chore: bump the vulnerable conformance harness deps #581

New issue

Closed

opened 2026-09-22 17:10:26 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-22 17:10:26 +00:00

Owner

Context

osv-scanner reports 19 known vulnerabilities (7 high) in the committed MCP
conformance harness lockfile. The affected packages are fast-uri 3.1.3, hono
4.12.29, ip-address 10.2.0, qs 6.15.3, and @hono/node-server 1.19.14. These are
development-only offline test-harness dependencies, but the lockfile is
committed, so the fix-everything rule applies. The Go module graph has zero
known vulnerabilities.

What

Run npm audit fix in conformance/mcp-client/; every fix is in range.
Update conformance/mcp-client/package-lock.json.
Leave conformance/mcp-client/package.json unchanged, since the fixes are in
range.

Acceptance

osv-scanner scan source -r . reports 0 vulnerabilities.
npm ci succeeds; the lockfile and package.json stay in sync.
./scripts/mcp-conformance.sh stays green.

## Context osv-scanner reports 19 known vulnerabilities (7 high) in the committed MCP conformance harness lockfile. The affected packages are fast-uri 3.1.3, hono 4.12.29, ip-address 10.2.0, qs 6.15.3, and @hono/node-server 1.19.14. These are development-only offline test-harness dependencies, but the lockfile is committed, so the fix-everything rule applies. The Go module graph has zero known vulnerabilities. ## What - Run `npm audit fix` in `conformance/mcp-client/`; every fix is in range. - Update `conformance/mcp-client/package-lock.json`. - Leave `conformance/mcp-client/package.json` unchanged, since the fixes are in range. ## Acceptance - `osv-scanner scan source -r .` reports 0 vulnerabilities. - `npm ci` succeeds; the lockfile and package.json stay in sync. - `./scripts/mcp-conformance.sh` stays green.

hexajon added the

testing

security

labels

2026-09-22 17:10:26 +00:00

hexajon referenced this issue from a pull request that will close it,

2026-09-24 14:16:40 +00:00

chore(conformance): bump the vulnerable harness dependencies #615

hexajon referenced this issue from a commit

2026-09-24 14:16:41 +00:00

chore(conformance): bump the vulnerable harness dependencies

hexajon closed this issue