build(deps): resolve Bun audit advisories - #459

Merged
wyattjoh merged 1 commit into
mainfrom
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged

build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom
wyattjoh/resolve-bun-audit

Conversation

@wyattjoh

@wyattjohwyattjoh commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.

Testing

  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json

@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot

changeset-botBot commented Aug 30, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 8ba8eef

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@wyattjoh
wyattjoh marked this pull request as ready for review August 31, 2026 15:20
@wyattjoh
wyattjoh merged commit 27425ed into mainAug 31, 2026
9 of 10 checks passed
@wyattjoh
wyattjoh deleted the wyattjoh/resolve-bun-audit branch August 31, 2026 15:21
@coderabbitai

coderabbitaiBot commented Aug 31, 2026

Copy link
Copy Markdown

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d33870cc-1027-4889-912d-190d5a280f99

📥 Commits

Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.

⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📝 Walkthrough

Walkthrough

The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers:rafa-thayto

Comment @coderabbitai help to get the list of available commands.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
build(deps): resolve Bun audit advisories - #459
Merged
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged
build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Summary
  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.
Testing
  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json
@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot
changeset-botBot
commented
Aug 30, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 8ba8eef
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@wyattjoh
wyattjoh
marked this pull request as ready for review
August 31, 2026 15:20
@wyattjoh
wyattjoh
merged commit 27425ed
into
mainAug 31, 2026

9 of 10 checks passed

@wyattjoh
wyattjoh
deleted the

wyattjoh/resolve-bun-audit

branch
August 31, 2026 15:21
@coderabbitai
coderabbitaiBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Review Change Stack
Caution
Review failed
The pull request is closed.
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d33870cc-1027-4889-912d-190d5a280f99
📥 Commits
Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.
⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json
Disabled knowledge base sources:
  • Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📝 Walkthrough
Walkthrough
The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers:rafa-thayto
Comment @coderabbitai help to get the list of available commands.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): resolve Bun audit advisories - #459
Merged
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged
build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Summary
  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.
Testing
  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json
@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot
changeset-botBot
commented
Aug 30, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 8ba8eef
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@wyattjoh
wyattjoh
marked this pull request as ready for review
August 31, 2026 15:20
@wyattjoh
wyattjoh
merged commit 27425ed
into
mainAug 31, 2026

9 of 10 checks passed

@wyattjoh
wyattjoh
deleted the

wyattjoh/resolve-bun-audit

branch
August 31, 2026 15:21
@coderabbitai
coderabbitaiBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Review Change Stack
Caution
Review failed
The pull request is closed.
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d33870cc-1027-4889-912d-190d5a280f99
📥 Commits
Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.
⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json
Disabled knowledge base sources:
  • Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📝 Walkthrough
Walkthrough
The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers:rafa-thayto
Comment @coderabbitai help to get the list of available commands.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): resolve Bun audit advisories - #459
Merged
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged
build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Summary
  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.
Testing
  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json
@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot
changeset-botBot
commented
Aug 30, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 8ba8eef
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@wyattjoh
wyattjoh
marked this pull request as ready for review
August 31, 2026 15:20
@wyattjoh
wyattjoh
merged commit 27425ed
into
mainAug 31, 2026

9 of 10 checks passed

@wyattjoh
wyattjoh
deleted the

wyattjoh/resolve-bun-audit

branch
August 31, 2026 15:21
@coderabbitai
coderabbitaiBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Review Change Stack
Caution
Review failed
The pull request is closed.
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d33870cc-1027-4889-912d-190d5a280f99
📥 Commits
Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.
⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json
Disabled knowledge base sources:
  • Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📝 Walkthrough
Walkthrough
The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers:rafa-thayto
Comment @coderabbitai help to get the list of available commands.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
build(deps): resolve Bun audit advisories - #459
Merged
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged
build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Summary
  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.
Testing
  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json
@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot
changeset-botBot
commented
Aug 30, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 8ba8eef
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@wyattjoh
wyattjoh
marked this pull request as ready for review
August 31, 2026 15:20
@wyattjoh
wyattjoh
merged commit 27425ed
into
mainAug 31, 2026

