Skip to content

fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422

Merged
KKonstantinov merged 1 commit into
mainfrom
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged

fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom
fweinberger/fix-audit-vulns

Conversation

@felixweinberger

@felixweinbergerfelixweinberger commented Jan 23, 2026

Copy link
Copy Markdown
Contributor

Motivation and Context

pnpm audit reports 3 HIGH severity vulnerabilities:

  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)

These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).

We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.

How Has This Been Tested?

  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps

Breaking Changes

None. This only affects dev tooling (TypeDoc config).

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

cc @jmhefner who originally added the typedoc config

@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger requested a review from a team as a code ownerJanuary 23, 2026 16:00
@changeset-bot

changeset-botBot commented Jan 23, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: e0d900a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Jan 23, 2026

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a

@KKonstantinov
KKonstantinov merged commit 11e3266 into mainJan 23, 2026
14 checks passed
@KKonstantinov
KKonstantinov deleted the fweinberger/fix-audit-vulns branch January 23, 2026 16:30
jonathanhefner added a commit to jonathanhefner/mcp-typescript-sdk that referenced this pull request Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit to jonathanhefner/mcp-typescript-sdk that referenced this pull request Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner mentioned this pull request Feb 4, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps by felixweinberger · Pull Request #1422 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422
Merged
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jan 23, 2026

Copy link


Copy Markdown

Contributor
Motivation and Context
pnpm audit reports 3 HIGH severity vulnerabilities:
  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)
These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).
We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.
How Has This Been Tested?
  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps
Breaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
cc @jmhefner who originally added the typedoc config
@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJanuary 23, 2026 16:00
@changeset-bot
changeset-botBot
commented
Jan 23, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: e0d900a
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jan 23, 2026

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a
@KKonstantinov
KKonstantinov
merged commit 11e3266
into
mainJan 23, 2026

14 checks passed

@KKonstantinov
KKonstantinov
deleted the

fweinberger/fix-audit-vulns

branch
January 23, 2026 16:30
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner
mentioned this pull request
Feb 4, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps by felixweinberger · Pull Request #1422 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422
Merged
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jan 23, 2026

Copy link


Copy Markdown

Contributor
Motivation and Context
pnpm audit reports 3 HIGH severity vulnerabilities:
  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)
These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).
We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.
How Has This Been Tested?
  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps
Breaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
cc @jmhefner who originally added the typedoc config
@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJanuary 23, 2026 16:00
@changeset-bot
changeset-botBot
commented
Jan 23, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: e0d900a
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jan 23, 2026

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a
@KKonstantinov
KKonstantinov
merged commit 11e3266
into
mainJan 23, 2026

14 checks passed

@KKonstantinov
KKonstantinov
deleted the

fweinberger/fix-audit-vulns

branch
January 23, 2026 16:30
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner
mentioned this pull request
Feb 4, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps by felixweinberger · Pull Request #1422 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422
Merged
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jan 23, 2026

Copy link


Copy Markdown

Contributor
Motivation and Context
pnpm audit reports 3 HIGH severity vulnerabilities:
  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)
These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).
We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.
How Has This Been Tested?
  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps
Breaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
cc @jmhefner who originally added the typedoc config
@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJanuary 23, 2026 16:00
@changeset-bot
changeset-botBot
commented
Jan 23, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: e0d900a
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jan 23, 2026

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a
@KKonstantinov
KKonstantinov
merged commit 11e3266
into
mainJan 23, 2026

14 checks passed

@KKonstantinov
KKonstantinov
deleted the

fweinberger/fix-audit-vulns

branch
January 23, 2026 16:30
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner
mentioned this pull request
Feb 4, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps by felixweinberger · Pull Request #1422 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422
Merged
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jan 23, 2026

Copy link


Copy Markdown

Contributor
Motivation and Context
pnpm audit reports 3 HIGH severity vulnerabilities:
  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)
These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).
We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.
How Has This Been Tested?
  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps
Breaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
cc @jmhefner who originally added the typedoc config
@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJanuary 23, 2026 16:00
@changeset-bot
changeset-botBot
commented
Jan 23, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: e0d900a
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jan 23, 2026

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a
@KKonstantinov
KKonstantinov
merged commit 11e3266
into
mainJan 23, 2026

14 checks passed

@KKonstantinov
KKonstantinov
deleted the

fweinberger/fix-audit-vulns

branch
January 23, 2026 16:30
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner
mentioned this pull request
Feb 4, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps by felixweinberger · Pull Request #1422 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422
Merged
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jan 23, 2026

Copy link


Copy Markdown

Contributor
Motivation and Context
pnpm audit reports 3 HIGH severity vulnerabilities:
  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)
These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).
We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.
How Has This Been Tested?
  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps
Breaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
cc @jmhefner who originally added the typedoc config
@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJanuary 23, 2026 16:00
@changeset-bot
changeset-botBot
commented
Jan 23, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: e0d900a
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jan 23, 2026

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a
@KKonstantinov
KKonstantinov
merged commit 11e3266
into
mainJan 23, 2026

14 checks passed

@KKonstantinov
KKonstantinov
deleted the

fweinberger/fix-audit-vulns

branch
January 23, 2026 16:30
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner
mentioned this pull request
Feb 4, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps by felixweinberger · Pull Request #1422 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422
Merged
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jan 23, 2026

Copy link


Copy Markdown

Contributor
Motivation and Context
pnpm audit reports 3 HIGH severity vulnerabilities:
  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)
These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).
We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.
How Has This Been Tested?
  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps
Breaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
cc @jmhefner who originally added the typedoc config
@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJanuary 23, 2026 16:00
@changeset-bot
changeset-botBot
commented
Jan 23, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: e0d900a
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jan 23, 2026

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a
@KKonstantinov
KKonstantinov
merged commit 11e3266
into
mainJan 23, 2026

14 checks passed

@KKonstantinov
KKonstantinov
deleted the

fweinberger/fix-audit-vulns

branch
January 23, 2026 16:30
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner
mentioned this pull request
Feb 4, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps by felixweinberger · Pull Request #1422 · modelcontextprotocol/typescript-sdk · GitHub
Skip to content
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps - #1422
Merged
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
KKonstantinov merged 1 commit into
mainfrom 
fweinberger/fix-audit-vulns
Conversation
@felixweinberger
@felixweinbergerfelixweinberger
commented
Jan 23, 2026

Copy link


Copy Markdown

Contributor
Motivation and Context
pnpm audit reports 3 HIGH severity vulnerabilities:
  • cross-spawn@7.0.3 (needs ≥7.0.5) - ReDoS vulnerability
  • tar@7.5.2 (needs ≥7.5.4) - Path traversal vulnerabilities (x2)
These come from @pnpm/workspace.find-packages which pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle → @yarnpkg/shell → vulnerable deps).
We only use these packages in typedoc.config.mjs to find workspace packages for docs generation - easily replaced with simpler code.
How Has This Been Tested?
  • pnpm audit now reports 0 vulnerabilities
  • pnpm docs:check passes - TypeDoc still finds the correct packages
  • Verified cross-spawn is now only at 7.0.6 (patched) and tar is completely removed from deps
Breaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
  •  Bug fix (non-breaking change which fixes an issue)
  •  New feature (non-breaking change which adds functionality)
  •  Breaking change (fix or feature that would cause existing functionality to change)
  •  Documentation update
Checklist
  •  I have read the MCP Documentation
  •  My code follows the repository's style guidelines
  •  New and existing tests pass locally
  •  I have added appropriate error handling
  •  I have added or updated documentation as needed
Additional context
cc @jmhefner who originally added the typedoc config
@felixweinberger
fix: remove @pnpm/workspace.* deps to resolve audit vulnerabilities
e0d900a
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest
with simple fast-glob usage in typedoc.config.mjs. These pnpm packages
pulled in a deep chain of dependencies including vulnerable versions of
cross-spawn@7.0.3 and tar@7.5.2.
The replacement is simpler and has no security vulnerabilities.
@felixweinberger
felixweinberger
requested a review
from a team
as a code ownerJanuary 23, 2026 16:00
@changeset-bot
changeset-botBot
commented
Jan 23, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: e0d900a
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Jan 23, 2026

Copy link


Copy Markdown

Open in StackBlitz
@modelcontextprotocol/client
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1422

@modelcontextprotocol/server
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1422

@modelcontextprotocol/express
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1422

@modelcontextprotocol/hono
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1422

@modelcontextprotocol/node
npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1422

commit: e0d900a
@KKonstantinov
KKonstantinov
merged commit 11e3266
into
mainJan 23, 2026

14 checks passed

@KKonstantinov
KKonstantinov
deleted the

fweinberger/fix-audit-vulns

branch
January 23, 2026 16:30
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
fix: use recursive glob in TypeDoc config to find nested middleware
fb9e75d
packages
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
@jonathanhefner@claude
Use recursive glob in TypeDoc config to find nested middleware packages
9616e0c
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one
level deep, missing the middleware packages at `packages/middleware/*/`.
Change to `packages/**/package.json` with a `node_modules` ignore to
find all 6 workspace packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@jonathanhefnerjonathanhefner
mentioned this pull request
Feb 4, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@KKonstantinovKKonstantinovKKonstantinov approved these changes
@pcarletonpcarletonAwaiting requested review from pcarleton
@jonathanhefnerjonathanhefnerAwaiting requested review from jonathanhefner

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@felixweinberger@KKonstantinov