[benfrank241]

Bundles every open Dependabot alert on the root package-lock.json into one PR. Dependabot's own branches don't receive CI secrets, so this human-authored branch is the one that gets real CI.

Alerts closed (15)

Alert	Package	Severity	Advisory	Fixed in	Resolves to
#90	@modelcontextprotocol/sdk	high	GHSA-46jr-4wx8-v453 / CVE-2026-111768	1.32.0	1.32.2
#89	@modelcontextprotocol/sdk	medium	GHSA-rvq5-wwqv-78pq / CVE-2026-111771	1.32.0	1.32.2
#88	@modelcontextprotocol/sdk	medium	GHSA-6prh-2h8m-c8cw / CVE-2026-111769	1.32.0	1.32.2
#86	@modelcontextprotocol/sdk	high	GHSA-22jm-h49p-29qw / CVE-2026-111767	1.32.0	1.32.2
#78	@modelcontextprotocol/sdk	high	GHSA-6qxp-vccf-f47h / CVE-2026-104850	1.31.0	1.32.2
#83	brace-expansion (1.x)	high	GHSA-qhr7-859c-m2p7 / CVE-2026-102278	1.1.20	1.1.21
#82	brace-expansion (1.x)	high	GHSA-6j4f-fj2g-mc7p / CVE-2026-102276	1.1.19	1.1.21
#80	brace-expansion (1.x)	medium	GHSA-q2hr-2g5m-vwhr / CVE-2026-102277	1.1.21	1.1.21
#76	brace-expansion (2.x)	medium	GHSA-q2hr-2g5m-vwhr / CVE-2026-102277	2.1.7	2.1.7
#85	fast-uri	medium	GHSA-hrr3-gc8f-f4qj / CVE-2026-86472	3.1.8	3.1.9
#87	hono	medium	GHSA-5r4p-p66f-jhc7 / CVE-2026-111757	4.13.11	4.13.13
#84	ip-address	medium	GHSA-h3mg-xc3c-68pw / CVE-2026-101911	10.7.1	10.7.4
#74	ip-address	medium	GHSA-j6r3-76f7-8jcv / CVE-2026-101912	10.7.1	10.7.4
#73	ip-address	medium	GHSA-rpw4-54j3-4h4q / CVE-2026-101913	10.5.1	10.7.4
#72	ip-address	medium	GHSA-2vr4-cq9g-pvrc / CVE-2026-101910	10.5.1	10.7.4

Two more advisories that npm audit reports but that have no Dependabot alert yet are also fixed:

• body-parser 2.3.0 -> 2.4.0, GHSA-27r3-jxmh-p828 (high). The cause was our own exact-pin override.
• zod 4.3.6 -> 4.6.7, GHSA-mrhx-c7xc-m3w5 (high). This is a lockfile-only update inside the parents' ^4 range.

Changes

• Direct dependency: @modelcontextprotocol/sdk ^1.29.0 -> ^1.32.0
• overrides: four exact pins became carets. Exact pins froze these packages, and the advisories then fired against the pins themselves. All carets stay inside the current major.
  • brace-expansion@^1.1.0 1.1.18 -> ^1.1.21
  • brace-expansion@^2.0.0 2.1.4 -> ^2.1.7
  • ip-address 10.3.1 -> ^10.7.1
  • body-parser 2.3.0 -> ^2.4.0
  • fast-uri ^3.1.6 -> ^3.1.8
  • hono ^4.13.5 -> ^4.13.11
• Lockfile churn is exactly 12 package entries. Nothing was added or removed: the targets above plus iconv-lite 0.7.2 -> 0.7.3, which comes from body-parser 2.4.0's own range.

Verification (local, from ci.yml)

• npm ci passed
• npm run build exit 0
• npm run lint exit 0
• npm audit: 9 vulnerabilities before (4 moderate, 5 high), 0 after
• Import smoke test: @modelcontextprotocol/sdk/server/index.js loads.
• There is no test script, and CI runs no tests.

Not changed

@hono/node-server stays pinned at 1.19.15 because no advisory affects it. Moving to 2.x would be a major-version change and is the maintainer's call. sdk 1.32 accepts ^1.19.9 || ^2.0.5.

🤖 Generated with Claude Code