Skip to content

chore: update @modelcontextprotocol/sdk in server dep#404

Merged
webdevcody merged 1 commit intomainfrom
fix/security-vulnerability
Jan 10, 2026
Merged

chore: update @modelcontextprotocol/sdk in server dep#404
webdevcody merged 1 commit intomainfrom
fix/security-vulnerability

Conversation

@Shironex
Copy link
Copy Markdown
Collaborator

@Shironex Shironex commented Jan 10, 2026 •
edited by coderabbitai Bot
Loading

  • update @modelcontextprotocol/sdk to latest version to adress high security vulnerability

Summary by CodeRabbit

  • Chores
    • Updated a server dependency to the latest patch version. This is a routine maintenance update with no changes to functionality or behavior.

✏️ Tip: You can customize this high-level summary in your review settings.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Jan 10, 2026 •
edited
Loading

📝 Walkthrough

Walkthrough

Updated the @modelcontextprotocol/sdk dependency from version 1.25.1 to 1.25.2 in the server package configuration file.

Changes

Cohort / File(s) Change Summary
Dependency Version Update
apps/server/package.json		 Updated @modelcontextprotocol/sdk from 1.25.1 to 1.25.2

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A nibble, a bump, a version so fine,
From 1.25.1 to its sibling benign,
The SDK hops along with grace,
Dependencies dance at their proper pace! ✨

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'chore: update @modelcontextprotocol/sdk in server dep' clearly summarizes the main change: updating a dependency in the server.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3f27074 and c5d0a8b.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (1)
  • apps/server/package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
  • GitHub Check: e2e
  • GitHub Check: build
🔇 Additional comments (1)
apps/server/package.json (1)

35-35: Version 1.25.2 correctly patches a ReDoS vulnerability in UriTemplate processing.

The update is verified and appropriate: version 1.25.2 exists on npm and includes a backport fixing a Regular Expression Denial of Service (ReDoS) vulnerability affecting UriTemplate regex patterns in versions ≥1.3.0. The patch-level bump introduces no breaking changes, only the security fix alongside minor CI and documentation updates.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gemini-code-assist
Copy link
Copy Markdown
Contributor

gemini-code-assist Bot commented Jan 10, 2026

Summary of Changes

Hello @Shironex, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on enhancing the security posture of the server application by upgrading a critical dependency. The update to @modelcontextprotocol/sdk resolves a high-severity security vulnerability, ensuring that the application leverages the latest security patches and maintains a robust defense against potential threats.

Highlights

  • Dependency Update: The @modelcontextprotocol/sdk dependency in the apps/server application has been updated from version 1.25.1 to 1.25.2.
  • Security Vulnerability Fix: This update specifically addresses a high-severity security vulnerability identified in the previous version of the @modelcontextprotocol/sdk.
  • Lock File Synchronization: The package-lock.json file has been updated to reflect the new dependency version and its corresponding integrity hash, ensuring consistent installations. Additionally, the versions for apps/server and apps/ui within the lock file were incremented from 0.8.0 to 0.9.0.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jan 10, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the @modelcontextprotocol/sdk dependency to version 1.25.2 to address a high-priority security vulnerability, which is a crucial and appreciated change. My review focuses on improving the clarity and consistency of this change.

I've noticed that this PR also includes minor version bumps for apps/server and apps/ui (from 0.8.0 to 0.9.0), which isn't reflected in the PR title or description. It would be beneficial to update them for better tracking. A minor version bump typically suggests new features, whereas this change seems to be a dependency fix, which would usually warrant a patch version bump (e.g., to 0.8.1). It might be worth reconsidering the versioning strategy here.

Additionally, I've left a comment regarding dependency versioning consistency in apps/server/package.json.

Comment thread apps/server/package.json
@webdevcody webdevcody merged commit 299b838 into main Jan 10, 2026
7 of 8 checks passed
@webdevcody webdevcody deleted the fix/security-vulnerability branch January 10, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Shironex @webdevcody