modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4
0 releases 87 tags
  • 2.0.0-rc.2 d5e35b52ee

    chore: clear all runtime dependency vulnerabilities; 2.0.0-rc.2 (#1837)
    Some checks failed
    Run install, format, lint, build, and test on every push / build (push) Has been cancelled
    Details
    Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
    Details
    Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
    Details

    Ghost released this 2026-07-28 05:59:00 +00:00 | 1286 commits to main since this release

    Sweeps every Dependabot alert that reaches users, then bumps to rc.2 so the
    swept tree gets the same live-registry validation rc.1 got. Deliberate: rc.1
    validated a specific dependency tree, and changing it invalidates that proof.

    Result: zero prod-scope high/critical vulnerabilities across all five
    manifests (root + four clients).

    Achieved with lockfile changes ONLY — no package.json touched, no declared
    range widened, no major upgrade. Every one of these was a stale lockfile pin
    sitting inside an existing caret range:

    hono → 4.12.32 (needed 4.12.27)
    fast-uri → 3.1.4 (needed 3.1.3)
    postcss → 8.5.23 (needed 8.5.18)
    brace-expansion → 1.1.16 (needed 1.1.16)
    js-yaml → 4.3.0 (needed 4.3.0)
    ws → 8.21.0/1 (needed 8.21.0)
    flatted → 3.4.3 (needed 3.4.2)

    Two dev-scope clusters remain, both deliberately untouched — neither ships (the
    files allowlist is clients/*/build, clients/web/dist, and
    scripts/install-clients.mjs), and both need real work that does not belong
    immediately before a release:

    • eslint (5 alerts × 5 lockfiles): a brace-expansion DoS via minimatch,
      fixable only by eslint@10 — a major bump across every package, likely
      requiring rule migration. The glob patterns involved come from the repo's own
      config, never attacker-controlled.
    • vitest (3 critical, clients/web): a circular exact-pin knot —
      @vitest/browser-playwright@4.1.0 requires @vitest/browser@"4.1.0" exactly,
      vitest@4.1.0 requires @vitest/browser-playwright@"4.1.0" exactly, and
      @storybook/addon-vitest constrains the set further. npm i fails ERESOLVE;
      untangling means moving Storybook too.

    npm run ci passes on the swept tree — full chain including the coverage gate,
    build gate, smokes, and 462 Storybook tests.

    Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

    Co-authored-by: Claude Opus 5 (1M context) noreply@anthropic.com

    Downloads