From 225ffe86d7af8e6ee9d655e892ba35621531ba6f Mon Sep 17 00:00:00 2001 From: sjungwon03 <> Date: Wed, 29 Jul 2026 00:31:28 +0900 Subject: [PATCH 1/5] ci: require verified dev-to-main promotions --- .github/workflows/release-promotion.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/release-promotion.yml diff --git a/.github/workflows/release-promotion.yml b/.github/workflows/release-promotion.yml new file mode 100644 index 0000000..2f2b40f --- /dev/null +++ b/.github/workflows/release-promotion.yml @@ -0,0 +1,23 @@ +name: Release promotion + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +jobs: + release-promotion: + name: release-promotion + runs-on: ubuntu-latest + steps: + - name: Require dev as the promotion source + run: test "${{ github.head_ref }}" = "dev" + - uses: actions/checkout@v5 + - uses: actions/setup-node@v5 + with: + node-version: 22 + cache: npm + - run: npm ci + - run: npm run check From 3155e9cb56d845aa54bb6819eac9cf28548be993 Mon Sep 17 00:00:00 2001 From: Jungwon Sohn Date: Wed, 29 Jul 2026 02:38:52 +0900 Subject: [PATCH 2/5] fix: pin examples MCP SDK to audited graph (#3) Co-authored-by: sjungwon03 <> --- .github/workflows/verify.yml | 1 + README.md | 7 ++++++ package-lock.json | 16 ++++++------- package.json | 8 ++++++- test/dependency-security.test.ts | 39 ++++++++++++++++++++++++++++++++ 5 files changed, 62 insertions(+), 9 deletions(-) create mode 100644 test/dependency-security.test.ts diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 3f9e520..ea34350 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -25,3 +25,4 @@ jobs: - run: npm run example:policy - run: npm run example:typemcp - run: npm run example:bridge + - run: npm run audit:prod diff --git a/README.md b/README.md index 02c8cdf..567c56a 100644 --- a/README.md +++ b/README.md @@ -30,12 +30,19 @@ These examples show declaration and adapter boundaries, not a full hosted applic - The bridge is in-process only. It adapts a decorated TypeMCP class to LangChain tools; it does not create an MCP client or network connection. - No model provider is configured. Add a model only in your application after deciding its credentials, authorization, and runtime policy. +## Dependency-security boundary + +The published `@theorvane/type-mcp` package currently exact-pins an MCP SDK release whose transitive `@hono/node-server` graph is affected by [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9). This **examples application** uses an npm `overrides` entry to resolve its lockfile to `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the resulting production graph. + +This override is intentionally scoped to this repository and is **not a remediation for downstream TypeMCP consumers**. The package-level remediation remains tracked in [Theorvane/type-mcp#93](https://github.com/Theorvane/type-mcp/issues/93). + ## Development ```bash npm run lint npm run build npm test +npm run audit:prod npm run check ``` diff --git a/package-lock.json b/package-lock.json index 4e67c10..3525ab6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -674,12 +674,12 @@ } }, "node_modules/@hono/node-server": { - "version": "1.19.17", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz", - "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==", + "version": "2.0.12", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.12.tgz", + "integrity": "sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==", "license": "MIT", "engines": { - "node": ">=18.14.1" + "node": ">=20" }, "peerDependencies": { "hono": "^4" @@ -815,12 +815,12 @@ "license": "MIT" }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.26.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz", - "integrity": "sha512-Y5RmPncpiDtTXDbLKswIJzTqu2hyBKxTNsgKqKclDbhIgg1wgtf1fRuvxgTnRfcnxtvvgbIEcqUOzZrJ6iSReg==", + "version": "1.30.