Skip to content

chore: resolve open dependabot security alerts #579

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonathannorris merged 3 commits into from
Jul 23, 2026
Merged

chore: resolve open dependabot security alerts #579

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d111926
chore: resolve open dependabot security alerts
jonathannorris Jul 22, 2026
b812ec0
fix: deduplicate js-yaml 4.x to single version by loosening direct de…
jonathannorris Jul 23, 2026
5182576
chore: add .worktrees/ to .gitignore
jonathannorris Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,3 +23,6 @@ mcp-worker/.wrangler/

# MCP Worker environment variables
.dev.vars

# git worktrees
.worktrees/
19 changes: 11 additions & 8 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
"@types/js-yaml": "4.0.9",
"@types/validator": "13.12.2",
"@zodios/core": "10.9.6",
"axios": "^1.15.2",
"axios": "^1.18.0",
"chalk": "4.1.2",
"class-transformer": "0.5.1",
"class-validator": "0.14.2",
Expand All @@ -61,7 +61,7 @@
"inquirer": "8.2.6",
"inquirer-autocomplete-prompt": "2.0.1",
"js-sha256": "0.11.0",
"js-yaml": "4.1.1",
"js-yaml": "^4.2.0",
"lodash": "4.18.1",
"minimatch": "9.0.9",
"open": "8.4.2",
Expand Down Expand Up @@ -164,8 +164,8 @@
"mcp-worker"
],
"resolutions": {
"axios@npm:^1.13.6": "^1.15.2",
"axios@npm:^1.6.0": "^1.15.2",
"axios@npm:^1.13.6": "^1.18.0",
"axios@npm:^1.6.0": "^1.18.0",
"tmp": "^0.2.6",
"shell-quote": "^1.8.4",
"yeoman-environment": "^6.0.1",
Expand All @@ -190,9 +190,10 @@
"handlebars@npm:^4.7.7": "^4.7.9",
"path-to-regexp@npm:^8.0.0": "^8.4.0",
"path-to-regexp@npm:^8.1.0": "^8.4.0",
"brace-expansion@npm:^1.1.7": "^1.1.13",
"brace-expansion@npm:^2.0.1": "^2.0.3",
"brace-expansion@npm:^2.0.2": "^2.0.3",
"brace-expansion@npm:^1.1.7": "^1.1.16",
"brace-expansion@npm:^2.0.1": "^2.1.2",
"brace-expansion@npm:^2.0.2": "^2.1.2",
"brace-expansion@npm:^5.0.5": "^5.0.7",
"picomatch@npm:^2.3.1": "^2.3.2",
"picomatch@npm:^4.0.2": "^4.0.4",
"picomatch@npm:^4.0.3": "^4.0.4",
Expand All @@ -212,6 +213,8 @@
"js-yaml@npm:^3.14.1": "^3.15.0",
"@babel/core@npm:^7.20.12": "^7.29.6",
"form-data@npm:^4.0.5": "^4.0.6",
"esbuild@npm:0.27.3": "^0.28.1"
"esbuild@npm:0.27.3": "^0.28.1",
"body-parser@npm:^2.2.1": "^2.3.0",
"js-yaml@npm:^4.1.0": "^4.2.0"
Comment on lines +217 to +218

@jonathannorris jonathannorris Jul 23, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in b812ec0: changed the direct dependency from the exact pin js-yaml: 4.2.0 to the range js-yaml: ^4.2.0. Now both the direct dep and the js-yaml@npm:^4.1.0 resolution use ^4.2.0, so Yarn deduplicates them to a single 4.3.0 instance — no two-version tree.

}
}
119 changes: 69 additions & 50 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -470,7 +470,7 @@ __metadata:
ajv: "npm:^8.18.0"
ajv-cli: "npm:^5.0.0"
ajv-formats: "npm:^3.0.1"
axios: "npm:^1.15.2"
axios: "npm:^1.18.0"
chalk: "npm:4.1.2"
class-transformer: "npm:0.5.1"
class-validator: "npm:0.14.2"
Expand All @@ -482,7 +482,7 @@ __metadata:
inquirer: "npm:8.2.6"
inquirer-autocomplete-prompt: "npm:2.0.1"
js-sha256: "npm:0.11.0"
js-yaml: "npm:4.1.1"
js-yaml: "npm:^4.2.0"
lodash: "npm:4.18.1"
minimatch: "npm:9.0.9"
nock: "npm:^13.5.6"
Expand Down Expand Up @@ -3524,14 +3524,15 @@ __metadata:
languageName: node
linkType: hard

"axios@npm:^1.15.2":
version: 1.16.0
resolution: "axios@npm:1.16.0"
"axios@npm:^1.18.0":
version: 1.18.1
resolution: "axios@npm:1.18.1"
dependencies:
follow-redirects: "npm:^1.16.0"
form-data: "npm:^4.0.5"
https-proxy-agent: "npm:^5.0.1"
proxy-from-env: "npm:^2.1.0"
checksum: 10c0/1c91a5221b77b76072026b4cc95ecdf38f7c3e33e63423abec09a85e6e9a12279637dcc9ac2ba1fc333e0c447fb3b0f46d7965acb5d7cea02d188e9c6d425c0b
checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc
languageName: node
linkType: hard

