Skip to content

chore: security audit fixes 2026-07-27 - #3

Merged
idapixl merged 1 commit into
masterfrom
chore/security-audit-fix-2026-07-27
Jul 27, 2026
Merged

chore: security audit fixes 2026-07-27#3
idapixl merged 1 commit into
masterfrom
chore/security-audit-fix-2026-07-27

Conversation

@idapixl

@idapixl idapixl commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Summary

Weekly security audit (2026-07-27) — lockfile-only fixes via npm audit fix.

Before → After: 1 HIGH + 3 moderate + 1 low (5 total) → 0 HIGH + 3 moderate (3 total)

Package Advisory Severity Status
fast-uri 3.0.0–3.1.3 GHSA-v2hh-gcrm-f6hx + GHSA-4c8g-83qw-93j6 — host confusion via backslash / IDN HIGH ✅ Fixed
body-parser 2.0.0–2.2.2 GHSA-v422-hmwv-36x6 — DoS via invalid limit LOW ✅ Fixed
@hono/node-server / @modelcontextprotocol/sdk / @fozikio/cortex-engine Windows-only path traversal via serve-static moderate ⚠️ Requires cortex-engine upstream release

Note on remaining moderates: The @hono/node-server path traversal only affects serve-static on Windows only. These servers run on Linux; real-world risk is zero. Durable fix requires @modelcontextprotocol/sdk to update to @hono/node-server ≥2.0.5, then a new @fozikio/cortex-engine release.

Test plan

  • npm audit count reduced 5 → 3 (1 HIGH + 1 LOW removed)
  • No test script in this repo
  • Lockfile-only diff (29 insertions, 15 deletions in package-lock.json), no package.json edits

Generated by Claude Code

npm audit fix: resolved fast-uri HIGH (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6),
body-parser LOW (GHSA-v422-hmwv-36x6). 0→3 moderate remain (all through
@fozikio/cortex-engine → @modelcontextprotocol/sdk → @hono/node-server chain;
require cortex-engine upstream release to resolve).
@idapixl
idapixl marked this pull request as ready for review July 27, 2026 16:15
Copilot AI review requested due to automatic review settings July 27, 2026 16:15

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@idapixl
idapixl merged commit ed2d541 into master Jul 27, 2026
1 check passed
@idapixl
idapixl deleted the chore/security-audit-fix-2026-07-27 branch July 27, 2026 22:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants