chore(deps): resolve open Dependabot security alerts by frontegg-david · Pull Request #43 · agentfront/mcp-from-openapi

frontegg-david · 2026-10-20T03:29:01Z

Summary

Resolves all 19 open Dependabot alerts. Every affected package is a transitive dev-tree dependency. The published package's runtime dependencies (@apidevtools/json-schema-ref-parser, openapi-types, yaml) are unchanged.

Lockfile refresh within existing ranges

Each patched version satisfies its parent's existing semver range, so only yarn.lock changes for these:

Package	Before → After	Pulled in by	Alerts
`proxy-addr`	2.0.7 → 2.0.8	`express` (MCP SDK)	IPv4-mapped IPv6 trust-subnet spoofing (critical)
`fast-uri`	3.1.5 → 3.1.9	`ajv`	5 host-confusion / SSRF / authority-injection advisories (high)
`undici`	6.28.0 → 6.29.1	`node-gyp` (via `@parcel/watcher`, jest)	WebSocket DoS ×2, retry-interceptor response splitting
`browserslist`	4.28.1 → 4.29.4	`@babel/helper-compilation-targets`	custom-stats crash / prototype write (high)
`baseline-browser-mapping`	2.9.11 → 2.11.30	`browserslist`	DoS on invalid input
`hono`	4.13.1 → 4.13.13	`@modelcontextprotocol/sdk`	JSX XSS, `toSSG` path escape, query-after-fragment
`ip-address`	10.5.0 → 10.7.4	`express-rate-limit`	cross-family subnet checks, `fe80::/10`, NAT64 local-use

browserslist's own data packages (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db) move with it.

`sprintf-js` (no patched release) and `js-yaml` 3.x

sprintf-js ≤ 1.1.3 is affected, and 1.1.3 is the latest release. Its only path in the tree was babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3 → argparse@1 → sprintf-js. js-yaml@3 needs argparse only for its CLI, and load-nyc-config only calls require('js-yaml').load(...), and only for a .nycrc.yaml (this repo has none). A resolutions entry points @istanbuljs/load-nyc-config/js-yaml at the ^5.4.2 already in the tree for json-schema-ref-parser. js-yaml 5 ships a CommonJS build with load. That removes js-yaml@3, argparse@1, esprima and sprintf-js, which also clears the js-yaml 3.x merge-key alert.

Build

scripts/strip-dist-from-pkg.js now deletes resolutions from the published dist/package.json (next to scripts). The field only means something in the repo root.

Verification

yarn install --immutable
yarn build, then dist/package.json and dist/esm/package.json checked for no resolutions
tsc --noEmit
yarn test:coverage: 1102 tests, 100% statements/branches/functions/lines
yarn test:e2e: 56 tests. This runs the real MCP SDK, so it exercises express (proxy-addr), express-rate-limit (ip-address), hono and ajv (fast-uri), plus the dist packaging story.
yarn why shows every alerted package at or above its first patched version, and sprintf-js / argparse@1 / js-yaml@3 absent.

Summary by CodeRabbit

Bug Fixes
- Improved dependency consistency for development and testing workflows.
- Ensured published package metadata excludes development-only configuration settings.
Chores
- Updated package configuration and publishing cleanup to support more reliable package distribution.

Refreshes vulnerable transitive dependencies to patched releases within their parents' existing semver ranges: - proxy-addr 2.0.7 -> 2.0.8 (express) - hono 4.13.1 -> 4.13.13 (@modelcontextprotocol/sdk) - ip-address 10.5.0 -> 10.7.4 (express-rate-limit) - undici 6.28.0 -> 6.29.1 (node-gyp) - fast-uri 3.1.5 -> 3.1.9 (ajv) - browserslist 4.28.1 -> 4.29.4, baseline-browser-mapping 2.9.11 -> 2.11.30 (@babel/helper-compilation-targets) sprintf-js has no patched release. Its only path was @istanbuljs/load-nyc-config -> js-yaml@3 -> argparse@1, and js-yaml@3 only needs argparse for its CLI. A resolution points load-nyc-config at the js-yaml ^5.4.2 already in the tree (it only calls js-yaml.load), which drops js-yaml@3, argparse@1, esprima and sprintf-js and clears the js-yaml 3.x alert too. The dist manifest no longer carries the root-only resolutions field.

coderabbitai · 2026-10-20T03:29:09Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: 47b34aec-4dd4-4109-b63c-02f9fb85d014

📥 Commits

Reviewing files that changed from the base of the PR and between 8e46e65 and b83b8ec.

⛔ Files ignored due to path filters: 1

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing: 2

package.json
scripts/strip-dist-from-pkg.js

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Walkthrough

The package manifest adds a Yarn resolution override for @istanbuljs/load-nyc-config/js-yaml. The publish-manifest cleanup script removes the resolutions field.

Changes

Dependency Resolution

Layer / File(s)	Summary
Resolution and publish cleanup `package.json`, `scripts/strip-dist-from-pkg.js`	`package.json` sets `@istanbuljs/load-nyc-config/js-yaml` to `^5.4.2`. The cleanup script removes `resolutions` from the manifest it writes.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to b83b8

No actionable merge risk remains: the dependency override is compatible and the published manifest preserves the runtime package contract.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating dependencies to resolve open Dependabot security alerts.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the package list,
And finds a version neatly fixed.
The publish script clears resolutions away,
So they do not travel on release day.
Then hops along, content and brisk.}

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-10-20T03:30:09Z

Add Carrot credits or activate Agent usage billing to use Autofix

frontegg-david · 2026-10-20T03:30:52Z

@coderabbitai review

coderabbitai · 2026-10-20T03:30:57Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

github-actions · 2026-10-20T03:43:32Z

Cherry-pick Created

A cherry-pick PR to main has been automatically created.

Please review and merge if this change should also be in main.

If the cherry-pick is not needed, close the PR.

frontegg-david merged commit 3881650 into release/2.9.x Oct 20, 2026
6 checks passed

frontegg-david deleted the chore/deps-security-2.9.x branch October 20, 2026 03:43

github-actions Bot mentioned this pull request Oct 20, 2026

Cherry-pick: chore(deps): resolve open Dependabot security alerts #44

Merged

Navigation Menu

Repository navigation

chore(deps): resolve open Dependabot security alerts - #43

chore(deps): resolve open Dependabot security alerts#43
frontegg-david merged 1 commit into
release/2.9.xfrom
chore/deps-security-2.9.x

frontegg-david commented Oct 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 20, 2026

Uh oh!

frontegg-david commented Oct 20, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

frontegg-david commented Oct 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Lockfile refresh within existing ranges

sprintf-js (no patched release) and js-yaml 3.x

Build

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot commented Oct 20, 2026

Uh oh!

frontegg-david commented Oct 20, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026

Cherry-pick Created

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

frontegg-david commented Oct 20, 2026 •

edited by coderabbitai Bot

Loading

`sprintf-js` (no patched release) and `js-yaml` 3.x

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading