stacklok / toolhive-studio / 29904396203

72%

push

github

fix(security): override fast-uri, hono, node-server, dompurify (7 CVEs) (#2495)

* fix(security): override fast-uri, hono, node-server, dompurify (7 CVEs)

Add pnpm overrides for transitive production dependencies to clear
pnpm audit failures from the MCP SDK and streamdown/mermaid trees.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(security): bump fast-xml-parser and sharp overrides for Grype

Resolve GHSA-8r6m-32jq-jx6q and GHSA-f88m-g3jw-g9cj findings from the
anchore/scan-action CI step.

Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: drop remediation-plan.md from PR

The remediation plan is a local agent artifact and should not be
committed to the repository.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(security): pin ajv>fast-uri to 3.1.4 on same major line

ajv declares fast-uri ^3.0.1; 3.1.4 is the minimum patched release and
avoids forcing an unvetted 4.x override.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

5592 of 8285 branches covered (67.5%)

8284 of 11454 relevant lines covered (72.32%)

137.31 hits per line