Skip to content

ci: fix failing "Node.js SDK (18)" integration tests#241

Merged
ajmfehr merged 10 commits into
mainfrom
fix/upgrade-mcp-sdk-cve
Jun 8, 2026
Merged

ci: fix failing "Node.js SDK (18)" integration tests#241
ajmfehr merged 10 commits into
mainfrom
fix/upgrade-mcp-sdk-cve

Conversation

@ajmfehr

@ajmfehr ajmfehr commented Apr 27, 2026

Copy link
Copy Markdown
Contributor

Fixes two root causes of the failing "Node.js SDK (18)" CI job (check run 79356814555).

Root Causes & Changes

1. ReferenceError: crypto is not defined — 5 LangChain test failures

In Node.js 18, the Web Crypto API is exposed as globalThis.crypto but is not automatically aliased to a bare crypto global in CommonJS module context. @langchain/core references crypto directly in uuid/rng.ts, throwing a ReferenceError at runtime on Node.js 18.

Fix:

  • Added tests/observability/integration/jest.polyfills.js — a lightweight setup file that polyfills globalThis.crypto using Node's built-in require('crypto').webcrypto. A typeof guard makes it a no-op on Node.js 19+ where crypto is already a first-class global.
  • Wired the polyfill via a new setupFiles entry in jest.integration.config.cjs so it runs before any test modules are loaded.

2. Test timeout — 1 OpenAI test failure (validate error.type on failing tool)

The test creates an agent with a tool that always throws. When the tool fails, the agent can loop through additional LLM turns, exhausting the 60 s testTimeout.

Fix:

  • Added { maxTurns: 3 } to the run() call to cap agent turns and prevent runaway loops (supported by SharedRunOptions in @openai/agents@0.7.x).
  • Increased the global testTimeout from 60000120000 ms in both jest.integration.config.cjs and setup.ts to give Azure OpenAI API calls adequate headroom.

… data leak CVE

Upgrades @modelcontextprotocol/sdk from ^1.25.2 to ^1.26.0 (resolved 1.27.1)
to address a cross-client data leak vulnerability caused by transport and
server/protocol instance reuse in stateless deployments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 27, 2026 19:59
@ajmfehr ajmfehr requested a review from a team as a code owner April 27, 2026 19:59

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the workspace’s Model Context Protocol (MCP) SDK dependency to a newer minor release in order to pick up fixes for a reported cross-client data leak vulnerability related to transport/server/protocol instance reuse.

Changes:

  • Bump @modelcontextprotocol/sdk in the workspace catalog from ^1.25.2 to ^1.26.0.
  • Refresh pnpm-lock.yaml to resolve the SDK to 1.27.1 and update related transitive dependencies.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
pnpm-workspace.yaml Updates the workspace catalog version range for @modelcontextprotocol/sdk.
pnpm-lock.yaml Updates the resolved MCP SDK version (to 1.27.1) and adjusts transitive dependency graph accordingly.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

Comment thread pnpm-lock.yaml Outdated
gwharris7
gwharris7 previously approved these changes Apr 27, 2026
gwharris7 and others added 2 commits April 27, 2026 13:36
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 27, 2026 20:37
gwharris7
gwharris7 previously approved these changes Apr 27, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

Comment thread pnpm-lock.yaml
Comment thread pnpm-workspace.yaml
gwharris7
gwharris7 previously approved these changes Apr 27, 2026
@ajmfehr ajmfehr enabled auto-merge (squash) April 28, 2026 00:15
sellakumaran
sellakumaran previously approved these changes Apr 28, 2026
Copilot AI review requested due to automatic review settings April 28, 2026 02:21

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

Comment thread pnpm-workspace.yaml
Copilot AI review requested due to automatic review settings June 3, 2026 17:35

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Copilot AI requested a review from a team as a code owner June 3, 2026 18:08
Copilot AI review requested due to automatic review settings June 3, 2026 18:10
@ajmfehr ajmfehr review requested due to automatic review settings June 3, 2026 18:10
Copilot AI changed the title Fix: upgrade @modelcontextprotocol/sdk to ^1.26.0 ci: fix failing "Node.js SDK (18)" integration tests Jun 3, 2026
Copilot AI requested a review from gwharris7 June 3, 2026 18:10
@ajmfehr ajmfehr merged commit ca4b554 into main Jun 8, 2026
7 checks passed
@ajmfehr ajmfehr deleted the fix/upgrade-mcp-sdk-cve branch June 8, 2026 17:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants