0588ec098e
Real fixes (deps): - python (git/fetch/time): idna 3.10->3.18 (GHSA-65pc), starlette 0.49.1->1.3.1 (GHSA-86qp) - npm: vitest ^2.1.8->^4.1.8 (critical GHSA-5xrq UI server RCE). vitest 4 pulls vite 8 (rolldown, no esbuild), clearing the esbuild/vite advisories natively. Remaining root overrides: qs>=6.15.2 (GHSA-q8mj, via express), hono>=4.12.21 (via @modelcontextprotocol/sdk). - npm audit: 0 vulnerabilities; all TS (313) + Python (git/fetch/time) suites and TS builds pass. Hardening (git_add): - The repo already mitigates CVE-2026-27735 by using repo.git.add (the git CLI rejects out-of-tree paths, PR #3164's fix), not repo.index.add (which did not). Add an explicit path-boundary check in git_add as defense in depth plus regression tests asserting the security invariant (out-of-tree paths are never staged), guarding against a regression to repo.index.add. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
946 B
JSON
31 lines
946 B
JSON
{
|
|
"name": "@modelcontextprotocol/servers",
|
|
"private": true,
|
|
"version": "0.6.2",
|
|
"description": "Model Context Protocol servers",
|
|
"license": "SEE LICENSE IN LICENSE",
|
|
"author": "Model Context Protocol a Series of LF Projects, LLC.",
|
|
"homepage": "https://modelcontextprotocol.io",
|
|
"bugs": "https://github.com/modelcontextprotocol/servers/issues",
|
|
"type": "module",
|
|
"workspaces": [
|
|
"src/*"
|
|
],
|
|
"files": [],
|
|
"scripts": {
|
|
"build": "npm run build --workspaces",
|
|
"watch": "npm run watch --workspaces",
|
|
"publish-all": "npm publish --workspaces --access public",
|
|
"link-all": "npm link --workspaces"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/server-everything": "*",
|
|
"@modelcontextprotocol/server-memory": "*",
|
|
"@modelcontextprotocol/server-filesystem": "*",
|
|
"@modelcontextprotocol/server-sequential-thinking": "*"
|
|
},
|
|
"overrides": {
|
|
"qs": ">=6.15.2",
|
|
"hono": ">=4.12.21"
|
|
}
|
|
}
|