Why this exists
Security Scan failed on npm audit because @modelcontextprotocol/sdk pulls in @hono/node-server 1.x, which is flagged for a Windows path-traversal issue (fixed in 2.0.5+).
npm's suggested fix is to downgrade the MCP SDK to 1.24.3 (before it depended on Hono). We rejected that.
Instead, this fork pins in package.json overrides:
"@hono/node-server": "^2.0.5"
Undo when
Upstream @modelcontextprotocol/sdk depends on @hono/node-server >= 2.0.5 (or otherwise no longer pulls a vulnerable 1.x).
Related upstream discussion (same topic, imperfect advisory IDs):
modelcontextprotocol/typescript-sdk#2551
Advisory npm actually reported:
GHSA-frvp-7c67-39w9
How to undo
- Delete the
"@hono/node-server" entry from overrides in package.json.
- Run
npm install.
- Confirm with
npm audit (and Security Scan CI).
Do not remove fast-uri / brace-expansion overrides in the same change unless those are also fixed without pins.
Why this exists
Security Scan failed on
npm auditbecause@modelcontextprotocol/sdkpulls in@hono/node-server1.x, which is flagged for a Windows path-traversal issue (fixed in 2.0.5+).npm's suggested fix is to downgrade the MCP SDK to 1.24.3 (before it depended on Hono). We rejected that.
Instead, this fork pins in
package.jsonoverrides:Undo when
Upstream
@modelcontextprotocol/sdkdepends on@hono/node-server>= 2.0.5 (or otherwise no longer pulls a vulnerable 1.x).Related upstream discussion (same topic, imperfect advisory IDs):
modelcontextprotocol/typescript-sdk#2551
Advisory npm actually reported:
GHSA-frvp-7c67-39w9
How to undo
"@hono/node-server"entry fromoverridesinpackage.json.npm install.npm audit(and Security Scan CI).Do not remove
fast-uri/brace-expansionoverrides in the same change unless those are also fixed without pins.