Expand Down Expand Up @@ -3648,20 +3649,20 @@ __metadata:
languageName: node
linkType: hard

"body-parser@npm:^2.2.1":
version: 2.2.2
resolution: "body-parser@npm:2.2.2"
"body-parser@npm:^2.3.0":
version: 2.3.0
resolution: "body-parser@npm:2.3.0"
dependencies:
bytes: "npm:^3.1.2"
content-type: "npm:^1.0.5"
content-type: "npm:^2.0.0"
debug: "npm:^4.4.3"
http-errors: "npm:^2.0.0"
iconv-lite: "npm:^0.7.0"
http-errors: "npm:^2.0.1"
iconv-lite: "npm:^0.7.2"
on-finished: "npm:^2.4.1"
qs: "npm:^6.14.1"
raw-body: "npm:^3.0.1"
type-is: "npm:^2.0.1"
checksum: 10c0/95a830a003b38654b75166ca765358aa92ee3d561bf0e41d6ccdde0e1a0c9783cab6b90b20eb635d23172c010b59d3563a137a738e74da4ba714463510d05137
qs: "npm:^6.15.2"
raw-body: "npm:^3.0.2"
type-is: "npm:^2.1.0"
checksum: 10c0/2a8fbbdc471b588338555a3e1a597d1eb0ad0c21cf20fdc3bac5d3f8d9c3a4b19b4163575ab852a43a5dfc0df7770ced5284f979e561f1a24c2f851ce89e695a
languageName: node
linkType: hard

Expand All @@ -3675,31 +3676,31 @@ __metadata:
languageName: node
linkType: hard

"brace-expansion@npm:^1.1.13":
version: 1.1.14
resolution: "brace-expansion@npm:1.1.14"
"brace-expansion@npm:^1.1.16":
version: 1.1.16
resolution: "brace-expansion@npm:1.1.16"
dependencies:
balanced-match: "npm:^1.0.0"
concat-map: "npm:0.0.1"
checksum: 10c0/b6fdac832bc4e36a753658c9ed052c2e1a2be221763b002df25d1efbf7d21724334e726a6cd5eadc72a4b19ec3efb632d629cc003bc9c62f7af7a7915ffa4385
checksum: 10c0/b2a915bbedbf4e45840d1fb9a4d391bbf26a79475bd134714d3cee34f1f0edb0ce982738028843be5fbaf8039429f71fa487df8c915b6065ced542c83e58fae6
languageName: node
linkType: hard

"brace-expansion@npm:^2.0.3":
version: 2.1.0
resolution: "brace-expansion@npm:2.1.0"
"brace-expansion@npm:^2.1.2":
version: 2.1.2
resolution: "brace-expansion@npm:2.1.2"
dependencies:
balanced-match: "npm:^1.0.0"
checksum: 10c0/439cedf3e23d7993b37919f1d6fdc653ec21a42437ec3e7460bea9ca8b17edf7a24a633273c31d61aa4335877cf29a443f1871814131c87997a1e6223e1f1502
checksum: 10c0/5442ecab84045d21826268bc56c81a6ef4215327ee1f5ee153f67928e93f7a915d130ecec9966623143277fa3cce036ebb50020024bcc4d78853cdd6af9a19f8
languageName: node
linkType: hard

"brace-expansion@npm:^5.0.5":
version: 5.0.6
resolution: "brace-expansion@npm:5.0.6"
"brace-expansion@npm:^5.0.7":
version: 5.0.7
resolution: "brace-expansion@npm:5.0.7"
dependencies:
balanced-match: "npm:^4.0.2"
checksum: 10c0/8c919869b90f61d533b341d3340be5ee4413232ea89b8246cbc2f38eb014f1d8182785c98a006eaf6111d02dc9eeffefdc240d5ac158625b2ed084dccd4bbf9b
checksum: 10c0/4769109c3c082de178e449a371bcad50d51ab468f644bce2dd9188efe0cf0a080ed102105d7fc8577382cedc45bad7e6443a91bf3d8102264ee8cf927dbaf205
languageName: node
linkType: hard

Expand Down Expand Up @@ -4266,6 +4267,13 @@ __metadata:
languageName: node
linkType: hard

"content-type@npm:^2.0.0":
version: 2.0.0
resolution: "content-type@npm:2.0.0"
checksum: 10c0/491539fff707d7594b0ca4fabcc084bef2a31ffa754ff0a4f80c4377e3963cff0394317f9271c24087596c97fa675bc123d61fa34ffe65b4904e7d3d3098de72
languageName: node
linkType: hard

"convert-source-map@npm:^2.0.0":
version: 2.0.0
resolution: "convert-source-map@npm:2.0.0"
Expand Down Expand Up @@ -5972,7 +5980,7 @@ __metadata:
languageName: node
linkType: hard