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", + "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", "license": "MIT", "dependencies": { - "@hono/node-server": "^1.19.9", + "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", diff --git a/package.json b/package.json index 2780dc9..3241cc3 100644 --- a/package.json +++ b/package.json @@ -8,8 +8,9 @@ "node": ">=20" }, "scripts": { + "audit:prod": "npm audit --omit=dev --audit-level=low", "build": "tsc --noEmit", - "check": "npm run format:check && npm run build && npm test", + "check": "npm run format:check && npm run build && npm test && npm run audit:prod", "example:typechain": "tsx examples/typechain-tool-definition.ts", "example:policy": "tsx examples/typechain-policy-guard.ts", "example:typemcp": "tsx examples/typemcp-server-definition.ts", @@ -32,5 +33,10 @@ "tsx": "^4.21.0", "typescript": "^5.9.3", "vitest": "^4.1.0" + }, + "overrides": { + "@theorvane/type-mcp": { + "@modelcontextprotocol/sdk": "1.30.0" + } } } diff --git a/test/dependency-security.test.ts b/test/dependency-security.test.ts new file mode 100644 index 0000000..076de06 --- /dev/null +++ b/test/dependency-security.test.ts @@ -0,0 +1,39 @@ +import { readFileSync } from "node:fs"; +import { resolve } from "node:path"; +import { fileURLToPath } from "node:url"; +import { describe, expect, it } from "vitest"; + +const repositoryRoot = resolve(fileURLToPath(new URL("..", import.meta.url))); + +type Lockfile = { + readonly packages: Record; +}; + +describe("production dependency security", () => { + it("pins the examples application to the audited MCP SDK graph", () => { + const packageJson = JSON.parse( + readFileSync(resolve(repositoryRoot, "package.json"), "utf8"), + ) as { + readonly overrides?: { + readonly "@theorvane/type-mcp"?: { + readonly "@modelcontextprotocol/sdk"?: string; + }; + }; + }; + const lockfile = JSON.parse( + readFileSync(resolve(repositoryRoot, "package-lock.json"), "utf8"), + ) as Lockfile; + + expect( + packageJson.overrides?.["@theorvane/type-mcp"]?.[ + "@modelcontextprotocol/sdk" + ], + ).toBe("1.30.0"); + expect( + lockfile.packages["node_modules/@modelcontextprotocol/sdk"]?.version, + ).toBe("1.30.0"); + expect(lockfile.packages["node_modules/@hono/node-server"]?.version).toBe( + "2.0.12", + ); + }); +}); From db7088f3b4e820f2a1083255c779efdf65875ad6 Mon Sep 17 00:00:00 2001 From: Jungwon Sohn Date: Wed, 29 Jul 2026 09:07:42 +0900 Subject: [PATCH 3/5] fix(deps): adopt TypeMCP 0.2.2 remediation (#7) --- README.md | 6 ++---- package-lock.json | 11 ++++++----- package.json | 7 +------ test/dependency-security.test.ts | 14 ++++---------- 4 files changed, 13 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index 567c56a..9bc6131 100644 --- a/README.md +++ b/README.md @@ -32,9 +32,7 @@ These examples show declaration and adapter boundaries, not a full hosted applic ## Dependency-security boundary -The published `@theorvane/type-mcp` package currently exact-pins an MCP SDK release whose transitive `@hono/node-server` graph is affected by [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9). This **examples application** uses an npm `overrides` entry to resolve its lockfile to `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the resulting production graph. - -This override is intentionally scoped to this repository and is **not a remediation for downstream TypeMCP consumers**. The package-level remediation remains tracked in [Theorvane/type-mcp#93](https://github.com/Theorvane/type-mcp/issues/93). +These examples use the published `@theorvane/type-mcp@^0.2.2` remediation. Its consumer-enforceable dependency contract resolves `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the installed production graph with no local npm override. ## Development @@ -49,7 +47,7 @@ npm run check ## Packages - [`@theorvane/type-chain`](https://www.npmjs.com/package/@theorvane/type-chain) `0.1.1` -- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.0` +- [`@theorvane/type-mcp`](https://www.npmjs.com/package/@theorvane/type-mcp) `0.2.2` or