modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore: clear all runtime dependency vulnerabilities; 2.0.0-rc.2 (#1837)
Some checks failed
Run install, format, lint, build, and test on every push / build (push) Has been cancelled
Details
Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
Details
Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
Details

Browse source 
Sweeps every Dependabot alert that reaches users, then bumps to rc.2 so the
swept tree gets the same live-registry validation rc.1 got. Deliberate: rc.1
validated a specific dependency tree, and changing it invalidates that proof.

Result: **zero prod-scope high/critical vulnerabilities** across all five
manifests (root + four clients).

Achieved with lockfile changes ONLY — no package.json touched, no declared
range widened, no major upgrade. Every one of these was a stale lockfile pin
sitting inside an existing caret range:

  hono             → 4.12.32  (needed 4.12.27)
  fast-uri         → 3.1.4    (needed 3.1.3)
  postcss          → 8.5.23   (needed 8.5.18)
  brace-expansion  → 1.1.16   (needed 1.1.16)
  js-yaml          → 4.3.0    (needed 4.3.0)
  ws               → 8.21.0/1 (needed 8.21.0)
  flatted          → 3.4.3    (needed 3.4.2)

Two dev-scope clusters remain, both deliberately untouched — neither ships (the
`files` allowlist is `clients/*/build`, `clients/web/dist`, and
`scripts/install-clients.mjs`), and both need real work that does not belong
immediately before a release:

- eslint (5 alerts × 5 lockfiles): a `brace-expansion` DoS via `minimatch`,
  fixable only by eslint@10 — a major bump across every package, likely
  requiring rule migration. The glob patterns involved come from the repo's own
  config, never attacker-controlled.
- vitest (3 critical, clients/web): a circular exact-pin knot —
  `@vitest/browser-playwright@4.1.0` requires `@vitest/browser@"4.1.0"` exactly,
  `vitest@4.1.0` requires `@vitest/browser-playwright@"4.1.0"` exactly, and
  `@storybook/addon-vitest` constrains the set further. `npm i` fails ERESOLVE;
  untangling means moving Storybook too.

`npm run ci` passes on the swept tree — full chain including the coverage gate,
build gate, smokes, and 462 Storybook tests.


Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-07-28 01:59:00 -04:00 • committed by GitHub
commit d5e35b52ee
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 515 additions and 468 deletions
Download patch file Download diff file Expand all files Collapse all files

2
package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector",
"version": "2.0.0-rc.1",
"version": "2.0.0-rc.2",
"description": "The Model Context Protocol Inspector",
"keywords": [
"MCP",