Skip to content

[Snyk] Fix for 2 vulnerabilities #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Krosebrook wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #10

Krosebrook wants to merge 1 commit into from

Conversation

@Krosebrook
Copy link
Owner

@Krosebrook Krosebrook commented Dec 5, 2025 •
edited by cubic-dev-ai bot
Loading

snyk-top-banner

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Arbitrary Argument Injection
SNYK-JS-ANTHROPICAICLAUDECODE-14176027		   721  
high severity Insecure Default Initialization of Resource
SNYK-JS-MODELCONTEXTPROTOCOLSDK-14171914		   666  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Summary by cubic

Upgraded @anthropic-ai/claude-code and @modelcontextprotocol/sdk to fix two high-severity Snyk vulnerabilities. No code changes; only dependency updates in package.json and package-lock.json.

  • Dependencies

    • @anthropic-ai/claude-code: ^1.0.70 → ^1.0.93 (fixes SNYK-JS-ANTHROPICAICLAUDECODE-14176027).
    • @modelcontextprotocol/sdk: ^1.17.0 → ^1.24.0 (fixes SNYK-JS-MODELCONTEXTPROTOCOLSDK-14171914).
    • Lockfile updates add ajv v8, ajv-formats, jose, and bump zod-to-json-schema per SDK requirements.

  • Migration

    • Ensure Node 18+ (required by @modelcontextprotocol/sdk).
    • Confirm zod satisfies ^3.25 or ^4; add if missing.

Written for commit 1061a36. Summary will update automatically on new commits.

Copilot AI review requested due to automatic review settings December 5, 2025 00:20
@coderabbitai
Copy link

coderabbitai bot commented Dec 5, 2025

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch snyk-fix-241b5cc5337cfa84111e1434dcbd17a6

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@claude
Copy link

claude bot commented Dec 5, 2025 •
edited
Loading

Claude encountered an error —— View job

I'll analyze this and get back to you.

Copilot AI reviewed Dec 5, 2025
View reviewed changes
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This automated Snyk PR addresses two high-severity security vulnerabilities by upgrading npm dependencies. The changes fix an Arbitrary Argument Injection vulnerability (CVSS score 721) in @anthropic-ai/claude-code and an Insecure Default Initialization of Resource vulnerability (CVSS score 666) in @modelcontextprotocol/sdk.

Key Changes

  • Upgraded @anthropic-ai/claude-code from v1.0.70 to v1.0.93 (23 patch versions)
  • Upgraded @modelcontextprotocol/sdk from v1.17.1 to v1.24.0 (7 minor versions)
  • Updated transitive dependencies including ajv (v6→v8), added jose and ajv-formats

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Updated version ranges for the two vulnerable dependencies using caret notation to allow compatible updates
package-lock.json Reflects the dependency tree changes including new transitive dependencies (jose, ajv-formats), ajv upgrade to v8, zod-to-json-schema update, and correctly marks some packages as dev-only that are only used by development dependencies

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cubic-dev-ai[bot]
cubic-dev-ai bot reviewed Dec 5, 2025
View reviewed changes
Copy link

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@cubic-dev-ai cubic-dev-ai[bot] cubic-dev-ai[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Krosebrook @snyk-bot