later within the `0.2.x` range ## License diff --git a/package-lock.json b/package-lock.json index 3525ab6..fe0b1eb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,7 +10,7 @@ "dependencies": { "@langchain/core": "^1.2.3", "@theorvane/type-chain": "^0.1.1", - "@theorvane/type-mcp": "^0.2.0", + "@theorvane/type-mcp": "^0.2.2", "langchain": "^1.5.4", "zod": "^4.4.3" }, @@ -1216,12 +1216,13 @@ } }, "node_modules/@theorvane/type-mcp": { - "version": "0.2.1", - "resolved": "https://registry.npmjs.org/@theorvane/type-mcp/-/type-mcp-0.2.1.tgz", - "integrity": "sha512-PafubwBhNu9b4nhsT0YX4gZRyiRQtqYmm2hKBPmd9xXG7NX87lOiAEXnkwfWsUwjf0bS88kHdNt3NRhY+/kPvw==", + "version": "0.2.2", + "resolved": "https://registry.npmjs.org/@theorvane/type-mcp/-/type-mcp-0.2.2.tgz", + "integrity": "sha512-Oj7ZNnJsC0SWdXrCiUNMfd3HYLtBkm7rNyL5xSsvVkUvowoTT+f+5ojl6Lq0DMLeKuMMRwFIMimwdzT35MWI2w==", "license": "MIT", "dependencies": { - "@modelcontextprotocol/sdk": "1.26.0", + "@hono/node-server": "2.0.12", + "@modelcontextprotocol/sdk": "1.30.0", "zod": "^4.4.3" }, "engines": { diff --git a/package.json b/package.json index 3241cc3..afe6f62 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "dependencies": { "@langchain/core": "^1.2.3", "@theorvane/type-chain": "^0.1.1", - "@theorvane/type-mcp": "^0.2.0", + "@theorvane/type-mcp": "^0.2.2", "langchain": "^1.5.4", "zod": "^4.4.3" }, @@ -33,10 +33,5 @@ "tsx": "^4.21.0", "typescript": "^5.9.3", "vitest": "^4.1.0" - }, - "overrides": { - "@theorvane/type-mcp": { - "@modelcontextprotocol/sdk": "1.30.0" - } } } diff --git a/test/dependency-security.test.ts b/test/dependency-security.test.ts index 076de06..c557313 100644 --- a/test/dependency-security.test.ts +++ b/test/dependency-security.test.ts @@ -10,25 +10,19 @@ type Lockfile = { }; describe("production dependency security", () => { - it("pins the examples application to the audited MCP SDK graph", () => { + it("uses the published TypeMCP remediation without a local override", () => { const packageJson = JSON.parse( readFileSync(resolve(repositoryRoot, "package.json"), "utf8"), ) as { - readonly overrides?: { - readonly "@theorvane/type-mcp"?: { - readonly "@modelcontextprotocol/sdk"?: string; - }; + readonly dependencies?: { + readonly "@theorvane/type-mcp"?: string; }; }; const lockfile = JSON.parse( readFileSync(resolve(repositoryRoot, "package-lock.json"), "utf8"), ) as Lockfile; - expect( - packageJson.overrides?.["@theorvane/type-mcp"]?.[ - "@modelcontextprotocol/sdk" - ], - ).toBe("1.30.0"); + expect(packageJson.dependencies?.["@theorvane/type-mcp"]).toBe("^0.2.2"); expect( lockfile.packages["node_modules/@modelcontextprotocol/sdk"]?.version, ).toBe("1.30.0"); From eff78edf5d100e1ce7fa99ac6a63d3cd8ed75853 Mon Sep 17 00:00:00 2001 From: Jungwon Sohn Date: Wed, 29 Jul 2026 09:22:06 +0900 Subject: [PATCH 4/5] chore: reconcile main release history into dev (#11) * release: publish verified TypeChain and TypeMCP examples (#1) Co-authored-by: sjungwon03 <> * release: promote audited MCP SDK graph to production (#5) * ci: require verified dev-to-main promotions * fix: pin examples MCP SDK to audited graph (#3) Co-authored-by: sjungwon03 <> --------- Co-authored-by: sjungwon03 <> * fix: retain published TypeMCP dependency contract From 654bffa64179dcf58f1143fa3812323dd3417518 Mon Sep 17 00:00:00 2001 From: sjungwon03 Date: Wed, 29 Jul 2026 09:29:30 +0900 Subject: [PATCH 5/5] fix: remove obsolete reconciliation override --- package.json | 5 ----- 1 file changed, 5 deletions(-) diff --git a/package.json b/package.json index ec88e32..afe6f62 100644 --- a/package.json +++ b/package.json @@ -33,10 +33,5 @@ "tsx": "^4.21.0", "typescript": "^5.9.3", "vitest": "^4.1.0" - }, - "overrides": { - "@theorvane/type-mcp": { - "@modelcontextprotocol/sdk": "1.30.0" - } } }