From abceac9d7049ac2d3b9e166cd75853b9e573ccb9 Mon Sep 17 00:00:00 2001
From: Mariano Fuentes <marfuen98@gmail.com>
Date: Wed, 15 Jul 2026 10:50:05 -0400
Subject: [PATCH] fix(deps): patch tmp and js-yaml in mcp-server (Dependabot
 #58/#59/#71)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

apps/mcp-server is a standalone npm project (excluded from the bun
workspaces). Three open Dependabot alerts, all dev-scope transitives:
- #59 (high) + #58 (low): tmp path traversal / symlink write — tmp@0.0.33
  via external-editor; patched in tmp>=0.2.6
- #71 (moderate): js-yaml quadratic-complexity DoS — js-yaml@4.1.1 via
  @eslint/eslintrc; patched in js-yaml>=4.2.0

Add npm overrides (caret-pinned to stay within the safe major):
- tmp ^0.2.6  -> resolves 0.2.7 (fileSync API is stable, external-editor works)
- js-yaml ^4.2.0 -> resolves 4.3.0 (satisfies eslintrc's ^4.1.1; NOT floated to
  v5, which would be an unvetted breaking major)

Verified: npm audit 0 vulnerabilities; mcp-server build + lint pass.
(bun.lock is gitignored and regenerated from package-lock.json at build.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/mcp-server/package-lock.json | 57 +++++++++++++++----------------
 apps/mcp-server/package.json      |  4 ++-
 2 files changed, 30 insertions(+), 31 deletions(-)

diff --git a/apps/mcp-server/package-lock.json b/apps/mcp-server/package-lock.json
index d2d56669f2..975a53171b 100644
--- a/apps/mcp-server/package-lock.json
+++ b/apps/mcp-server/package-lock.json
@@ -208,6 +208,29 @@
         "node": ">= 4"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "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/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "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/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
     "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -2555,19 +2578,6 @@
         "url": "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/sponsors/panva"
       }
     },
-    "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^2.0.1"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -2824,16 +2834,6 @@
         "node": ">= 0.8.0"
       }
     },
-    "node_modules/os-tmpdir": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz",
-      "integrity": "sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/p-limit": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
@@ -3316,16 +3316,13 @@
       }
     },
     "node_modules/tmp": {
-      "version": "0.0.33",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz",
-      "integrity": "sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
+      "integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "os-tmpdir": "~1.0.2"
-      },
       "engines": {
-        "node": ">=0.6.0"
+        "node": ">=14.14"
       }
     },
     "node_modules/toidentifier": {
diff --git a/apps/mcp-server/package.json b/apps/mcp-server/package.json
index e0a74fef07..fc6337ff27 100644
--- a/apps/mcp-server/package.json
+++ b/apps/mcp-server/package.json
@@ -29,7 +29,9 @@
   "overrides": {
     "@modelcontextprotocol/sdk": "1.26.0",
     "hono": ">=4.12.25",
-    "fast-uri": ">=3.1.2"
+    "fast-uri": ">=3.1.2",
+    "tmp": "^0.2.6",
+    "js-yaml": "^4.2.0"
   },
   "devDependencies": {
     "@anthropic-ai/mcpb": "^1.2.0",