[YahiaBakour]

The current lockfile triggers 56 Dependabot alerts across 16 packages: 2 critical, 19 high, 28 medium, and 7 low. This updates the affected direct dependencies, overrides, and transitive packages; every installed version is outside all 56 reported vulnerable ranges, and npm audit reports zero vulnerabilities.

Zod now emits primitive unions as type arrays. That broke Gemini compatibility for the brand tool's phone and MCC fields. Convert those published unions to anyOf while preserving constraints and nullability, with regression tests exercising the actual Zod output and schema acceptance.

• Keep mcp-use on 1.34.5; apply patched MCP SDK, Hono, Undici, Zod, DOMPurify, and related dependencies without a framework major upgrade.
• Override Zod globally so the CLI and inspector cannot retain vulnerable nested copies. Pin patched KaTeX 0.18.2 to retain Node 20 compatibility; later 0.18 patches pull in a Node 22-only commander.
• Run CI on Node 20 and 22 and fail on npm audit findings at any severity.

Validation:

• Local tests on Node 20 and 22, plus clean Linux npm ci, full build/type check, and npm test on both versions in GitHub Actions: 658 tests per run, 625 pass, zero failures, 33 pre-existing TODOs.
• npm ls --all: no dependency problems.
• npm audit --audit-level=low: zero vulnerabilities, including development dependencies.
• Compared every installed copy against all 56 open Dependabot advisory ranges: no affected versions remain.
• KaTeX consumers both render normal math and reject inherited trust for javascript links.
• GitHub Actions: both Node matrix jobs and all CodeQL checks passed.
• Hosted deployment passed; its preview returns healthy, completes MCP initialization, and lists all 50 tools with the repaired brand phone schema. The preview does not expose OAuth discovery; OAuth discovery, callback, refresh, and authentication behavior are covered by the passing integration suites. Existing production health and OAuth discovery endpoints also return HTTP 200.

Dependabot alerts on main should resolve after this PR is merged and GitHub rescans the dependency graph.

---

Note

Medium Risk
Dependency and override churn can affect runtime behavior (HTTP stack, validation), but changes are mostly security pins plus a schema-widening publish step with tests; CI now enforces clean audit on two Node versions.

Overview
Addresses 56 Dependabot alerts by bumping direct dependencies (hono, undici, zod) and tightening package.json overrides (MCP SDK, DOMPurify, KaTeX, ip-address, proxy-addr, nested zod, etc.), with an updated lockfile.

CI now runs tests on a Node 20 and 22 matrix with fail-fast: false and fails the job on npm audit --audit-level=low.

After the Zod upgrade, primitive unions show up as type arrays in published JSON Schema, which Gemini rejects. compactPublishedSchema gains expandTypeUnion to rewrite those into anyOf while preserving constraints and nullability; regression tests cover real Zod output and equivalence with the full validator.

^{Reviewed by Cursor Bugbot for commit 4235197. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mcp-use]

Deployment #320 deployed successfully

Status	Logs	URL	Updated
	Build Logs | Runtime Logs	🔗 MCP URL	Nov 9 2026 5:37 am

View deployment details

---

Deployed on Manufact.com