fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x, clearing the last two runtime advisories - #68
Conversation
…st two runtime advisories @hono/node-server is not a direct dependency. it is pinned by @modelcontextprotocol/sdk, which declared ^1.19.9 through 1.29.0, so forcing 2.x onto the old sdk would mean overriding a dependency own declared range. that is the shape claude-workstation#554 documents, where a patched version broke its consumer while npm audit reported zero vulnerabilities and 195 of 195 tests passed. sdk 1.30.0, published 2026-07-27, widened the range to ^1.19.9 || ^2.0.5. the root already declares ^1.0.0, so both moves are reachable with npm update --package-lock-only and no manifest edit. the peer @modelcontextprotocol/sdk ^1.29.0 from @anthropic-ai/claude-agent-sdk is still satisfied. @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 @hono/node-server 1.19.14 -> 2.0.12 audit, dev scope included: main 7 (3 high, 2 mod), here 5 (3 high, 0 mod). both moderates clear, since the sdk was only ever flagged transitively via @hono/node-server. this repo has no test suite (#64), so a green build proves nothing about runtime. spawned the built binary over stdio and completed a real MCP handshake: initialize returns wave-mcp-server protocol 2025-06-18 and tools/list still enumerates all 18 tools. src/server.ts imports only StdioServerTransport, so node-server sits off this code path entirely. build, tsc --noEmit and eslint all clean. CI cannot run.
|
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_b916bc9e-2d4d-46e3-bef4-71ffb3ea7f30) |
|
Companion PR opened on the other repo carrying the same two-package move: wave-av/sdks#50 (closes wave-av/sdks#49). One deliberate difference, flagged so it doesn't read as an oversight. sdks#50 also narrows a manifest range, The reason is that a declared range only protects downstream consumers of a published package, and these two repos differ on that point. If #66 lands and this repo later becomes the genuine publisher, the range should be narrowed here too. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_3d8de40f-0968-46a1-9971-0b76d861aa4f) |
|
No reviewable files after applying ignore patterns. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_2e95c509-63ec-4275-a331-3ae2592412bd) |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 1 potential issue.
⚠️ 1 issue in files not directly in the diff
⚠️ Package still claims to support Node 18 while a newly pulled-in dependency requires Node 20 (package-lock.json:773-779)
The dependency tree now resolves to a library that requires Node 20 or newer (@hono/node-server 2.0.12 with "node": ">=20" at package-lock.json:772-780) while the project keeps advertising support for Node 18 ("node": ">=18.0.0" in package.json), so anyone installing or running it on Node 18 gets engine warnings and possibly a broken runtime.
Impact: Users on Node 18, which the project still says it supports, may see install warnings or failures at runtime.
How the transitive engine requirement is introduced
The lockfile bumps @modelcontextprotocol/sdk to 1.30.0, whose dependency range for @hono/node-server becomes ^1.19.9 || ^2.0.5 (package-lock.json:895). npm resolves the highest satisfying version, 2.0.12, which declares engines.node >= 20. The MCP SDK dependency is not optional, so it is installed for every consumer of @wave-av/mcp-server. Meanwhile package.json still declares engines: { node: ">=18.0.0" }. With engine-strict enabled (or in CI images pinned to Node 18) installation fails; otherwise it warns with EBADENGINE and any Node 20+ API used by node-server 2 will fail at runtime. Either bump the declared minimum Node version to 20 (and note it in CHANGELOG.md) or pin the transitive dependency to the 1.x line.
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
ApprovabilityVerdict: Approved 4c25f01 Lockfile-only dependency update to clear security advisories. Changes are limited to package-lock.json version bumps with no application code modifications, and the author owns this file. You can customize Macroscope's approvability policy. Learn more. |
1 participant
Clears the last two runtime-scope advisories on this repo, lockfile only.
The interesting part: why this needs no
overrides@hono/node-serveris not a direct dependency. It's pinned by the MCP SDK:So the obvious remediation — force 2.0.5 with an
overridesentry — would mean overriding a dependency's own declared range. That's exactly the failure documented in claude-workstation#554, where the "fix" broke the consumer whilenpm auditreported 0 vulnerabilities and 195/195 tests passed.It isn't necessary.
