fix: address open dependabot security alerts#556
Conversation
jonathannorris
requested review from
JamieSinn,
Copilot,
kaushalkapasi and
suthar26
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
devcycle-mcp-server | 06bae8b | Mar 11 2026, 02:14 PM |
There was a problem hiding this comment.
Pull request overview
This PR focuses on reducing Dependabot security alerts by upgrading several direct dependencies and pinning vulnerable transitive dependency versions via Yarn resolutions.
Changes:
- Bumped direct dependencies to patched versions (
@modelcontextprotocol/sdk,ajv,minimatch,hono). - Added Yarn
resolutionsto force patched transitive versions ofminimatch(3/5/7) androllup. - Refreshed
yarn.lockto reflect the updated dependency graph (including patched transitive versions likeqs).
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
package.json |
Updates direct dependency ranges and adds resolutions to pin vulnerable transitive packages. |
yarn.lock |
Updates the lockfile to the resolved patched versions across the dependency graph. |
oclif.manifest.json |
Updates manifest version metadata to align with the release version. |
mcp-worker/package.json |
Bumps hono dependency in the worker workspace. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "minimatch@npm:^3.1.1": "3.1.4", | ||
| "minimatch@npm:^3.1.2": "3.1.4", | ||
| "minimatch@npm:^5.0.1": "5.1.8", | ||
| "minimatch@npm:^7.2.0": "7.4.8", | ||
| "rollup@npm:^4.43.0": "4.59.0" |
There was a problem hiding this comment.
PR description mentions adding yarn resolutions for a transitive qs vulnerability, but the resolutions block only pins minimatch and rollup (no qs entry). If qs still needs to be forced for security, add an explicit qs resolution; otherwise, update the PR description to reflect that qs was addressed via lockfile upgrades rather than a resolution.
…() from breaking subsequent tests
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
hono,ajv,minimatch,@modelcontextprotocol/sdk) to patched versionsminimatch@3/5/7,rollup, andqsvulnerabilitiesRemaining alerts
5 alerts deferred — they require breaking version changes (
agents0.2→0.3+,tar6→7,@tootallnate/once1/2→3) and need separate PRs with more careful migration.