security: dependency cleanup — 0 vulnerabilities (npm audit clean) (v0.2.0) - #4
security: dependency cleanup — 0 vulnerabilities (npm audit clean) (v0.2.0)#4jamubc wants to merge 1 commit into
Conversation
…0.2.0) Closes all open Dependabot alerts by removing dead production dependencies, upgrading the MCP SDK, and patching transitive chains via overrides. Removed unused production deps (never imported in src/): - inquirer (CVE-2026-44705, HIGH — path traversal via tmp/external-editor) - ai (CVE-2026-8769, LOW — resource exhaustion in @ai-sdk/provider-utils) Removed unused devDeps: - @types/inquirer (orphaned stubs) - archiver (never imported; brought in glob/lodash/minimatch HIGH chain, 83 pkgs) Upgraded: - @modelcontextprotocol/sdk 0.5.0 → 1.29.0 (GHSA-8r9q-7v3j-jr4g HIGH — ReDoS; GHSA-w48q-cv73-mx4w HIGH — DNS rebinding) Breaking change: removed `notifications` from Server capabilities (dropped in 1.x). - mermaid ^11.9.0 → ^11.15.0 (CVE-2026-41159/41149/41148 — CSS/HTML injection) Added overrides for transitive vulnerabilities: postcss ^8.5.10, dompurify ^3.4.0, uuid ^11.1.1, rollup ^4.61.0, preact ^10.27.0, mdast-util-to-hast ^13.2.1, esbuild ^0.25.0, vite ^6.4.2 Gated timeout-test tool behind QWEN_MCP_TEST_TOOLS env var so it is not visible to end users in normal operation. No source logic changes beyond the SDK capability fix and the registry gate. npm audit: 0 vulnerabilities. tsc --noEmit: clean.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request bumps the version of qwen-mcp-tool to 0.2.0, updates dependencies (including upgrading @modelcontextprotocol/sdk to ^1.29.0 and adding dependency overrides), and removes the notifications capability. It also refactors tool registration so that the timeoutTestTool is only registered when the QWEN_MCP_TEST_TOOLS environment variable is set. Feedback was provided to explicitly check if this environment variable is equal to the string "true", as any non-empty string (like "false") would otherwise evaluate to truthy in JavaScript.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| if (process.env.QWEN_MCP_TEST_TOOLS) { | ||
| toolRegistry.push(timeoutTestTool); | ||
| } |
There was a problem hiding this comment.
In Node.js, environment variables retrieved from process.env are always strings (or undefined). Checking if (process.env.QWEN_MCP_TEST_TOOLS) will evaluate to true even if the variable is explicitly set to "false" or "0" because any non-empty string is truthy in JavaScript. To avoid registering test tools when they are explicitly disabled via QWEN_MCP_TEST_TOOLS=false, check for an explicit "true" value.
| if (process.env.QWEN_MCP_TEST_TOOLS) { | |
| toolRegistry.push(timeoutTestTool); | |
| } | |
| if (process.env.QWEN_MCP_TEST_TOOLS === "true") { | |
| toolRegistry.push(timeoutTestTool); | |
| } |
1 participant
Summary
Closes all open Dependabot alerts. Achieves 0 vulnerabilities (
npm auditclean) across the full dependency tree. No source logic changes beyond the SDK capability fix and the test-tool registry gate.Vulnerability Fixes
Direct / Production Dependencies
tmp(viainquirer)inquirerdep@ai-sdk/provider-utils(viaai)aidep@modelcontextprotocol/sdk <=1.25.10.5.0→1.29.0@modelcontextprotocol/sdk <=1.25.10.5.0→1.29.0Dev / Transitive Dependencies (overrides)
uuid <11.1.1^11.1.1rollup 4.0.0-4.58.0^4.61.0preact 10.26.5-10.26.9^10.27.0mdast-util-to-hast 13.0.0-13.2.0^13.2.1esbuild <=0.24.2^0.25.0vite <=6.4.1^6.4.2postcss <8.5.10^8.5.10dompurify <3.4.0^3.4.0mermaid <=11.14.0^11.15.0Removed Dead Dependencies
inquirer@9.0.0+@types/inquirersrc/. Brought in thetmppath-traversal chain.ai@4.3.17src/. Brought in the@ai-sdk/provider-utilsresource exhaustion chain.archiver@7.0.1glob(HIGH),lodash(HIGH),minimatch(HIGH),brace-expansion(MODERATE). 83 packages removed.Source Changes
src/index.ts— removednotifications: {}from theServercapabilities object. This key was dropped from the@modelcontextprotocol/sdk1.x API; keeping it causes a TypeScript error against the new types.src/tools/index.ts—timeoutTestToolis now gated behindprocess.env.QWEN_MCP_TEST_TOOLS. It no longer appears as a user-facing tool in normal operation.Vite Override
vitepress@1.6.3pinsvite@^5.4.14. The 5.4.x line has no backport for CVE-2026-39365 (path traversal in the dev server). The"overrides": { "vite": "^6.4.2" }entry forces the full tree to resolve to a patched version. Verified:npm run docs:buildcompletes successfully.Test Plan
npm audit— 0 vulnerabilitiestsc --noEmit— cleannpm run build— full dist buildnpm run docs:build— VitePress docs build with vite override