fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422
Merged
KKonstantinov merged 1 commit intomainfrom Jan 23, 2026
Merged
fix: resolve pnpm audit vulnerabilities by removing @pnpm/workspace.* deps#1422KKonstantinov merged 1 commit intomainfrom
KKonstantinov merged 1 commit intomainfrom
Conversation
Replace @pnpm/workspace.find-packages and @pnpm/workspace.read-manifest with simple fast-glob usage in typedoc.config.mjs. These pnpm packages pulled in a deep chain of dependencies including vulnerable versions of cross-spawn@7.0.3 and tar@7.5.2. The replacement is simpler and has no security vulnerabilities.
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
KKonstantinov
approved these changes
Jan 23, 2026
jonathanhefner
added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
packages The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one level deep, missing the middleware packages at `packages/middleware/*/`. Change to `packages/**/package.json` with a `node_modules` ignore to find all 6 workspace packages. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jonathanhefner
added a commit
to jonathanhefner/mcp-typescript-sdk
that referenced
this pull request
Feb 4, 2026
The glob pattern `packages/*/package.json` from modelcontextprotocol#1422 only matches one level deep, missing the middleware packages at `packages/middleware/*/`. Change to `packages/**/package.json` with a `node_modules` ignore to find all 6 workspace packages. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
pnpm auditreports 3 HIGH severity vulnerabilities:cross-spawn@7.0.3(needs ≥7.0.5) - ReDoS vulnerabilitytar@7.5.2(needs ≥7.5.4) - Path traversal vulnerabilities (x2)These come from
@pnpm/workspace.find-packageswhich pulls in a deep chain of pnpm internal packages (@pnpm/npm-lifecycle→@yarnpkg/shell→ vulnerable deps).We only use these packages in
typedoc.config.mjsto find workspace packages for docs generation - easily replaced with simpler code.How Has This Been Tested?
pnpm auditnow reports 0 vulnerabilitiespnpm docs:checkpasses - TypeDoc still finds the correct packagescross-spawnis now only at 7.0.6 (patched) andtaris completely removed from depsBreaking Changes
None. This only affects dev tooling (TypeDoc config).
Types of changes
Checklist
Additional context
cc @jmhefner who originally added the typedoc config