From 9fb5297e6983816b38f07594eac98ef238696f5c Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 14:51:12 +0000 Subject: [PATCH 1/2] chore: upgrade @modelcontextprotocol/sdk to ^1.32.1 to address CVE-2026-104850 Co-Authored-By: Claude Opus 5.5 --- yarn.lock | 43 +++++-------------------------------------- 1 file changed, 5 insertions(+), 38 deletions(-) diff --git a/yarn.lock b/yarn.lock index a3e37041d..5df809b76 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3643,11 +3643,11 @@ __metadata: languageName: node linkType: hard -"@modelcontextprotocol/sdk@npm:^1.25.0": - version: 1.27.1 - resolution: "@modelcontextprotocol/sdk@npm:1.27.1" +"@modelcontextprotocol/sdk@npm:^1.25.0, @modelcontextprotocol/sdk@npm:^1.29.0": + version: 1.32.1 + resolution: "@modelcontextprotocol/sdk@npm:1.32.1" dependencies: - "@hono/node-server": "npm:^1.19.9" + "@hono/node-server": "npm:^1.19.9 || ^2.0.5" ajv: "npm:^8.17.1" ajv-formats: "npm:^3.0.1" content-type: "npm:^1.0.5" @@ -3672,40 +3672,7 @@ __metadata: optional: true zod: optional: false - checksum: 10c0/1b8ad87093c9e43174c7d65864b3d826a8dd050d5c32248f5da49fd72c51b556ebd702e3e49a7f1cc7fa25717a3f7fcee22ed89edd5bd3d8f4e1f8ca499b365e - languageName: node - linkType: hard - -"@modelcontextprotocol/sdk@npm:^1.29.0": - version: 1.29.0 - resolution: "@modelcontextprotocol/sdk@npm:1.29.0" - dependencies: - "@hono/node-server": "npm:^1.19.9" - ajv: "npm:^8.17.1" - ajv-formats: "npm:^3.0.1" - content-type: "npm:^1.0.5" - cors: "npm:^2.8.5" - cross-spawn: "npm:^7.0.5" - eventsource: "npm:^3.0.2" - eventsource-parser: "npm:^3.0.0" - express: "npm:^5.2.1" - express-rate-limit: "npm:^8.2.1" - hono: "npm:^4.11.4" - jose: "npm:^6.1.3" - json-schema-typed: "npm:^8.0.2" - pkce-challenge: "npm:^5.0.0" - raw-body: "npm:^3.0.0" - zod: "npm:^3.25 || ^4.0" - zod-to-json-schema: "npm:^3.25.1" - peerDependencies: - "@cfworker/json-schema": ^4.1.1 - zod: ^3.25 || ^4.0 - peerDependenciesMeta: - "@cfworker/json-schema": - optional: true - zod: - optional: false - checksum: 10c0/7c4bc339205b1652330cd4e6b121cc859079655f2b9c0506bbb15563ba0d07924bda3d949705530532db7f4d2cb86d633dc8f92bc32803d97c7bece2ac63e29f + checksum: 10c0/8b6c8ff6aa5358aeb316fedfa2094a4241ce12d98a0f818cee42510ec9149fed21fc75244c5f0e8cb453337f243c09fa8a90425cd2533fd481964d8583a1f0c9 languageName: node linkType: hard From 048b3bd624b15e08ecb870829bfadb7fac24320d Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 14:51:31 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for #1719 Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 05f18c31c..8acfbdd80 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Upgraded `seroval` to `^1.6.8`, `proxy-addr` to `^2.0.8`, `shell-quote` to `^1.12.0`, and `@grpc/grpc-js` to `^1.14.6`. [#1713](https://github.com/sourcebot-dev/sourcebot/pull/1713) - Upgraded `engine.io` to `^6.6.11`, `source-map-js` to `^1.2.2`, `smol-toml` to `^1.9.0`, `fast-copy` to `^3.1.0`, and `dompurify` to `^3.4.16`. [#1714](https://github.com/sourcebot-dev/sourcebot/pull/1714) - Upgraded `golang.org/x/crypto` to `v0.56.0` and OpenTelemetry-Go exporters and SDK to `v1.45.0` in Zoekt. [#1716](https://github.com/sourcebot-dev/sourcebot/pull/1716) +- Upgraded `@modelcontextprotocol/sdk` to `^1.32.1`. [#1719](https://github.com/sourcebot-dev/sourcebot/pull/1719) ## [5.1.15] - 2026-09-29