From 472cbf0835f9c6f7c571752857f7c04a5a8dbf65 Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Mon, 12 Oct 2026 12:06:56 +1100 Subject: [PATCH 1/3] fix(deps): patch @modelcontextprotocol/sdk to 1.32.0 --- .changeset/wizard-mcp-sdk-security-pin.md | 9 +++++++++ e2e/tests/supply-chain.e2e.test.ts | 15 +++++++++++++++ languages/typescript/packages/wizard/package.json | 1 + pnpm-lock.yaml | 15 +++++++++------ pnpm-workspace.yaml | 4 ++++ 5 files changed, 38 insertions(+), 6 deletions(-) create mode 100644 .changeset/wizard-mcp-sdk-security-pin.md diff --git a/.changeset/wizard-mcp-sdk-security-pin.md b/.changeset/wizard-mcp-sdk-security-pin.md new file mode 100644 index 000000000..1e7f2c01b --- /dev/null +++ b/.changeset/wizard-mcp-sdk-security-pin.md @@ -0,0 +1,9 @@ +--- +"@cipherstash/wizard": patch +--- + +Add `@modelcontextprotocol/sdk` `^1.32.0` as a direct dependency so the +auto-installed peer of `@anthropic-ai/claude-agent-sdk` resolves to a release +patched against GHSA-6qxp-vccf-f47h / CVE-2026-104850, instead of the vulnerable +1.29.0 the peer range (`^1.29.0`) alone would select. The wizard never imports +the MCP SDK directly — this is a peer-resolution pin only; no behaviour change. diff --git a/e2e/tests/supply-chain.e2e.test.ts b/e2e/tests/supply-chain.e2e.test.ts index ad8e4292e..8f187cd8d 100644 --- a/e2e/tests/supply-chain.e2e.test.ts +++ b/e2e/tests/supply-chain.e2e.test.ts @@ -291,6 +291,21 @@ describe('supply chain — pnpm-lock.yaml integrity', () => { ).toBe(true) } }) + + it('@modelcontextprotocol/sdk resolves to the peer-pinned patched version (≥ 1.31.0)', () => { + // Peer-resolution pin, like @anthropic-ai/sdk above: languages/typescript/packages/wizard + // depends on @modelcontextprotocol/sdk@^1.32.0 to force the auto-installed + // peer of @anthropic-ai/claude-agent-sdk past the advisory-vulnerable range + // (GHSA-6qxp-vccf-f47h / CVE-2026-104850, patched 1.31.0). + const versions = resolvedVersionsByName().get('@modelcontextprotocol/sdk') ?? [] + expect(versions.length).toBeGreaterThan(0) + for (const version of versions) { + expect( + semver.gte(version, '1.31.0'), + `@modelcontextprotocol/sdk@${version} is below the patched 1.31.0`, + ).toBe(true) + } + }) }) describe('supply chain — every workflow installs with --frozen-lockfile', () => { diff --git a/languages/typescript/packages/wizard/package.json b/languages/typescript/packages/wizard/package.json index f27b9333e..21235bfe2 100644 --- a/languages/typescript/packages/wizard/package.json +++ b/languages/typescript/packages/wizard/package.json @@ -34,6 +34,7 @@ "@anthropic-ai/sdk": "^0.117.1", "@cipherstash/auth": "workspace:*", "@clack/prompts": "1.7.0", + "@modelcontextprotocol/sdk": "^1.32.0", "dotenv": "17.4.2", "pg": "8.23.0", "picocolors": "^1.1.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 092fe353f..1a7e1e904 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -765,7 +765,7 @@ importers: dependencies: '@anthropic-ai/claude-agent-sdk': specifier: ^0.3.234 - version: 0.3.234(@anthropic-ai/sdk@0.117.1(zod@3.25.76))(@modelcontextprotocol/sdk@1.29.0(zod@3.25.76))(zod@3.25.76) + version: 0.3.234(@anthropic-ai/sdk@0.117.1(zod@3.25.76))(@modelcontextprotocol/sdk@1.32.0(zod@3.25.76))(zod@3.25.76) '@anthropic-ai/sdk': specifier: ^0.117.1 version: 0.117.1(zod@3.25.76) @@ -775,6 +775,9 @@ importers: '@clack/prompts': specifier: 1.7.0 version: 1.7.0 + '@modelcontextprotocol/sdk': + specifier: ^1.32.0 + version: 1.32.0(zod@3.25.76) dotenv: specifier: 17.4.2 version: 17.4.2 @@ -1460,8 +1463,8 @@ packages: '@manypkg/get-packages@1.1.3': resolution: {integrity: sha512-fo+QhuU3qE/2TQMQmbVMqaQ6EWbMhi4ABWP+O4AM1NqPBuy0OrApV5LO6BrrgnhtAHS2NH6RrVk9OL181tTi8A==} - '@modelcontextprotocol/sdk@1.29.0': - resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==} + '@modelcontextprotocol/sdk@1.32.0': + resolution: {integrity: