From bf218457d9a7d4e847dec61942b6de0d3f743fc8 Mon Sep 17 00:00:00 2001 From: Jungwon Sohn Date: Wed, 29 Jul 2026 00:37:24 +0900 Subject: [PATCH 1/3] release: publish verified TypeChain and TypeMCP examples (#1) Co-authored-by: sjungwon03 <> --- .github/workflows/release-promotion.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/release-promotion.yml diff --git a/.github/workflows/release-promotion.yml b/.github/workflows/release-promotion.yml new file mode 100644 index 0000000..2f2b40f --- /dev/null +++ b/.github/workflows/release-promotion.yml @@ -0,0 +1,23 @@ +name: Release promotion + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +jobs: + release-promotion: + name: release-promotion + runs-on: ubuntu-latest + steps: + - name: Require dev as the promotion source + run: test "${{ github.head_ref }}" = "dev" + - uses: actions/checkout@v5 + - uses: actions/setup-node@v5 + with: + node-version: 22 + cache: npm + - run: npm ci + - run: npm run check From 59cff9452d38dc62f66c6ece1162e0832ceb225e Mon Sep 17 00:00:00 2001 From: Jungwon Sohn Date: Wed, 29 Jul 2026 02:43:14 +0900 Subject: [PATCH 2/3] release: promote audited MCP SDK graph to production (#5) * ci: require verified dev-to-main promotions * fix: pin examples MCP SDK to audited graph (#3) Co-authored-by: sjungwon03 <> --------- Co-authored-by: sjungwon03 <> --- .github/workflows/verify.yml | 1 + README.md | 7 ++++++ package-lock.json | 16 ++++++------- package.json | 8 ++++++- test/dependency-security.test.ts | 39 ++++++++++++++++++++++++++++++++ 5 files changed, 62 insertions(+), 9 deletions(-) create mode 100644 test/dependency-security.test.ts diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 3f9e520..ea34350 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -25,3 +25,4 @@ jobs: - run: npm run example:policy - run: npm run example:typemcp - run: npm run example:bridge + - run: npm run audit:prod diff --git a/README.md b/README.md index 02c8cdf..567c56a 100644 --- a/README.md +++ b/README.md @@ -30,12 +30,19 @@ These examples show declaration and adapter boundaries, not a full hosted applic - The bridge is in-process only. It adapts a decorated TypeMCP class to LangChain tools; it does not create an MCP client or network connection. - No model provider is configured. Add a model only in your application after deciding its credentials, authorization, and runtime policy. +## Dependency-security boundary + +The published `@theorvane/type-mcp` package currently exact-pins an MCP SDK release whose transitive `@hono/node-server` graph is affected by [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9). This **examples application** uses an npm `overrides` entry to resolve its lockfile to `@modelcontextprotocol/sdk@1.30.0` and `@hono/node-server@2.0.12`; `npm run audit:prod` verifies the resulting production graph. + +This override is intentionally scoped to this repository and is **not a remediation for downstream TypeMCP consumers**. The package-level remediation remains tracked in [Theorvane/type-mcp#93](https://github.com/Theorvane/type-mcp/issues/93). + ## Development ```bash npm run lint npm run build npm test +npm run audit:prod npm run check ``` diff --git a/package-lock.json b/package-lock.json index 4e67c10..3525ab6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -674,12 +674,12 @@ } }, "node_modules/@hono/node-server": { - "version": "1.19.17", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz", - "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==", + "version": "2.0.12", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.12.tgz", + "integrity": "sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==", "license": "MIT", "engines": { - "node": ">=18.14.1" + "node": ">=20" }, "peerDependencies": { "hono": "^4" @@ -815,12 +815,12 @@ "license": "MIT" }, "node_modules/@modelcontextprotocol/sdk": { - "version": "1.26.0", - "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz", - "integrity": "sha512-Y5RmPncpiDtTXDbLKswIJzTqu2hyBKxTNsgKqKclDbhIgg1wgtf1fRuvxgTnRfcnxtvvgbIEcqUOzZrJ6iSReg==", + "version": "1.30.0", + "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz", + "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==", "license": "MIT", "dependencies": { - "@hono/node-server": "^1.19.9", + "@hono/node-server": "^1.19.9 || ^2.0.5", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", diff --git a/package.json b/package.json index 2780dc9..3241cc3 100644 --- a/package.json +++ b/package.json @@ -8,8 +8,9 @@ "node": ">=20" }, "scripts": { + "audit:prod": "npm audit --omit=dev --audit-level=low", "build": "tsc --noEmit", - "check": "npm run format:check && npm run build && npm test", + "check": "npm run format:check && npm run build && npm test && npm run audit:prod", "example:typechain": "tsx examples/typechain-tool-definition.ts", "example:policy": "tsx examples/typechain-policy-guard.ts", "example:typemcp": "tsx examples/typemcp-server-definition.ts", @@ -32,5 +33,10 @@ "tsx": "^4.21.0", "typescript": "^5.9.3", "vitest": "^4.1.0" + }, + "overrides": { + "@theorvane/type-mcp": { + "@modelcontextprotocol/sdk": "1.30.0" + } } } diff --git a/test/dependency-security.test.ts b/test/dependency-security.test.ts new file mode 100644 index 0000000..076de06 --- /dev/null +++ b/test/dependency-security.test.ts @@ -0,0 +1,39 @@ +import { readFileSync } from "node:fs"; +import { resolve } from "node:path"; +import { fileURLToPath } from "node:url"; +import { describe, expect, it } from "vitest"; + +const repositoryRoot = resolve(fileURLToPath(new URL("..", import.meta.url))); + +type Lockfile = { + readonly packages: Record; +}; + +describe("production dependency security", () => { + it("pins the examples application to the audited MCP SDK graph", () => { + const packageJson = JSON.parse( + readFileSync(resolve(repositoryRoot, "package.json"), "utf8"), + ) as { + readonly overrides?: { + readonly "@theorvane/type-mcp"?: { + readonly "@modelcontextprotocol/sdk"?: string; + }; + }; + }; + const lockfile = JSON.parse( + readFileSync(resolve(repositoryRoot, "package-lock.json"), "utf8"), + ) as Lockfile; + + expect( + packageJson.overrides?.["@theorvane/type-mcp"]?.[ + "@modelcontextprotocol/sdk" + ], + ).toBe("1.30.0"); + expect( + lockfile.packages["node_modules/@modelcontextprotocol/sdk"]?.version, + ).toBe("1.30.0"); + expect(lockfile.packages["node_modules/@hono/node-server"]?.version).toBe( + "2.0.12", + ); + }); +}); From 654bffa64179dcf58f1143fa3812323dd3417518 Mon Sep 17 00:00:00 2001 From: sjungwon03 Date: Wed, 29 Jul 2026 09:29:30 +0900 Subject: [PATCH 3/3] fix: remove obsolete reconciliation override --- package.json | 5 ----- 1 file changed, 5 deletions(-) diff --git a/package.json b/package.json index ec88e32..afe6f62 100644 --- a/package.json +++ b/package.json @@ -33,10 +33,5 @@ "tsx": "^4.21.0", "typescript": "^5.9.3", "vitest": "^4.1.0" - }, - "overrides": { - "@theorvane/type-mcp": { - "@modelcontextprotocol/sdk": "1.30.0" - } } }