Repository navigation
Release v0.9.1 - #1704
Merged
Merged
Release v0.9.1#1704
Conversation
…updates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@fastify/busboy](https://github.com/fastify/busboy) | `3.2.0` | `3.2.2` | | [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` | | [prosemirror-view](https://github.com/prosemirror/prosemirror-view) | `1.42.2` | `1.42.6` | | [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | Bumps the npm_and_yarn group with 2 updates in the /mcp-docs directory: [proxy-addr](https://github.com/jshttp/proxy-addr) and [source-map-js](https://github.com/7rulnik/source-map-js). Updates `@fastify/busboy` from 3.2.0 to 3.2.2 - [Release notes](https://github.com/fastify/busboy/releases) - [Commits](fastify/busboy@v3.2.0...v3.2.2) Updates `compression` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@v1.8.1...v1.8.2) Updates `prosemirror-view` from 1.42.2 to 1.42.6 - [Changelog](https://github.com/ProseMirror/prosemirror-view/blob/master/CHANGELOG.md) - [Commits](https://github.com/prosemirror/prosemirror-view/commits) Updates `proxy-addr` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `proxy-addr` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: "@fastify/busboy" dependency-version: 3.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: compression dependency-version: 1.8.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: prosemirror-view dependency-version: 1.42.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…nd_yarn-f7e546dfac chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates
auto-instrumentations-node 0.78.0 -> 0.79.0, sdk-node 0.220.0 -> 0.221.0, sdk-metrics 2.9.0 -> 2.10.0 (kept exactly aligned with sdk-node; root mirror and backend ranges changed in lockstep). Pulls the patched pg, knex, mysql, mysql2, mongoose, oracledb, tedious and cassandra-driver instrumentations for GHSA-qqmp-wf37-98f9.
…or-parser and smol-toml advisories - katex 0.16.47 -> 0.18.10 via override (mermaid pins ^0.16; GHSA-238p-pmpm-9mq7) - sharp 0.35.4 -> 0.35.5 within @huggingface/transformers' range (GHSA-wq5f-xc86-pv6w) - shell-quote 1.10.0 -> 1.12.0 by raising the existing override (GHSA-pqg4-j6r4-53mv) - postcss-selector-parser 6.0.10 -> 7.1.6 via override (@tailwindcss/typography pins 6.0.10; GHSA-rj75-hqrm-r3gf) - smol-toml 1.8.0 -> 1.9.0; drop the exact 1.8.0 override, knip's ^1.6.1 admits the fix (GHSA-r4xh-jqrq-34v2) - advisory invariants test asserts floors instead of exact versions
fix(deps): patch transitive katex, sharp, shell-quote, postcss-selector-parser and smol-toml advisories
…etry-instrumentation # Conflicts: # CHANGELOG.md
# Conflicts: # CHANGELOG.md
…strumentation fix(deps): bump OpenTelemetry so database spans stop emitting db.user (GHSA-qqmp-wf37-98f9)
# Conflicts: # CHANGELOG.md
fix(deps): bump @modelcontextprotocol/sdk to 1.31.0 (GHSA-6qxp-vccf-f47h)
fix(deps): bump fast-copy to 4.1.2
The root dependencies block mirrors backend prod deps so npm hoists them, but the root range lagged at ^1.9.0, leaving a nested backend/node_modules/@opentelemetry/api@1.9.1 in the lockfile. Re-locked: the nested copy is gone and the hoisted copy is 1.9.1.
.npmrc sets engine-strict=true, and the locked tree already refuses older Node 22 releases: jsdom 28 and isomorphic-dompurify (backend prod deps) and eslint-visitor-keys require ^22.13.0; vitest 5, vite 8 and rolldown require >=22.12.0. Declaring >=22.0.0 promised installs that fail with EBADENGINE. Root goes to >=22.13.0; mcp-docs (own lockfile, floor 22.12.0 from vitest/vite/jsdom) to >=22.12.0.
…ents widen The root overrides for katex (mermaid wants ^0.16) and postcss-selector-parser (@tailwindcss/typography pins 6.0.10) exist only because the parents' own ranges exclude every patched release. Nothing noticed when that stops being true, at which point the override is dead weight or forces a downgrade. The invariants test now reads each parent's spec from the lockfile and fails with 'mermaid widened its katex range to X — drop the override' once it admits a patched version. Also renames the sharp floor test to say what it checks (sharp >= 0.35.5, not the bundled librsvg version).
Regression guard for GHSA-qqmp-wf37-98f9. A child process registers the real auto-instrumentations (configured as startTelemetry() does) with an in-memory exporter before pg is loaded, runs a query against the test database, and asserts the pg.query span exists while no span carries db.user or the connection's username. Fails on instrumentation-pg 0.72.0 (db.user on pg.connect and pg.query), passes on 0.73.0.
…mentation claim ADMIN-GUIDE → OpenTelemetry now lists the span-attribute renames and the HTTP metric rename + unit change from the 0.221 OTel release (http.server.duration ms → http.server.request.duration s, same for client). Code comments and PERFORMANCE.md claimed Fastify auto-instrumentation, but neither @opentelemetry/instrumentation-fastify nor @fastify/otel is installed; Fastify requests are HTTP server spans.
…in the runbook CHANGELOG [Unreleased]: add the GHSA IDs for the fast-copy and transitive updates (verified against the repo's Dependabot alerts), the HTTP metric rename/unit change, and the Node floor. client-inference runbook: sharp 0.35.5 with @img/sharp-libvips 1.3.4 (librsvg 2.63.2) and GHSA-wq5f-xc86-pv6w.
chore(release): v0.9.1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v0.9.1: dependency security updates since v0.9.0 (20 commits, bump in #1703): MCP SDK 1.31.0, OpenTelemetry without DB username in spans, katex, sharp, shell-quote, postcss-selector-parser, smol-toml, fast-copy, plus #1696.
Upgrade notes: OpenTelemetry users — span attribute and HTTP metric names change (duration histograms ms → s). Source installs need Node.js 22.13.0+. No migrations.