"http-errors@npm:^2.0.0, http-errors@npm:~2.0.1":
"http-errors@npm:^2.0.0, http-errors@npm:^2.0.1, http-errors@npm:~2.0.1":
version: 2.0.1
resolution: "http-errors@npm:2.0.1"
dependencies:
Expand Down Expand Up @@ -6016,7 +6024,7 @@ __metadata:
languageName: node
linkType: hard

"https-proxy-agent@npm:^5.0.0":
"https-proxy-agent@npm:^5.0.0, https-proxy-agent@npm:^5.0.1":
version: 5.0.1
resolution: "https-proxy-agent@npm:5.0.1"
dependencies:
Expand Down Expand Up @@ -6084,21 +6092,21 @@ __metadata:
languageName: node
linkType: hard

"iconv-lite@npm:^0.7.0, iconv-lite@npm:~0.7.0":
version: 0.7.0
resolution: "iconv-lite@npm:0.7.0"
"iconv-lite@npm:^0.7.2":
version: 0.7.2
resolution: "iconv-lite@npm:0.7.2"
dependencies:
safer-buffer: "npm:>= 2.1.2 < 3.0.0"
checksum: 10c0/2382400469071c55b6746c531eed5fa4d033e5db6690b7331fb2a5f59a30d7a9782932e92253db26df33c1cf46fa200a3fbe524a2a7c62037c762283f188ec2f
checksum: 10c0/3c228920f3bd307f56bf8363706a776f4a060eb042f131cd23855ceca962951b264d0997ab38a1ad340e1c5df8499ed26e1f4f0db6b2a2ad9befaff22f14b722
languageName: node
linkType: hard

"iconv-lite@npm:^0.7.2":
version: 0.7.2
resolution: "iconv-lite@npm:0.7.2"
"iconv-lite@npm:~0.7.0":
version: 0.7.0
resolution: "iconv-lite@npm:0.7.0"
dependencies:
safer-buffer: "npm:>= 2.1.2 < 3.0.0"
checksum: 10c0/3c228920f3bd307f56bf8363706a776f4a060eb042f131cd23855ceca962951b264d0997ab38a1ad340e1c5df8499ed26e1f4f0db6b2a2ad9befaff22f14b722
checksum: 10c0/2382400469071c55b6746c531eed5fa4d033e5db6690b7331fb2a5f59a30d7a9782932e92253db26df33c1cf46fa200a3fbe524a2a7c62037c762283f188ec2f
languageName: node
linkType: hard

Expand Down Expand Up @@ -6597,17 +6605,6 @@ __metadata:
languageName: node
linkType: hard

"js-yaml@npm:4.1.1, js-yaml@npm:^4.1.0":
version: 4.1.1
resolution: "js-yaml@npm:4.1.1"
dependencies:
argparse: "npm:^2.0.1"
bin:
js-yaml: bin/js-yaml.js
checksum: 10c0/561c7d7088c40a9bb53cc75becbfb1df6ae49b34b5e6e5a81744b14ae8667ec564ad2527709d1a6e7d5e5fa6d483aa0f373a50ad98d42fde368ec4a190d4fae7
languageName: node
linkType: hard

"js-yaml@npm:^3.15.0":
version: 3.15.0
resolution: "js-yaml@npm:3.15.0"
Expand All @@ -6620,6 +6617,17 @@ __metadata:
languageName: node
linkType: hard

"js-yaml@npm:^4.2.0":
version: 4.3.0
resolution: "js-yaml@npm:4.3.0"
dependencies:
argparse: "npm:^2.0.1"
bin:
js-yaml: bin/js-yaml.js
checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
languageName: node
linkType: hard

"jsesc@npm:^3.0.2":
version: 3.1.0
resolution: "jsesc@npm:3.1.0"
Expand Down Expand Up @@ -8960,7 +8968,7 @@ __metadata:
languageName: node
linkType: hard

"raw-body@npm:^3.0.0, raw-body@npm:^3.0.1":
"raw-body@npm:^3.0.0, raw-body@npm:^3.0.2":
version: 3.0.2
resolution: "raw-body@npm:3.0.2"
dependencies:
Expand Down Expand Up @@ -10423,6 +10431,17 @@ __metadata:
languageName: node
linkType: hard

"type-is@npm:^2.1.0":
version: 2.1.0
resolution: "type-is@npm:2.1.0"
dependencies:
content-type: "npm:^2.0.0"
media-typer: "npm:^1.1.0"
mime-types: "npm:^3.0.0"
checksum: 10c0/a6018f8f509de48f2c7429305e3a920e73b374fa93127dd0877ae1c2df65a5d33907caac8afb0c37a9b9fc7c49f29e3f55d668963dc845d966930b667c07f50e
languageName: node
linkType: hard

"typescript-eslint@npm:^8.21.0":
version: 8.37.0
resolution: "typescript-eslint@npm:8.37.0"
Expand Down
Loading