Patch 20 transitive advisories to zero - #325
Conversation
GitHub reported 20 open Dependabot alerts on main (7 high, 11 moderate, 2 low) across eight packages: fast-uri, ip-address, hono, @hono/node-server, undici, qs, body-parser. None are direct dependencies of jedit. Every one arrives through @modelcontextprotocol/sdk, which pulls in express, ajv, express-rate-limit and a Hono HTTP server. #294 bumped hono to 4.12.31 but the advisories require 4.12.34, so it closed none of them. This is a lockfile-only change -- no package.json edit, so no semver range moves and no breaking upgrade. npm audit reports 0 vulnerabilities of any severity afterwards. npm run check: 808 tests, 796 pass, 0 fail, quality regressions none.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Summary
GitHub reported 20 open Dependabot alerts on main — 7 high, 11 moderate, 2 low — across eight packages. This closes all of them with a lockfile-only change: no
package.jsonedit, so no semver range moves and no breaking upgrade.npm auditreports 0 vulnerabilities of any severity afterwards.Where they came from
None are direct dependencies of jedit. Every one arrives through a single door —
@modelcontextprotocol/sdk, which pulls inexpress,ajv,express-rate-limitand a Hono HTTP server:Worth noting #294 bumped
hono4.12.23 → 4.12.31, but the advisories require 4.12.34 — so it closed none of them.Follow-up worth discussing (not done here)
@modelcontextprotocol/sdkis declared in jedit'sdependenciesbut imported nowhere — no source import, nodistreference, no dynamic import, no script. Dropping the direct declaration would be correct hygiene.It would not reduce attack surface, though:
@flyingrobots/graft@0.11.1depends on@modelcontextprotocol/sdk@^1.29.0, so the whole HTTP-server tree arrives through graft either way. Genuinely shrinking the surface for a terminal editor means addressing it in graft. Flagging rather than acting.Verification
npm run check— 808 tests, 796 pass, 0 fail, quality regressions none.