[Chisanan232]

Jira Ticket

https://lightning-dust-mite.atlassian.net/browse/AAASM-6358

Summary

dependency-audit (pnpm audit --audit-level=high) fails on every node-sdk PR (it only runs on pull_request, so main never shows it), failing the aggregate CI Success. Three advisories, all transitive via @openai/agents-core > @modelcontextprotocol/sdk > express:

• proxy-addr GHSA-jqcg-44mw-7w3h (critical) → floor ^2.0.8
• source-map-js GHSA-68fv-2mgg-jv7q (high) → floor ^1.2.2
• @modelcontextprotocol/sdk GHSA-6qxp-vccf-f47h (high) → floor ^1.31.0 (resolves 1.32.1)

Floors are added to pnpm-workspace.yaml overrides, per the file's existing convention (pnpm 11 ignores package.json overrides). No audit suppression.

Evidence

• Reproduced on main before the change (3 vulnerabilities: 1 critical, 2 high).
• After: pnpm audit --audit-level=high → "No known vulnerabilities found".
• pnpm typecheck clean; pnpm test 748 passed, 2 skipped (74 files).
• Lockfile diff: only proxy-addr 2.0.7→2.0.8, MCP SDK 1.29.0→1.32.1, source-map-js dedupe.

Unblocks PR #522 (AAASM-6352).

🤖 Generated with Claude Code

https://claude.ai/code/session_01M2jR4NNxxSWJokWJqTu4nd

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Chisanan232]

LGTM / owner self-review record (head 4816185*, full SHA verified at merge).

Reviewed the full diff: pnpm-workspace.yaml overrides add floors proxy-addr ^2.0.8, source-map-js ^1.2.2, @modelcontextprotocol/sdk ^1.31.0 (GHSA-jqcg-44mw-7w3h critical, GHSA-68fv-2mgg-jv7q, GHSA-6qxp-vccf-f47h); pnpm-lock.yaml changes are limited to proxy-addr 2.0.7→2.0.8, MCP SDK 1.29.0→1.32.1 and a source-map-js dedupe. No audit suppression. Reproduced the failing pnpm audit --audit-level=high on main, then "No known vulnerabilities found" after the change; pnpm typecheck clean and pnpm test 748 passed locally. All checks green on this exact head incl. dependency-audit; mergeable; no unresolved finding.

Merging under the owner-only admin-merge exception (AAASM-5858) and the founder owner-admin-merge policy: verified identity Chisanan232 (org role admin); the only blocker is same-identity REVIEW_REQUIRED. Merge commit.

🤖 Generated with Claude Code