73fe059072
Some checks failed
Run install, format, lint, build, and test on every push / build (push) Has been cancelled
Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
The #1837 sweep moved vite to 8.0.16 in the root and tui manifests but left `clients/web` pinned at **8.0.0** — `npm update` reported "up to date" and only an explicit install would move it. That left five open advisories, three high: GHSA-fx2h-pf6j-xcff high `server.fs.deny` bypass via Windows ADS GHSA-v2wj-q39q-566r high `server.fs.deny` bypassed with queries GHSA-p9ff-h696-f583 high arbitrary file read via the dev server GHSA-v6wh-96g9-6wx3 medium launch-editor NTLMv2 hash disclosure GHSA-4w7w-66w2-5vf9 medium path traversal in optimized deps These are worth fixing rather than dismissing as "dev-only". Unlike the other remaining dev-scope alerts, `server.fs.deny` bypass is *remotely triggerable*: a malicious page can read arbitrary files from anyone running `npm run dev`. Published-package users are unaffected — they get the built `dist` and never run vite — but contributors are. Also raises the declared floor to `^8.1.5` in all three manifests that declare vite. The root previously declared `^8.0.0`, which still *permitted* the vulnerable 8.0.0 on a fresh resolve, so pinning the lockfile alone would have left a regression path open. Bumped to rc.3 rather than folding this into 2.0.0: vite builds the shipped bundle, so changing it changes the artifact, and the tree that ships should be the tree that was validated against the live registry. rc.2 validated a different tree. `npm run ci` passes — full chain including the coverage gate, build gate, smokes, and 462 Storybook tests. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
103 lines
3.6 KiB
JSON
103 lines
3.6 KiB
JSON
{
|
|
"name": "@modelcontextprotocol/inspector-web",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "build/index.js",
|
|
"bin": {
|
|
"mcp-inspector-web": "./build/index.js"
|
|
},
|
|
"exports": {
|
|
".": "./build/index.js"
|
|
},
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build && npm run build:runner",
|
|
"build:client": "vite build",
|
|
"build:runner": "tsup --config tsup.runner.config.ts",
|
|
"build:storybook": "storybook build",
|
|
"validate": "npm run format:check && npm run lint && npm run build && npm run test",
|
|
"pretest": "npm run test-servers:build",
|
|
"test": "vitest run --project=unit",
|
|
"test:watch": "vitest --project=unit",
|
|
"test:coverage": "npm run test-servers:build && vitest run --project=unit --project=integration --coverage",
|
|
"test:storybook": "vitest run --project=storybook",
|
|
"test:storybook:watch": "vitest --project=storybook",
|
|
"test:integration": "npm run test-servers:build && vitest run --project=integration",
|
|
"test:integration:watch": "npm run test-servers:build && vitest --project=integration",
|
|
"test-servers:build": "tsc -p ../../test-servers --noCheck",
|
|
"lint": "eslint .",
|
|
"format": "prettier --write src server .storybook \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"format:check": "prettier --check src server .storybook \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"preview": "vite preview",
|
|
"storybook": "storybook dev -p 6006"
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^8.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@emotion/react": "^11.14.0",
|
|
"@hono/node-server": "^2.0.12",
|
|
"@mantine/core": "^8.3.17",
|
|
"@mantine/form": "^8.3.17",
|
|
"@mantine/hooks": "^8.3.17",
|
|
"@mantine/notifications": "^8.3.17",
|
|
"@modelcontextprotocol/client": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/core": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/ext-apps": "^1.7.4",
|
|
"@modelcontextprotocol/server": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/server-legacy": "2.0.0-beta.5",
|
|
"@napi-rs/keyring": "^1.3.0",
|
|
"ajv": "^8.17.1",
|
|
"atomically": "^2.1.1",
|
|
"chokidar": "^4.0.3",
|
|
"commander": "^13.1.0",
|
|
"hono": "^4.12.18",
|
|
"open": "^10.2.0",
|
|
"papaparse": "^5.5.4",
|
|
"pino": "^9.14.0",
|
|
"react": "^19.2.4",
|
|
"react-dom": "^19.2.4",
|
|
"react-icons": "^5.6.0",
|
|
"react-markdown": "^10.1.0",
|
|
"react-syntax-highlighter": "^16.1.1",
|
|
"remark-gfm": "^4.0.1",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@chromatic-com/storybook": "^5.0.1",
|
|
"@eslint/js": "^9.39.4",
|
|
"@storybook/addon-a11y": "^10.2.19",
|
|
"@storybook/addon-docs": "^10.2.19",
|
|
"@storybook/addon-onboarding": "^10.2.19",
|
|
"@storybook/addon-vitest": "^10.2.19",
|
|
"@storybook/react-vite": "^10.2.19",
|
|
"@testing-library/jest-dom": "^6.9.1",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/express": "^5.0.6",
|
|
"@types/node": "^24.12.4",
|
|
"@types/papaparse": "^5.5.2",
|
|
"@types/react": "^19.2.14",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@types/react-syntax-highlighter": "^15.5.13",
|
|
"@vitejs/plugin-react": "^6.0.0",
|
|
"@vitest/browser-playwright": "^4.1.0",
|
|
"@vitest/coverage-v8": "^4.1.0",
|
|
"eslint": "^9.39.4",
|
|
"eslint-plugin-react-hooks": "^7.0.1",
|
|
"eslint-plugin-react-refresh": "^0.5.2",
|
|
"eslint-plugin-storybook": "^10.2.19",
|
|
"express": "^5.2.1",
|
|
"globals": "^17.4.0",
|
|
"happy-dom": "^20.9.0",
|
|
"playwright": "^1.58.2",
|
|
"prettier": "3.8.4",
|
|
"storybook": "^10.2.19",
|
|
"tsup": "^8.5.1",
|
|
"typescript": "~5.9.3",
|
|
"typescript-eslint": "^8.56.1",
|
|
"vite": "^8.1.5",
|
|
"vitest": "^4.1.0",
|
|
"yaml": "^2.9.0"
|
|
}
|
|
}
|