9 of 10 checks passed

@wyattjoh
wyattjoh
deleted the

wyattjoh/resolve-bun-audit

branch
August 31, 2026 15:21
@coderabbitai
coderabbitaiBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Review Change Stack
Caution
Review failed
The pull request is closed.
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d33870cc-1027-4889-912d-190d5a280f99
📥 Commits
Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.
⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json
Disabled knowledge base sources:
  • Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📝 Walkthrough
Walkthrough
The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers:rafa-thayto
Comment @coderabbitai help to get the list of available commands.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): resolve Bun audit advisories - #459
Merged
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged
build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Summary
  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.
Testing
  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json
@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot
changeset-botBot
commented
Aug 30, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 8ba8eef
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@wyattjoh
wyattjoh
marked this pull request as ready for review
August 31, 2026 15:20
@wyattjoh
wyattjoh
merged commit 27425ed
into
mainAug 31, 2026

9 of 10 checks passed

@wyattjoh
wyattjoh
deleted the

wyattjoh/resolve-bun-audit

branch
August 31, 2026 15:21
@coderabbitai
coderabbitaiBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Review Change Stack
Caution
Review failed
The pull request is closed.
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d33870cc-1027-4889-912d-190d5a280f99
📥 Commits
Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.
⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json
Disabled knowledge base sources:
  • Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📝 Walkthrough
Walkthrough
The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers:rafa-thayto
Comment @coderabbitai help to get the list of available commands.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): resolve Bun audit advisories - #459
Merged
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged
build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Summary
  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.
Testing
  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json
@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot
changeset-botBot
commented
Aug 30, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 8ba8eef
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@wyattjoh
wyattjoh
marked this pull request as ready for review
August 31, 2026 15:20
@wyattjoh
wyattjoh
merged commit 27425ed
into
mainAug 31, 2026

9 of 10 checks passed

@wyattjoh
wyattjoh
deleted the

wyattjoh/resolve-bun-audit

branch
August 31, 2026 15:21
@coderabbitai
coderabbitaiBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Review Change Stack
Caution
Review failed
The pull request is closed.
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d33870cc-1027-4889-912d-190d5a280f99
📥 Commits
Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.
⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json
Disabled knowledge base sources:
  • Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📝 Walkthrough
Walkthrough
The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers:rafa-thayto
Comment @coderabbitai help to get the list of available commands.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
build(deps): resolve Bun audit advisories - #459
Merged
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Aug 31, 2026
Merged
build(deps): resolve Bun audit advisories#459
wyattjoh merged 1 commit into
mainfrom 
wyattjoh/resolve-bun-audit
Conversation
@wyattjoh
@wyattjohwyattjoh
commented
Aug 30, 2026

Copy link


Copy Markdown

Contributor
Summary
  • Upgrade the Model Context Protocol SDK and its vulnerable transitive dependencies.
  • Pin the legacy external-editor dependency chain to a patched tmp release.
  • Refresh the Bun lockfile so bun audit reports no advisories.
Testing
  • bun run format
  • bun run lint
  • bun run typecheck
  • bun run test
  • bun audit --json
@wyattjoh
build(deps): update MCP SDK and tmp
8ba8eef
- Upgrade the MCP SDK to 1.30.0
- Override tmp to version ^0.2.6
- Refresh the Bun lockfile dependencies
@changeset-bot
changeset-botBot
commented
Aug 30, 2026

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 8ba8eef
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 0 packages
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@wyattjoh
wyattjoh
marked this pull request as ready for review
August 31, 2026 15:20
@wyattjoh
wyattjoh
merged commit 27425ed
into
mainAug 31, 2026

9 of 10 checks passed

@wyattjoh
wyattjoh
deleted the

wyattjoh/resolve-bun-audit

branch
August 31, 2026 15:21
@coderabbitai
coderabbitaiBot
commented
Aug 31, 2026

Copy link


Copy Markdown

Review Change Stack
Caution
Review failed
The pull request is closed.
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d33870cc-1027-4889-912d-190d5a280f99
📥 Commits
Reviewing files that changed from the base of the PR and between dbf4937 and 8ba8eef.
⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • .changeset/legal-games-buy.md
  • package.json
  • packages/cli-core/package.json
Disabled knowledge base sources:
  • Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📝 Walkthrough
Walkthrough
The pull request adds a package-manager override for tmp at ^0.2.6. It updates the @modelcontextprotocol/sdk development dependency in cli-core from ^1.29.0 to ^1.30.0. It also adds an empty changeset delimiter block.
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers:rafa-thayto
Comment @coderabbitai help to get the list of available commands.
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@ZertsovZertsovZertsov approved these changes

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@wyattjoh@Zertsov