chore(deps): resolve transitive vite + esbuild security alerts via npm overrides

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.

[LSDimi]

Summary

Resolves the two remaining transitive Dependabot security alerts that the per-package Dependabot bumps couldn't reach:

• vite path traversal in optimized deps .map handling — patched in 6.4.2
• esbuild dev server arbitrary request injection — patched in 0.25.0

Both are dev-only, reaching us through vitest -> vite -> esbuild. Adds an overrides block in the root package.json and regenerates the lockfile so all transitives resolve to patched versions across all workspaces.

npm audit reports 0 vulnerabilities after this PR.

What's in this PR

1. package.json (+4 lines) — adds:

   "overrides": {
   "vite": "^6.4.2",
   "esbuild": "^0.25.0"
   }

2. package-lock.json (net -301 lines) — regenerated from scratch to apply the overrides. Net reduction comes from deduplication; no major version bumps to direct dependencies.
3. packages/mcp-server/src/server.ts (-9 lines) — drops three @ts-expect-error directives that the regenerated dep tree no longer needs. The MCP TypeScript SDK upgrade pulled in by the lockfile regen fixesmodelcontextprotocol/typescript-sdk#494 (the deep Zod type inference issue), which is exactly the removal condition the original directive comments documented (Remove when SDK fixes deep type inference for complex Zod schemas). Without removing them, tsc flags them as unused (TS2578).

Why overrides instead of bumping vitest

Bumping vitest to a major version that uses vite >= 6.4.2 natively would touch four package.json files and risk test-runtime regressions across all workspaces. overrides is the surgical fix: pin the vulnerable transitives to patched versions without changing direct dependency declarations. Same outcome, smaller blast radius.

Test plan

• npm audit → found 0 vulnerabilities
• npm run check → lint (9 pre-existing warnings, 0 errors), format:check clean, build:shared clean, typecheck clean (after @ts-expect-error cleanup), build all workspaces clean, all 103 tests pass across mcp-server (60), claude-plugin (18), shared (25)
• vite@6.4.2 and esbuild@0.25.12 confirmed installed in node_modules
• Reviewer: confirm CI green and that no test regressions surface in the matrix
• Reviewer: verify the @ts-expect-error removal is appropriate (cross-check that server.tool() calls now type-check cleanly without the suppressions)

[gemini-code-assist]

Code Review

This pull request adds dependency overrides for vite and esbuild in package.json and removes several @ts-expect-error suppressions in server.ts that were previously used to handle Zod type depth issues. A high-severity issue was identified where the specified vite version (^6.4.2) does not exist on the npm registry, which will lead to installation failures.

[gemini-code-assist]

The version ^6.4.2 for vite does not appear to exist on the npm registry. The latest stable version is currently 6.1.0. This might be a typo for 5.4.12 (the security patch for the 5.x branch) or 6.0.2 (for the 6.x branch). Since using a non-existent version will cause npm install to fail, please verify and correct the version number.

[LSDimi]

This is incorrect — vite@6.4.2 exists and is on the registry. The latest stable is currently 8.0.11, not 6.1.0 as suggested. Verification:

$ npm view vite@6.4.2 version
6.4.2
$ npm view vite versions --json | tail -6
"8.0.6", "8.0.7", "8.0.8", "8.0.9", "8.0.10", "8.0.11"

The lockfile in this PR resolves to https://registry.npmjs.org/vite/-/vite-6.4.2.tgz and CI ran a full npm install + build + 103 tests successfully across Node 20/22/24. npm audit reports 0 vulnerabilities on this branch (vs 6 on main).

Looks like a stale-training-data hallucination. Closing this thread and proceeding with merge.