Fix security vulnerabilities in dependencies

[courtenay]

Hey, I was checking out this repo to help with compliance and noticed some stuff out of date, so set my claude to update the libraries and then fix the various zod errors and such. There isn't a test suite that I could find, but also fixed a bunch of ESlint errors.

AI slop 100% after this line!

---

Summary

• Upgrade all dependencies to resolve 11 security vulnerabilities (now 0)
• Fix build and lint errors caused by breaking changes in updated packages

Changes

Dependencies updated:

• @modelcontextprotocol/sdk 1.6.0 → 1.25.3
• zod 3.x → 4.3.6
• eslint 8.x → 9.39.2
• typescript 5.8.2 → 5.9.3
• Other dev dependencies to latest

Code changes for compatibility:

• Update Zod type definitions (ZodTypeAny → ZodType for v4)
• Fix type inference for URL params
• Exclude src/eval from build (requires optional transitive dependency)
• Fix lint errors flagged by stricter ESLint rules

Security vulnerabilities fixed

Severity	Package	Issue
Critical	qs	Prototype pollution
High	qs	DoS via memory exhaustion
Moderate	eslint	Stack overflow with circular refs
Moderate	js-yaml	Prototype pollution
Low	brace-expansion	ReDoS (multiple instances)

Test plan

• yarn build passes
• yarn lint passes
• yarn audit shows 0 vulnerabilities

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​typescript-eslint/​parser@​7.18.0 ⏵ 8.54.0			+1
	npm/​@​typescript-eslint/​eslint-plugin@​7.18.0 ⏵ 8.54.0	+1		+1
	npm/​eslint-config-prettier@​9.1.0 ⏵ 10.1.8	+1		+29
	npm/​typescript@​5.8.2 ⏵ 5.9.3	+1		+1
	npm/​prettier@​3.5.3 ⏵ 3.8.1	-7		+1
	npm/​@​eslint/​js@​8.57.1 ⏵ 9.39.2			+14
	npm/​eslint@​8.57.1 ⏵ 9.39.2	-2	+2	+1	+47
	npm/​zod@​3.24.2 ⏵ 4.3.6				-1
	npm/​openai@​4.91.1 ⏵ 6.17.0	+1		+1
	npm/​@​modelcontextprotocol/​sdk@​1.8.0 ⏵ 1.25.3		+22
	npm/​@​types/​node@​18.19.86 ⏵ 25.2.0	+1		+20	+5

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Publisher changed: npm cors is now published by ulisesgascon Author: ulisesgascon From: ? → npm/@modelcontextprotocol/sdk@1.25.3 → npm/cors@2.8.6 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cors@2.8.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm require-from-string was last published 8 years ago Last Publish: 4/9/2018, 9:49:47 AM From: ? → npm/@modelcontextprotocol/sdk@1.25.3 → npm/require-from-string@2.0.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/require-from-string@2.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report