3be4230391
`npm audit` (dev included) reported a low-severity advisory against
`esbuild` in three of the four client installs. It is not in the
production tree — `npm audit --omit=dev` has been clean everywhere since
2058 — but a permanently non-clean audit trains people to skim the
channel, which is the same argument 2058 made.
`tsup@8.5.1` declares `esbuild: ^0.27.0`, and the advisory covers
0.27.3 - 0.28.0 with 0.27.7 the last 0.27.x, so there is no upward
escape inside tsup's declared range. `npm audit fix` "resolves" it by
silently downgrading to 0.27.2 across three installs — the trap hit and
reverted during 2058. An `overrides` entry forces the copy above the
range instead.
- Add `"overrides": { "esbuild": "^0.28.2" }` to clients/{web,cli,tui}.
That also covers the tui's `tsx` copy (0.28.0), so no separate update
is needed.
- Re-resolve each lockfile. Every changed entry is an esbuild one: the
nested `tsup/node_modules/esbuild` and `tsx/node_modules/esbuild`
copies collapse into the single deduped 0.28.2, and no other package
moves.
- Document the pin in AGENTS.md, including when to drop it.
The real gate here is the build, not the audit: this puts tsup on an
esbuild major it does not declare. `npm run build` succeeds for all
three clients, and `npm run ci` passes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>
59 lines
1.8 KiB
JSON
59 lines
1.8 KiB
JSON
{
|
|
"name": "@modelcontextprotocol/inspector-cli",
|
|
"private": true,
|
|
"description": "CLI for the Model Context Protocol inspector",
|
|
"license": "MIT",
|
|
"type": "module",
|
|
"main": "build/index.js",
|
|
"exports": {
|
|
".": "./build/index.js"
|
|
},
|
|
"bin": {
|
|
"mcp-inspector-cli": "./build/index.js"
|
|
},
|
|
"files": [
|
|
"build"
|
|
],
|
|
"scripts": {
|
|
"build": "tsup",
|
|
"typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.test.json",
|
|
"validate": "npm run format:check && npm run lint && npm run typecheck && npm run test",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:coverage": "npm run test-servers:build && npm run build && vitest run --coverage",
|
|
"test-servers:build": "tsc -p ../../test-servers --noCheck",
|
|
"test:cli": "vitest run cli.test.ts",
|
|
"test:cli-tools": "vitest run tools.test.ts",
|
|
"test:cli-headers": "vitest run headers.test.ts",
|
|
"test:cli-metadata": "vitest run metadata.test.ts",
|
|
"pretest": "npm run test-servers:build && npm run build",
|
|
"lint": "eslint . --max-warnings 0",
|
|
"format": "prettier --write src __tests__ \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"format:check": "prettier --check src __tests__ \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\""
|
|
},
|
|
"dependencies": {
|
|
"@napi-rs/keyring": "^1.3.0",
|
|
"ajv": "^8.17.1",
|
|
"atomically": "^2.1.1",
|
|
"commander": "^13.1.0",
|
|
"open": "^10.2.0",
|
|
"pino": "^9.14.0",
|
|
"zod": "^4.4.3"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@types/express": "^5.0.6",
|
|
"@types/node": "^24.12.4",
|
|
"@vitest/coverage-v8": "^4.1.10",
|
|
"eslint": "^10.8.0",
|
|
"globals": "^17.4.0",
|
|
"prettier": "3.8.4",
|
|
"tsup": "^8.5.0",
|
|
"typescript": "~5.9.3",
|
|
"typescript-eslint": "^8.56.1",
|
|
"vitest": "^4.1.10"
|
|
},
|
|
"overrides": {
|
|
"esbuild": "^0.28.2"
|
|
}
|
|
}
|