modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
0 releases 87 tags
  • 2.0.0-rc.3 73fe059072

    fix(deps): raise vite to 8.1.5 to close three dev-server file-read advisories; 2.0.0-rc.3 (#1841)
    Some checks failed
    Run install, format, lint, build, and test on every push / build (push) Has been cancelled
    Details
    Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
    Details
    Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
    Details

    Ghost released this 2026-07-28 02:43:48 -04:00 | 1285 commits to main since this release

    The #1837 sweep moved vite to 8.0.16 in the root and tui manifests but left
    clients/web pinned at 8.0.0 — npm update reported "up to date" and only
    an explicit install would move it. That left five open advisories, three high:

    GHSA-fx2h-pf6j-xcff high server.fs.deny bypass via Windows ADS
    GHSA-v2wj-q39q-566r high server.fs.deny bypassed with queries
    GHSA-p9ff-h696-f583 high arbitrary file read via the dev server
    GHSA-v6wh-96g9-6wx3 medium launch-editor NTLMv2 hash disclosure
    GHSA-4w7w-66w2-5vf9 medium path traversal in optimized deps

    These are worth fixing rather than dismissing as "dev-only". Unlike the other
    remaining dev-scope alerts, server.fs.deny bypass is remotely triggerable: a
    malicious page can read arbitrary files from anyone running npm run dev.
    Published-package users are unaffected — they get the built dist and never
    run vite — but contributors are.

    Also raises the declared floor to ^8.1.5 in all three manifests that declare
    vite. The root previously declared ^8.0.0, which still permitted the
    vulnerable 8.0.0 on a fresh resolve, so pinning the lockfile alone would have
    left a regression path open.

    Bumped to rc.3 rather than folding this into 2.0.0: vite builds the shipped
    bundle, so changing it changes the artifact, and the tree that ships should be
    the tree that was validated against the live registry. rc.2 validated a
    different tree.

    npm run ci passes — full chain including the coverage gate, build gate,
    smokes, and 462 Storybook tests.

    Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

    Co-authored-by: Claude Opus 5 (1M context) noreply@anthropic.com

    Downloads