modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore(deps): address Copilot review round 1 on #2243

Browse source 
- `--slurp` the paginated alert feed; a bare `--paginate` emits one JSON
  array per page and `JSON.parse` rejects it past 100 open alerts.
- Put `fixedIn` in the marker and in the existing-issue lookup, so a
  second bump of one package cannot merge into the first one's issue.
- Only an authorization-shaped failure of the `automated-security-fixes`
  read becomes UNVERIFIED; a rate limit or 5xx now throws.
- Distinguish "card never added" (benign, triage picks it up) from
  "card added, field not set" — the latter finishes every group, then
  fails the run.
- Don't board an unmilestoned issue at Todo; `Incoming` <=> no milestone.
- Comment before rewriting the marker, and give the comment its own
  marker, so a failed comment cannot be skipped forever.
- Ask a direct dependency's range to be raised, not widened to `>=`.
- Test `main()` through an injected spawn, as the sibling sweep does.
- Correct the docs that named the removed release-time `npm audit fix`,
  the ones promising an unconditional guard, and the sibling sweep's
  issue body claiming security updates remain enabled.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013H6Cew3KB3jVmQ5x4Dq1sq
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-03 23:56:18 -04:00 • committed by GitHub
commit b53266bc72
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 695 additions and 117 deletions
Download patch file Download diff file Expand all files Collapse all files

14
.github/workflows/dependabot-alerts.yml vendored
View file

@ -12,8 +12,11 @@
# security PRs off there is no mergeable-against-`main` artifact and no window to
# race, so the merge guard #2060 needed has no analogue here. What replaces it is
# a precondition inside the script: `automated-security-fixes` is a repo SETTING
# and can be switched back on from the UI without a commit, so the sweep asserts
# it is still disabled and fails loudly if it is not.
# and can be switched back on from the UI without a commit, so the sweep reads it
# back and fails loudly on an explicit `enabled: true`. That read needs a
# permission `GITHUB_TOKEN` cannot hold, so with the default token it reports
# UNVERIFIED instead — see the token notes below; it is a conditional guard, not
# an invariant.
#
# ⚠️ GitHub computes the dependency graph, and therefore every alert, from the
# DEFAULT branch (`main`), while we ship from `v2/main`. Two consequences:
@ -24,9 +27,10 @@
# waiting on a milestone merge to close, so it is skipped silently.
# * A vulnerable dependency introduced on `v2/main` and not yet merged to
# `main` produces NO alert at all. No approach that consumes GitHub's alerts
# avoids that. The release-time `npm audit fix` from #2231 is a second signal
# that partially covers it; a scheduled `npm audit --audit-level=high` over
# `v2/main`'s lockfiles would close it fully and is a separable follow-up.
# avoids that. The release-time `npm audit --audit-level=high` report from
# #2231 is a second signal that partially covers it — at release time only;
# running that same report over `v2/main`'s lockfiles on a schedule would
# close it fully and is a separable follow-up.
#
# `vulnerability-alerts: read` is the one non-default permission, and
# `GITHUB_TOKEN` supports it — no PAT is needed to read the alerts themselves.