sha512-8BviX/hK4Gd2eL1KdTwm0gfl4d3wdoErW0Jd00h6nomUAtk6IJk5vwQJc6kfWtJTzN5OEV/lgIiJKI8fiDGAlA==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -3634,10 +3637,10 @@ snapshots: '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.234': optional: true - '@anthropic-ai/claude-agent-sdk@0.3.234(@anthropic-ai/sdk@0.117.1(zod@3.25.76))(@modelcontextprotocol/sdk@1.29.0(zod@3.25.76))(zod@3.25.76)': + '@anthropic-ai/claude-agent-sdk@0.3.234(@anthropic-ai/sdk@0.117.1(zod@3.25.76))(@modelcontextprotocol/sdk@1.32.0(zod@3.25.76))(zod@3.25.76)': dependencies: '@anthropic-ai/sdk': 0.117.1(zod@3.25.76) - '@modelcontextprotocol/sdk': 1.29.0(zod@3.25.76) + '@modelcontextprotocol/sdk': 1.32.0(zod@3.25.76) zod: 3.25.76 optionalDependencies: '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.234 @@ -4157,7 +4160,7 @@ snapshots: globby: 11.1.0 read-yaml-file: 1.1.0 - '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)': + '@modelcontextprotocol/sdk@1.32.0(zod@3.25.76)': dependencies: '@hono/node-server': 1.19.17(hono@4.13.13) ajv: 8.20.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index cdb68f87e..1ed5cd131 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -66,6 +66,10 @@ catalogs: # pnpm overrides rewrite peer ranges, not peer resolutions. It is fixed by an # explicit dependency in languages/typescript/packages/wizard — that dep is a peer-resolution pin # (wizard never imports the sdk directly); do not remove it as "unused". +# The same applies to @modelcontextprotocol/sdk (alert #247, +# GHSA-6qxp-vccf-f47h / CVE-2026-104850, patched 1.31.0): another auto-installed +# peer of claude-agent-sdk (`^1.29.0`), pinned by the same kind of explicit +# wizard dependency. overrides: # #96, #115-#127 — Next.js middleware bypass / SSRF / DoS / XSS batch # (GHSA-267c-6grr-h53f, GHSA-26hh-7cqf-hhc6, GHSA-36qx-fr4f-26g5, et al.) From 1259224bd4508039015fb160b55bb8076c44cbbf Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Mon, 12 Oct 2026 17:14:12 +1100 Subject: [PATCH 2/3] docs(changeset): clarify @modelcontextprotocol/sdk patch wording --- .changeset/wizard-mcp-sdk-security-pin.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.changeset/wizard-mcp-sdk-security-pin.md b/.changeset/wizard-mcp-sdk-security-pin.md index 1e7f2c01b..96eba07d6 100644 --- a/.changeset/wizard-mcp-sdk-security-pin.md +++ b/.changeset/wizard-mcp-sdk-security-pin.md @@ -5,5 +5,5 @@ Add `@modelcontextprotocol/sdk` `^1.32.0` as a direct dependency so the auto-installed peer of `@anthropic-ai/claude-agent-sdk` resolves to a release patched against GHSA-6qxp-vccf-f47h / CVE-2026-104850, instead of the vulnerable -1.29.0 the peer range (`^1.29.0`) alone would select. The wizard never imports -the MCP SDK directly — this is a peer-resolution pin only; no behaviour change. +1.29.0 previously locked. The wizard never imports the MCP SDK directly — this +is a peer-resolution pin only; no API change. From 9fc3b553c38a0ef1c5d486dc1317c8c6105d9f5f Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Tue, 13 Oct 2026 16:22:39 +1100 Subject: [PATCH 3/3] style: format supply-chain e2e test --- e2e/tests/supply-chain.e2e.test.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/e2e/tests/supply-chain.e2e.test.ts b/e2e/tests/supply-chain.e2e.test.ts index 8f187cd8d..737021820 100644 --- a/e2e/tests/supply-chain.e2e.test.ts +++ b/e2e/tests/supply-chain.e2e.test.ts @@ -297,7 +297,8 @@ describe('supply chain — pnpm-lock.yaml integrity', () => { // depends on @modelcontextprotocol/sdk@^1.32.0 to force the auto-installed // peer of @anthropic-ai/claude-agent-sdk past the advisory-vulnerable range // (GHSA-6qxp-vccf-f47h / CVE-2026-104850, patched 1.31.0). - const versions = resolvedVersionsByName().get('@modelcontextprotocol/sdk') ?? [] + const versions = + resolvedVersionsByName().get('@modelcontextprotocol/sdk') ?? [] expect(versions.length).toBeGreaterThan(0) for (const version of versions) { expect(