@modelcontextprotocol/sdk@1.30.0, published 2026-07-27, widened its range to^1.19.9 || ^2.0.5. The root already declares^1.0.0, so both moves come fromnpm update --package-lock-onlywith no manifest edit at all:NODE_ENV=development npm update @modelcontextprotocol/sdk --package-lock-only NODE_ENV=development npm update @hono/node-server --package-lock-only git status --short # → " M package-lock.json" (nothing else)Eight lines of lockfile. The peer requirement
@modelcontextprotocol/sdk@^1.29.0from@anthropic-ai/claude-agent-sdk@0.3.168is still satisfied.Advisory delta
Dev scope included, against
main@a199245:mainBoth moderates clear together because
@modelcontextprotocol/sdkwas only ever flagged transitively —via: ["@hono/node-server"]. One root cause, two entries.Verified against runtime, not just the build
This repo has no test suite (#64), so build + type-check green is precisely the evidence #554 proved worthless. So I spawned the actual built binary over stdio and completed a real MCP handshake:
main(SDK 1.29.0 / node-server 1.19.14)initializewave-mcp-server, protocol2025-06-18tools/listByte-identical behaviour on the exercised surface. Plus
npm run build→ success,tsc --noEmit→ clean,eslint --max-warnings 0→ clean.Reachability note that lowers the risk further:
src/server.tsimports onlyStdioServerTransport. This repo never constructs an HTTP transport, so@hono/node-serveris present in the tree but sits off the code path entirely — the major bump has no exercised surface here at all.Measurement caveat
npm auditin this environment inheritsomit=devfromNODE_ENV=production, silently reporting 5 advisories instead of 7 and hiding the dev-scope entries. Every figure above was taken withNODE_ENV=developmentset explicitly.What's left after this
With #59 (hono), #58 (fast-uri), #55 (body-parser), #67 (brace-expansion) and this one, the repo goes from 14 open Dependabot alerts to 1:
esbuild0.27.3 - 0.28.0, low, dev-only. Same class as the dev-only tail on wave-av/sdks#48.Supersedes the need for a mcp-server equivalent of wave-av/sdks#49, which described this bump as needing a breaking-change assessment — that was true against SDK 1.29.0 and stopped being true when 1.30.0 shipped.
CI cannot run — Actions are refusing every job org-wide on an account-level billing lock (
plan=free,locked=yes, confirmed live this morning onadkanddispatch-edge). All verification above is local.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is enabled.Note
Low Risk
Lockfile-only transitive bump with no source changes;
@hono/node-serveris unused because the server only uses stdio transport.Overview
Lockfile-only dependency update that clears the last two runtime-scope advisories—no
package.jsonor source changes.Bumps
@modelcontextprotocol/sdk1.29.0 → 1.30.0, which widens its@hono/node-serverrange to^1.19.9 || ^2.0.5, allowing the transitive package to resolve to 2.0.12 (from 1.19.14) without overrides.@hono/node-serverremains unused on this repo's code path (StdioServerTransportonly), so the major bump has no exercised surface here.Reviewed by Cursor Bugbot for commit 4c25f01. Configure here.
Summary by cubic
Lockfile-only bump to
@modelcontextprotocol/sdk1.30.0 so@hono/node-serverresolves to 2.x, clearing the last two runtime advisories. Verified by running the built stdio server and completing an MCP handshake; no workers/routes changed and no billing impact.@modelcontextprotocol/sdk1.29.0 → 1.30.0 (widens@hono/node-serverto^1.19.9 || ^2.0.5)@hono/node-server1.19.14 → 2.0.12 (Node>=20)Written for commit 4c25f01. Summary will update on new commits.
Note
Upgrade SDK to 1.30.0 to unblock @hono/node-server 2.x and clear runtime advisories
Updates
package-lock.jsonto reflect the SDK 1.30.0 dependency bump, which resolves compatibility with@hono/node-server2.x and clears the remaining two runtime security advisories.Macroscope summarized 4c25f01.