Residual from the 2026-07-24 npm audit fix pass
Two moderate advisories remain against @hono/node-server (transitive, via @modelcontextprotocol/sdk used by @codespar/mcp):
- GHSA-frvp-7c67-39w9 — path traversal in
serve-static via encoded backslash (%5C). Windows-only.
Why it isn't actionable today
- The latest
@modelcontextprotocol/sdk (1.29.0, which we already use) pins @hono/node-server@^1.19.9.
- The fix only exists in the
@hono/node-server 2.x major, outside that range.
npm audit fix --force would downgrade @modelcontextprotocol/sdk to 1.24.3 — a breaking change.
The CI audit gate runs at --audit-level=high, so these moderates are reported in the log but don't block.
Resolution trigger
When @modelcontextprotocol/sdk adopts @hono/node-server 2.x: bump it, confirm npm audit --omit=dev is clean, and close this issue.
Residual from the 2026-07-24
npm audit fixpassTwo moderate advisories remain against
@hono/node-server(transitive, via@modelcontextprotocol/sdkused by@codespar/mcp):serve-staticvia encoded backslash (%5C). Windows-only.Why it isn't actionable today
@modelcontextprotocol/sdk(1.29.0, which we already use) pins@hono/node-server@^1.19.9.@hono/node-server2.x major, outside that range.npm audit fix --forcewould downgrade@modelcontextprotocol/sdkto 1.24.3 — a breaking change.The CI audit gate runs at
--audit-level=high, so these moderates are reported in the log but don't block.Resolution trigger
When
@modelcontextprotocol/sdkadopts@hono/node-server2.x: bump it, confirmnpm audit --omit=devis clean, and close this issue.