From 70832f3fe7ea8ed6561a1590a670f83548edda67 Mon Sep 17 00:00:00 2001 From: NiveditJain Date: Fri, 16 Oct 2026 17:14:24 +0530 Subject: [PATCH] [failproofai-legion-904] Clear the fixable Dependabot alerts: mcp in the SDK lock, sprintf-js in two fixtures Three of the 12 open Dependabot alerts have a fix that keeps every pin: - sdk/python/uv.lock: mcp 1.28.1 -> 1.30.0 (GHSA-84m7-p3x7-pcfv, alert #60), the finding that has had the Supply Chain gate red on main since today's scheduled scan. crewai 1.15.27 (and 1.15.28) pin `mcp~=1.28.1`, so the fix is a `[tool.uv] override-dependencies` entry. uv reads it only when resolving uv.lock; the built package's metadata does not change. The lock moves mcp and nothing else and stays at revision 5 (written with uv 0.13.1; an older uv rewrites it to revision 3). - nextjs and mastra-1 fixtures: sprintf-js 1.0.3 removed (GHSA-hp3w-g68c-fv3c, alerts #50 and #52). No sprintf-js release fixes it. The only path is @mastra/core -> gray-matter -> js-yaml@3.15.2 -> argparse@1.0.10, and js-yaml 3 requires argparse from bin/js-yaml.js alone. A fixture-local `"argparse": "2.0.1"` override (no dependencies) drops it; each lockfile changes by those two entries only. Verified locally: OSV-Scanner with the gate's image and args reports no issues; npm audit on both fixtures reports 0; the mastra integration suites (mastra-0, mastra-1) and the nextjs shard pass; the Python adapter suite with every extra passes, as does the SDK suite on 3.10 and 3.14. The other nine alerts have no fix that keeps the fixtures: chromadb x4 and nltk (no patched release exists; ignored in osv-scanner.toml until 2026-11-20), and ai plus @ai-sdk/provider-utils in ai-4 and mastra-0 (accepted in SECURITY.md). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01L4vWL1D7r7hvSEG2KgDgcB --- CHANGELOG.md | 7 +++++++ sdk/python/pyproject.toml | 12 ++++++++++++ sdk/python/uv.lock | 9 ++++++--- sdk/typescript/CHANGELOG.md | 9 ++++++++- .../fixtures/mastra-1/package-lock.json | 17 ++++------------- .../integration/fixtures/mastra-1/package.json | 3 ++- .../fixtures/nextjs/package-lock.json | 17 ++++------------- .../integration/fixtures/nextjs/package.json | 3 +++ 8 files changed, 46 insertions(+), 31 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index aced97bac..94545e976 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 1.0.12-beta.0 — 2026-10-16 + +### Dependencies + +- Patch `mcp` 1.28.1 → 1.30.0 (GHSA-84m7-p3x7-pcfv) in the Python SDK's test lockfile, the finding that turned `main`'s Supply Chain gate red. crewai pins `mcp~=1.28.1`, so the fix is a `[tool.uv] override-dependencies` entry in `sdk/python/pyproject.toml`; uv applies it only when resolving `uv.lock`, and the published package's metadata is unchanged (#904) +- Remove `sprintf-js` (GHSA-hp3w-g68c-fv3c, no fixed release) from the `nextjs` and `mastra-1` SDK integration fixtures with an `argparse` 2.0.1 override. Both reached it through `@mastra/core` → `gray-matter` → `js-yaml@3` → `argparse@1`, and js-yaml 3 loads `argparse` only from its CLI, which nothing runs; every pin stays put (#904) + ## 1.0.11 — 2026-10-15 The first stable release with the new terminal experience and OpenTelemetry. Everything below in the `1.0.11-beta.*` sections ships here; the highlights: diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml index e107419ac..2eee24c64 100644 --- a/sdk/python/pyproject.toml +++ b/sdk/python/pyproject.toml @@ -74,6 +74,18 @@ llamaindex = ["llama-index-core>=0.14.23,<0.15"] pydantic-ai = ["pydantic-ai-slim>=2.0,<3"] # 2.0 removed Agent(instrument=...) otel = ["opentelemetry-sdk>=1.39,<2"] # optional SpanExporter / processor APIs +# Read by uv only when it resolves uv.lock, the dev/test lockfile. It is not package +# metadata, so it never reaches anyone installing `failproofai-sdk[crewai]`. +# +# crewai pins `mcp~=1.28.1`, and mcp 1.8.0 through 1.29.1 carry GHSA-84m7-p3x7-pcfv +# (unbounded Streamable HTTP sessions). The fix, 1.30.0, is outside that pin, so no +# in-range update reaches it; this is the uv equivalent of an npm `overrides` entry. +# The ceiling keeps crewai on the 1.x API it is written against. Delete this once a +# crewai release allows 1.30: an override replaces crewai's own requirement outright, +# so while it is here uv does not check the mcp version crewai asks for. +[tool.uv] +override-dependencies = ["mcp>=1.30.0,<2"] + [tool.setuptools.dynamic] version = { attr = "failproofai_sdk._version.__version__" } diff --git a/sdk/python/uv.lock b/sdk/python/uv.lock index 727b9a520..3558c860a 100644 --- a/sdk/python/uv.lock +++ b/sdk/python/uv.lock @@ -13,6 +13,9 @@ resolution-markers = [ "python_full_version < '3.11' and sys_platform != 'win32'", ] +[manifest] +overrides = [{ name = "mcp", specifier = ">=1.30.0,<2" }] + [[package]] name = "aiofiles" version = "24.1.0" @@ -2332,7 +2335,7 @@ wheels = [ [[package]] name = "mcp" -version = "1.28.1" +version = "1.30.