73fe059072
Some checks failed
Run install, format, lint, build, and test on every push / build (push) Has been cancelled
Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
The #1837 sweep moved vite to 8.0.16 in the root and tui manifests but left `clients/web` pinned at **8.0.0** — `npm update` reported "up to date" and only an explicit install would move it. That left five open advisories, three high: GHSA-fx2h-pf6j-xcff high `server.fs.deny` bypass via Windows ADS GHSA-v2wj-q39q-566r high `server.fs.deny` bypassed with queries GHSA-p9ff-h696-f583 high arbitrary file read via the dev server GHSA-v6wh-96g9-6wx3 medium launch-editor NTLMv2 hash disclosure GHSA-4w7w-66w2-5vf9 medium path traversal in optimized deps These are worth fixing rather than dismissing as "dev-only". Unlike the other remaining dev-scope alerts, `server.fs.deny` bypass is *remotely triggerable*: a malicious page can read arbitrary files from anyone running `npm run dev`. Published-package users are unaffected — they get the built `dist` and never run vite — but contributors are. Also raises the declared floor to `^8.1.5` in all three manifests that declare vite. The root previously declared `^8.0.0`, which still *permitted* the vulnerable 8.0.0 on a fresh resolve, so pinning the lockfile alone would have left a regression path open. Bumped to rc.3 rather than folding this into 2.0.0: vite builds the shipped bundle, so changing it changes the artifact, and the tree that ships should be the tree that was validated against the live registry. rc.2 validated a different tree. `npm run ci` passes — full chain including the coverage gate, build gate, smokes, and 462 Storybook tests. Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
65 lines
1.9 KiB
JSON
65 lines
1.9 KiB
JSON
{
|
|
"name": "@modelcontextprotocol/inspector-tui",
|
|
"private": true,
|
|
"description": "Terminal User Interface (TUI) for the Model Context Protocol inspector",
|
|
"license": "MIT",
|
|
"type": "module",
|
|
"main": "build/index.js",
|
|
"exports": {
|
|
".": "./build/index.js"
|
|
},
|
|
"bin": {
|
|
"mcp-inspector-tui": "./build/index.js"
|
|
},
|
|
"files": [
|
|
"build",
|
|
"README.md"
|
|
],
|
|
"scripts": {
|
|
"dev": "vite-node --config vitest.config.ts dev.ts",
|
|
"build": "tsup",
|
|
"typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.test.json",
|
|
"validate": "npm run format:check && npm run lint && npm run typecheck && npm run build && npm run test",
|
|
"test": "vitest run",
|
|
"test:coverage": "vitest run --coverage",
|
|
"lint": "eslint .",
|
|
"format": "prettier --write src __tests__ \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
|
|
"format:check": "prettier --check src __tests__ \"*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\""
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/client": "2.0.0-beta.5",
|
|
"@modelcontextprotocol/core": "2.0.0-beta.5",
|
|
"@napi-rs/keyring": "^1.3.0",
|
|
"ajv": "^8.17.1",
|
|
"atomically": "^2.1.1",
|
|
"commander": "^13.1.0",
|
|
"ink": "^6.0.0",
|
|
"ink-form": "^2.0.1",
|
|
"ink-scroll-view": "^0.3.6",
|
|
"open": "^10.2.0",
|
|
"pino": "^9.14.0",
|
|
"react": "^19.2.4",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"overrides": {
|
|
"ink-select-input": "^6.2.0"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.39.4",
|
|
"@types/node": "^24.12.4",
|
|
"@types/react": "^19.2.14",
|
|
"@vitest/coverage-v8": "^4.1.0",
|
|
"eslint": "^9.39.4",
|
|
"eslint-plugin-react-hooks": "^7.0.1",
|
|
"globals": "^17.4.0",
|
|
"ink-testing-library": "^4.0.0",
|
|
"prettier": "3.8.4",
|
|
"tsup": "^8.5.0",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "~5.9.3",
|
|
"typescript-eslint": "^8.56.1",
|
|
"vite": "^8.1.5",
|
|
"vite-node": "^6.0.0",
|
|
"vitest": "^4.1.0"
|
|
}
|
|
}
|