npm audit --omit=dev at the repo root reports one high severity vulnerability in the production tree, on both main and v2/main (identical version, so it is not drift — see #2057, which is about parity and deliberately leaves this alone):
nanoid 3.3.16 severity=high vulnerable: <3.3.18 fixAvailable: true
GHSA-2v37-7h3g-55p8 — custom generators can loop indefinitely when size is zero
It is transitive, three levels down:
@modelcontextprotocol/inspector
└─┬ vite@8.2.0
└─┬ postcss@8.5.25
└── nanoid@3.3.16
Dependabot has not raised it — plausibly because the advisory is only reachable through a postcss range that its security updates consider already satisfied, or because it is grouped with updates it has open elsewhere. Worth confirming rather than assuming.
Notes
npm audit fix reports a fix is available, so this is likely a lockfile-only bump of nanoid (or of postcss), not a vite major.- Reachability is probably nil in practice — the affected path needs a custom generator called with
size: 0, and nothing here calls nanoid directly; it arrives through PostCSS's source-map machinery. That argues for treating this as hygiene rather than an incident, but the audit output is a standing red mark on the release branch either way, and a clean npm audit is worth having so a real finding is not lost in noise.
- Note
vite is declared in root dependencies, not devDependencies, which is why this shows under --omit=dev at all. Whether that placement is correct is a separate question worth a look while here — per the placement rule in AGENTS.md, a package only the build tooling needs belongs in devDependencies.
Scope
Bump the transitive dependency to a non-vulnerable version, confirm npm audit --omit=dev is clean at the root and in each client install, and run npm run ci.
npm audit --omit=devat the repo root reports one high severity vulnerability in the production tree, on bothmainandv2/main(identical version, so it is not drift — see #2057, which is about parity and deliberately leaves this alone):It is transitive, three levels down:
Dependabot has not raised it — plausibly because the advisory is only reachable through a
postcssrange that its security updates consider already satisfied, or because it is grouped with updates it has open elsewhere. Worth confirming rather than assuming.Notes
npm audit fixreports a fix is available, so this is likely a lockfile-only bump ofnanoid(or ofpostcss), not avitemajor.size: 0, and nothing here callsnanoiddirectly; it arrives through PostCSS's source-map machinery. That argues for treating this as hygiene rather than an incident, but the audit output is a standing red mark on the release branch either way, and a cleannpm auditis worth having so a real finding is not lost in noise.viteis declared in rootdependencies, notdevDependencies, which is why this shows under--omit=devat all. Whether that placement is correct is a separate question worth a look while here — per the placement rule in AGENTS.md, a package only the build tooling needs belongs indevDependencies.Scope
Bump the transitive dependency to a non-vulnerable version, confirm
npm audit --omit=devis clean at the root and in each client install, and runnpm run ci.