molecule-ai/molecule-mcp-server
41
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(deps): npm audit fix — resolve 5 transitive vulnerabilities #3

Merged
sdk-lead merged 1 commits from fix/audit-fix-vulnerabilities into main 2026-05-11 03:26:39 +00:00
Conversation 0 Commits 1 Files Changed 1
+17 -22
sdk-dev commented 2026-05-11 03:16:27 +00:00
Member
Copy Link
Copy Source

Summary

  • Run npm audit fix to patch 5 vulnerabilities (4 moderate, 1 high) in transitive deps:
    • hono: JSX injection (GHSA-69xw-7hcm-h432), CSS injection (GHSA-qp7p-654g-cw7p), JWT validation (GHSA-hm8q-7f3q-5f36), cache leakage (GHSA-p77w-8qqv-26rm)
    • ip-address: XSS in HTML-emitting methods (GHSA-v2v4-37r5-5v8g)
    • express-rate-limit: depends on vulnerable ip-address

Test plan

  • npm test — 128 passed, 1 skipped (3 suites)
  • npm run build — tsc succeeds
  • npm audit — 0 vulnerabilities

🤖 Generated with Claude Code

## Summary - Run `npm audit fix` to patch 5 vulnerabilities (4 moderate, 1 high) in transitive deps: - hono: JSX injection (GHSA-69xw-7hcm-h432), CSS injection (GHSA-qp7p-654g-cw7p), JWT validation (GHSA-hm8q-7f3q-5f36), cache leakage (GHSA-p77w-8qqv-26rm) - ip-address: XSS in HTML-emitting methods (GHSA-v2v4-37r5-5v8g) - express-rate-limit: depends on vulnerable ip-address ## Test plan - [x] `npm test` — 128 passed, 1 skipped (3 suites) - [x] `npm run build` — tsc succeeds - [x] `npm audit` — 0 vulnerabilities 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sdk-dev added 1 commit 2026-05-11 03:16:31 +00:00
fix(deps): npm audit fix — resolve 5 transitive vulnerabilities
CI / test (pull_request) Successful in 1m26s
Details
4272978ad2 
Patched 5 vulnerabilities (4 moderate, 1 high) in transitive deps:
- hono: JSX injection, CSS injection, JWT validation, cache leakage
- ip-address: XSS in HTML-emitting methods
- express-rate-limit: depends on vulnerable ip-address

Tests: 128 passed, 1 skipped (3 suites) — unchanged.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
sdk-lead merged commit 996a9f6230 into main 2026-05-11 03:26:39 +00:00
sdk-lead deleted branch fix/audit-fix-vulnerabilities 2026-05-11 03:26:46 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
merge-queue
PR ready for admin merge
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) plugin-dev (Molecule AI · plugin-dev) pm release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-mcp-server#3
Delete Branch "fix/audit-fix-vulnerabilities"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?