Repository navigation
Dependency refresh: Alpine 3.24.2 pins, deps-watch publish gate, MCP SDK 2.3.1 (alpha.41 candidate) - #91
Merged
Conversation
…3 3.5.9-r0, zlib 1.3.2-r1) Found by the first manual deps-watch dispatch (platform-verification run 38779130973). That run's verified candidate and this local refresh-bwrap run are identical (branch hash febba56facfe513a). Both independent builds matched, and the bundled binary identity is unchanged; only the build host closure moved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…ed pin PR The first manual dispatch (run 38779130973) verified an Alpine 3.24.2 pin candidate, but deps-publish was skipped because it required the whole deps-watch job to succeed and that job's dependency report failed on unrelated findings. The refresh step now sets a job output only when refresh-bwrap exits 0. deps-publish runs on that output (not on the job result), so the watch job stays red and visible while the pin PR is still opened. Permissions, the base-sha checkout and never-merge are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…urity review of 7780dc3) Gating deps-publish only on the verified refresh failed open: before 7780dc3 a signature problem or a CRITICAL (malware) finding blocked the publisher through the job result, and after it nothing did. A new integrity step (`deps-watch.mjs --integrity`, reading the newest report) sets `integrity-clear` only when registry signatures are complete (invalid 0, missing 0), no finding is CRITICAL and the watch is not incomplete. deps-publish needs both refresh-verified and integrity-clear. Ordinary HIGH/MEDIUM advisories keep the job red but no longer hold back a verified pin candidate. A missing or unreadable report counts as not clear. The 2026-10-15 dispatch report is clear (HIGH advisories only). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…llows; source-map-js 1.2.2 (dev) Owner 2026-10-15: integrate SDK 2.3.1. Its tarballs still embed fast-uri 3.1.0 (and ajv 8.18.0) in ajvProvider. The accepted risk moves to the 2.3.1 carriers and adds GHSA-hrr3-gc8f-f4qj (MEDIUM, the same host-confusion class); the mitigation is unchanged (not shipped + Deckent's own validator) and the expiry stays 2026-10-29. @modelcontextprotocol/core moves 2.2.0 -> 2.3.1 with it. The SDK's nested zod is now 4.6.7; embedded component lists are unchanged (check-embedded-deps). Evidence: typecheck clean; the local deps-watch reports CRITICAL 0, HIGH 0, MITIGATED 18, exit 0. build:dist is publishable and its SBOM names no ajv/fast-uri. Mutation: disabling the ajv stub makes build:dist refuse "would ship the MCP SDK's ajv/fast-uri (FASTURI-OUT)". 59 MCP, validator, dist and workflow test files pass, after one expectation was updated from the server@2.2.0 carrier name to 2.3.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
…alpha.40 recorded as released Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner 2026-10-15 decisions after the first manual deps-watch dispatch (platform-verification run 38779130973):
refresh-verifiedplusintegrity-clear(registry signatures complete, no CRITICAL finding, watch complete) instead of the whole job result. Ordinary advisories keep the watch red but no longer block the pin PR. The second commit closes a fail-open that a security review flagged on the first.Local deps-watch: CRITICAL 0, HIGH 0, MITIGATED 18, exit 0.
🤖 Generated with Claude Code
https://claude.ai/code/session_017uL4HZTS1oaVHovPUKoRXP