From 701a596aae70886787f0230f0fdf8287294456fd Mon Sep 17 00:00:00 2001 From: laboef1900 Date: Wed, 7 Oct 2026 09:29:59 +0200 Subject: [PATCH] fix(deps): bump @modelcontextprotocol/sdk to 1.31.0 (GHSA-6qxp-vccf-f47h) Lockfile-only bump in the root lockfile (backend MCP client) and the mcp-docs sidecar lockfile. Closes Dependabot alerts #279 and #276. --- CHANGELOG.md | 8 ++++++++ mcp-docs/package-lock.json | 6 +++--- package-lock.json | 6 +++--- 3 files changed, 14 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7ee5d4842..9ced18ecb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Security + +- **`@modelcontextprotocol/sdk` 1.30.0 → 1.31.0** in the backend (root + lockfile) and the `mcp-docs` sidecar (GHSA-6qxp-vccf-f47h: the OAuth client + could send credentials to an authorization server chosen by the MCP server). + Neither side uses the SDK's OAuth support, so no code changes; the sidecar + now also rejects JSON-RPC batches of more than 100 messages. + ## [0.9.0] - 2026-10-06 > Minor: fixes for seven security advisories (GHSA-527x, -9v4v, -r652, -mvgq, -59q7, -v22g, -98hf), page restrictions on every read, Confluence as a per-user toggle (standalone mode), image analysis in retrieval (ADR-027), dependency security updates. **Every user signs in again once after upgrading.** 237 commits since v0.8.0. diff --git a/mcp-docs/package-lock.json b/mcp-docs/package-lock.json index 1c001b89f..62bf8ef0a 100644 --- a/mcp-docs/package-lock.json +++ b/mcp-docs/package-lock.json @@ -724,9 +724,9 @@ "license": "BSD-2-Clause" }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.30.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", - "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", + "version": "1.31.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.31.0.tgz", + "integrity": "sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==", "license": "MIT", "dependencies": { "@hono/node-server": "^1.19.9 || ^2.0.5", diff --git a/package-lock.json b/package-lock.json index afe21893f..b28069686 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3501,9 +3501,9 @@ "license": "BSD-2-Clause" }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.30.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", - "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", + "version": "1.31.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.31.0.tgz", + "integrity": "sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==", "license": "MIT", "dependencies": { "@hono/node-server": "^1.19.9 || ^2.0.5",