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anyio" }, @@ -2350,9 +2353,9 @@ dependencies = [ { name = "typing-inspection" }, { name = "uvicorn", marker = "sys_platform != 'emscripten'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ba/93/0142dc84a666daf8ad51a34268f34c12fd6fda4f3810c4be2504eecc8212/mcp-1.30.0.tar.gz", hash = "sha256:445414625fce5c295faa505bb11bacece661ab6f4028d57c935db57820b7a3e4", size = 680511, upload-time = "2026-09-07T14:34:15.845Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/e2/5e/d118fce19f87a2e7d8101c35c8ae0ec289098a4df0ff244cec23e415aca0/mcp-1.28.1-py3-none-any.whl", hash = "sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df", size = 222620, upload-time = "2026-06-26T12:57:27.218Z" }, + { url = "https://files.pythonhosted.org/packages/f5/f4/e58bc33317c92a0203664daaf00bf6f41166cc0149e5d6870a03f7cd004a/mcp-1.30.0-py3-none-any.whl", hash = "sha256:666edb5009503e1047c9d60346a756f94b261f05cc2625f23d41c728ffc484d0", size = 234581, upload-time = "2026-09-07T14:34:14.266Z" }, ] [[package]] diff --git a/sdk/typescript/CHANGELOG.md b/sdk/typescript/CHANGELOG.md index cd4828f8f..8f31a590c 100644 --- a/sdk/typescript/CHANGELOG.md +++ b/sdk/typescript/CHANGELOG.md @@ -12,7 +12,14 @@ section is missing or empty is refused before anything is built. ### Fixes -- _Nothing yet._ +- **`nextjs` and `mastra-1` drop `sprintf-js`.** Every release through `1.1.3` + carries GHSA-hp3w-g68c-fv3c and none fixes it, so the fix is to take it out of + the tree. Both fixtures reached it only through `@mastra/core@1.68.0` → + `gray-matter@4.0.3` → `js-yaml@3.15.2` → `argparse@1.0.10`, and js-yaml 3 loads + `argparse` from its `js-yaml` CLI alone, never from the library `gray-matter` + calls. A fixture-local `overrides` entry moves `argparse` to `2.0.1`, which has no + dependencies. Each lockfile changes by those two packages and nothing else, and + `npm audit` on both now reports no findings. (#904) ## 0.0.1-beta.1 — 2026-10-15 diff --git a/sdk/typescript/integration/fixtures/mastra-1/package-lock.json b/sdk/typescript/integration/fixtures/mastra-1/package-lock.json index f5d27290a..85e4cb3f6 100644 --- a/sdk/typescript/integration/fixtures/mastra-1/package-lock.json +++ b/sdk/typescript/integration/fixtures/mastra-1/package-lock.json @@ -577,13 +577,10 @@ "license": "Apache-2.0" }, "node_modules/argparse": { - "version": "1.0.10", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz", - "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==", - "license": "MIT", - "dependencies": { - "sprintf-js": "~1.0.2" - } + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", + "license": "Python-2.0" }, "node_modules/async-mutex": { "version": "0.5.0", @@ -2265,12 +2262,6 @@ "url": "https://github.com/sponsors/isaacs" } }, - "node_modules/sprintf-js": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz", - "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==", - "license": "BSD-3-Clause" - }, "node_modules/stream-parser": { "version": "0.3.1", "resolved": "https://registry.npmjs.org/stream-parser/-/stream-parser-0.3.1.tgz", diff --git a/sdk/typescript/integration/fixtures/mastra-1/package.json b/sdk/typescript/integration/fixtures/mastra-1/package.json index 08054b10b..9f5cbde8f 100644 --- a/sdk/typescript/integration/fixtures/mastra-1/package.json +++ b/sdk/typescript/integration/fixtures/mastra-1/package.json @@ -13,6 +13,7 @@ "@types/node": "22.20.4" }, "overrides": { - "@modelcontextprotocol/client": "2.2.0" + "@modelcontextprotocol/client": "2.2.0", + "argparse": "2.0.1" } } diff --git a/sdk/typescript/integration/fixtures/nextjs/package-lock.json b/sdk/typescript/integration/fixtures/nextjs/package-lock.json index 1121b90ea..38a94b043 100644 --- a/sdk/typescript/integration/fixtures/nextjs/package-lock.json +++ b/sdk/typescript/integration/fixtures/nextjs/package-lock.json @@ -1589,13 +1589,10 @@ } }, "node_modules/argparse": { - "version": "1.0.10", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz", - "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==", - "license": "MIT", - "dependencies": { - "sprintf-js": "~1.0.2" - } + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", + "license": "Python-2.0" }, "node_modules/bail": { "version": "2.0.2", @@ -3741,12 +3738,6 @@ "node": ">=0.10.0" } }, - "node_modules/sprintf-js": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz", - "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==", - "license": "BSD-3-Clause" - }, "node_modules/strip-bom-string": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/strip-bom-string/-/strip-bom-string-1.0.0.tgz", diff --git a/sdk/typescript/integration/fixtures/nextjs/package.json b/sdk/typescript/integration/fixtures/nextjs/package.json index c630238f7..10f3414c9 100644 --- a/sdk/typescript/integration/fixtures/nextjs/package.json +++ b/sdk/typescript/integration/fixtures/nextjs/package.json @@ -24,5 +24,8 @@ "@types/node": "22.20.4", "@types/react": "19.3.0", "typescript": "5.9.3" + }, + "overrides": { + "argparse": "2.0.1" } }