4.12.5) + '@hono/node-server': 1.19.11(hono@4.12.9) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -1938,7 +1940,7 @@ snapshots: eventsource-parser: 3.0.6 express: 5.2.1 express-rate-limit: 8.3.0(express@5.2.1) - hono: 4.12.5 + hono: 4.12.9 jose: 6.2.0 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -2149,13 +2151,13 @@ snapshots: chai: 6.2.2 tinyrainbow: 3.0.3 - '@vitest/mocker@4.0.18(vite@7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.2))': + '@vitest/mocker@4.0.18(vite@7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.3))': dependencies: '@vitest/spy': 4.0.18 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.2) + vite: 7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.3) '@vitest/pretty-format@4.0.18': dependencies: @@ -2619,7 +2621,7 @@ snapshots: dependencies: function-bind: 1.1.2 - hono@4.12.5: {} + hono@4.12.9: {} http-errors@2.0.1: dependencies: @@ -2864,7 +2866,7 @@ snapshots: path-key@3.1.1: {} - path-to-regexp@8.3.0: {} + path-to-regexp@8.4.0: {} pathe@2.0.3: {} @@ -2882,12 +2884,12 @@ snapshots: mlly: 1.8.0 pathe: 2.0.3 - postcss-load-config@6.0.1(postcss@8.5.6)(yaml@2.8.2): + postcss-load-config@6.0.1(postcss@8.5.6)(yaml@2.8.3): dependencies: lilconfig: 3.1.3 optionalDependencies: postcss: 8.5.6 - yaml: 2.8.2 + yaml: 2.8.3 postcss@8.5.6: dependencies: @@ -2977,7 +2979,7 @@ snapshots: depd: 2.0.0 is-promise: 4.0.0 parseurl: 1.3.3 - path-to-regexp: 8.3.0 + path-to-regexp: 8.4.0 transitivePeerDependencies: - supports-color @@ -3159,7 +3161,7 @@ snapshots: ts-interface-checker@0.1.13: {} - tsup@8.5.1(postcss@8.5.6)(typescript@5.9.3)(yaml@2.8.2): + tsup@8.5.1(postcss@8.5.6)(typescript@5.9.3)(yaml@2.8.3): dependencies: bundle-require: 5.1.0(esbuild@0.27.3) cac: 6.7.14 @@ -3170,7 +3172,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(postcss@8.5.6)(yaml@2.8.2) + postcss-load-config: 6.0.1(postcss@8.5.6)(yaml@2.8.3) resolve-from: 5.0.0 rollup: 4.59.0 source-map: 0.7.6 @@ -3226,7 +3228,7 @@ snapshots: vary@1.1.2: {} - vite@7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.2): + vite@7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.3): dependencies: esbuild: 0.27.3 fdir: 6.5.0(picomatch@4.0.3) @@ -3238,12 +3240,12 @@ snapshots: '@types/node': 25.3.2 fsevents: 2.3.3 terser: 5.46.0 - yaml: 2.8.2 + yaml: 2.8.3 - vitest@4.0.18(@opentelemetry/api@1.9.0)(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.2): + vitest@4.0.18(@opentelemetry/api@1.9.0)(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.3): dependencies: '@vitest/expect': 4.0.18 - '@vitest/mocker': 4.0.18(vite@7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.2)) + '@vitest/mocker': 4.0.18(vite@7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.3)) '@vitest/pretty-format': 4.0.18 '@vitest/runner': 4.0.18 '@vitest/snapshot': 4.0.18 @@ -3260,7 +3262,7 @@ snapshots: tinyexec: 1.0.2 tinyglobby: 0.2.15 tinyrainbow: 3.0.3 - vite: 7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.2) + vite: 7.3.1(@types/node@25.3.2)(terser@5.46.0)(yaml@2.8.3) why-is-node-running: 2.3.0 optionalDependencies: '@opentelemetry/api': 1.9.0 @@ -3307,7 +3309,7 @@ snapshots: dependencies: is-wsl: 3.1.1 - yaml@2.8.2: {} + yaml@2.8.3: {} yocto-queue@0.1.0: {}