[dangrondahl]

Why

npm audit --omit=dev reports 8 advisories (1 critical, 3 high) in the locked runtime dependencies. This lockfile is what the .mcpb bundle installs from (pack-mcpb.sh copies it before npm install --omit=dev), so that's where users get them, along with CI and any scan of the repo. The npm package doesn't ship a lockfile, so npx users already resolve current versions within the SDK's ranges. All of them come in indirectly through @modelcontextprotocol/sdk:

Package	Before → after	Pulled in by
proxy-addr (critical)	2.0.7 → 2.0.8	express
hono	4.12.12 → 4.13.13	SDK
@hono/node-server	1.19.13 → 2.1.5	SDK (allows ^1.19.9 || ^2.0.5)
fast-uri	3.1.0 → 3.1.9	ajv
ip-address, express-rate-limit	10.1.0 → 10.7.4, 8.3.2 → 8.7.1	SDK
qs, body-parser	6.15.1 → 6.16.1, 2.2.2 → 2.4.0	express

Most of these belong to the SDK's HTTP server transports, which this server doesn't use, since it only speaks stdio. Scanners still flag them in the release.

Nothing would have fixed them otherwise. The weekly Dependabot version updates bump only direct dependencies, and Dependabot security updates were off. The repo also showed 0 Dependabot alerts, because the dependency graph was off. Both are being switched on in the repo settings.

What

npm audit fix --omit=dev. Only package-lock.json changes, and package.json is untouched. Every new version stays within the range its parent declares. The other lockfile changes (content-type, type-is, iconv-lite, hasown, side-channel, es-object-atoms) are patch or minor bumps that npm needed to resolve the fixed versions.

Checked

• npm audit --omit=dev: 0 vulnerabilities, down from 8.
• npm install --package-lock-only leaves the lockfile unchanged, so it's consistent with package.json.
• Locally: build, typecheck, 122 tests, and the smoke test against dist/. Before the rebase onto chore: bump @modelcontextprotocol/sdk from 1.30.1 to 1.32.1 #79's merge commit I also ran it against the unzipped .mcpb (manifest validated). The bundle ships @hono/node-server 2.1.5. CI repeats all of this, plus the bundle on Node 22.0.0.

Not in this PR

• Dev-only advisories (10). They never ship. @anthropic-ai/mcpb's node-forge and tmp have no fix yet. The vite/vitest ones should move with chore: bump vitest from 4.1.11 to 5.0.5 #93 (vitest 5).
• Declaring zod directly: chore: declare zod as a direct dependency #95.

[claude]

Claude finished @dangrondahl's task in 2m 3s —— View job

---

Review: lockfile-only transitive dependency bump

• Read CLAUDE.md invariants and the PR diff
• Verify the change is lockfile-only and consistent with package.json
• Check every bumped version stays inside its parent's declared range
• Check CI results

No blocking findings. The diff touches only package-lock.json; no src/, workflow, or package.json change, so none of CLAUDE.md's invariants (three tools, no configured org, the error-object contract, the User-Agent version) are in play.

What I verified

Every new version satisfies the range its parent declares, including the one that isn't obvious:

• @modelcontextprotocol/sdk@1.32.1 declares "@hono/node-server": "^1.19.9 || ^2.0.5" (package-lock.json:747), so 2.1.5 is inside the SDK's own supported range — the 1.x → 2.x jump is sanctioned by the SDK, not forced past it. Same for express-rate-limit ^8.2.1 → 8.7.1 and hono ^4.11.4 → 4.13.13.
• express@5.2.1 (package-lock.json:1763-1791): body-parser ^2.2.1 → 2.4.0, qs ^6.14.0 → 6.16.1, proxy-addr ^2.0.7 → 2.0.8, type-is ^2.0.1 → 2.1.0. All satisfied.
• The new requirements the bumped packages introduce are all already met by what's locked: raw-body ^3.0.2 → 3.0.2, http-errors ^2.0.1 → 2.0.1, es-define-property ^1.0.1 → 1.0.1 (new edge from qs), object-inspect ^1.13.4 → 1.13.4, side-channel-list ^1.0.1 → 1.0.1, debug ^4.4.3 → 4.4.3 (new edge from express-rate-limit). No dangling range.
• The duplicated content-type@2.1.0 under body-parser and type-is is correct rather than sloppy: both the SDK (:750) and express (:1767) still pin ^1.0.5, so 1.0.5 has to stay hoisted.
• Node floor: @hono/node-server tightened engines.node from >=18.14.1 to >=20, and the new body-parser/type-is/content-type all declare >=18. All below the consumer floor of >=22, so nothing on CLAUDE.md's "raising the Node floor" checklist has to move, and the bundle's 22.0.0 smoke test is unaffected.
• npm ci passing in CI confirms the lockfile is in sync with the untouched package.json.
• CI: ✅ success (build, typecheck, tests, smoke against dist/, pack, mcpb validate, bundle smoke on 22.0.0).
• Commit 8bf603a and the PR title are both valid Conventional Commits (fix(deps):).

Two notes, neither blocking

The PR says the advisories are fixed "both in the npm package and in the .mcpb bundle." npm strips package-lock.json from published tarballs, so npx -y @kosli/mcp-server consumers resolve fresh from ^1.29.0 and were already getting these versions or newer. What this lockfile actually fixes is the .mcpb bundle (scripts/pack-mcpb.sh copies the lockfile before npm install --omit=dev), CI, and any scan of the repo itself — which is the part that was being flagged, so the outcome stands.

Nothing in ci.yml runs npm audit --omit=dev, so this can regress silently between the Dependabot security updates being enabled out of band. Worth considering as a follow-up rather than here.

Nicely scoped PR: the description's claims each turned out to be checkable and correct, which made this quick to verify.
· branch fix/audit-shipped-deps