Skip to content

[Snyk] Upgrade @modelcontextprotocol/sdk from 1.12.1 to 1.25.3 - #62

Merged
djannot merged 1 commit into
mainfrom
snyk-upgrade-5a9d5caf6d8cc21a691edbd855ca1f4b
Aug 19, 2026
Merged

[Snyk] Upgrade @modelcontextprotocol/sdk from 1.12.1 to 1.25.3#62
djannot merged 1 commit into
mainfrom
snyk-upgrade-5a9d5caf6d8cc21a691edbd855ca1f4b

Conversation

@peterj

@peterj peterj commented Feb 20, 2026

Copy link
Copy Markdown
Contributor

snyk-top-banner

Snyk has created this PR to upgrade @modelcontextprotocol/sdk from 1.12.1 to 1.25.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 38 versions ahead of your current version.

  • The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AJV-15274295		 803 Proof of Concept
high severity Insecure Default Initialization of Resource
SNYK-JS-MODELCONTEXTPROTOCOLSDK-14171914		 803 No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MODELCONTEXTPROTOCOLSDK-14871802		 803 Proof of Concept
Release notes
Package name: @modelcontextprotocol/sdk

@snyk-bot
fix: upgrade @modelcontextprotocol/sdk from 1.12.1 to 1.25.3
28ed63c 
Snyk has created this PR to upgrade @modelcontextprotocol/sdk from 1.12.1 to 1.25.3.

See this package in npm:
@modelcontextprotocol/sdk

See this project in Snyk:
https://app.snyk.io/org/kagent/project/8e104b77-2401-41e5-860c-f1d50686348a?utm_source=github&utm_medium=referral&page=upgrade-pr
@inFocus7 inFocus7 mentioned this pull request Aug 18, 2026
Closed
@djannot
djannot merged commit e3bdf29 into main Aug 19, 2026
2 of 3 checks passed
@djannot djannot mentioned this pull request Aug 19, 2026
Merged
djannot added a commit that referenced this pull request Aug 19, 2026
@djannot
feat(deps): upgrade puppeteer to 25, axios to 1.19, better-sqlite3 to…
5f0b5c3 
… 13; require Node >= 22 (#110)

* feat(deps): upgrade puppeteer to 25, axios to 1.19, better-sqlite3 to 13; require Node >= 22

Final dependency upgrade for the security cleanup in #109:

- puppeteer ^25.8.0: drops the vulnerable extract-zip dependency
  (SNYK-JS-EXTRACTZIP-17660777 has no fixed release; puppeteer 25 replaced
  extract-zip with modern-tar). Code adapted to the v25 API: executablePath()
  is now async, browser.isConnected() became the .connected property.
- axios ^1.19.0: clears all advisories flagged up to 1.17.x.
- js-yaml ^4.3.1 (as planned in #109).
- better-sqlite3 ^13.0.3 in root and mcp: 11.x cannot compile on Node >= 26
  (uses removed V8 APIs).
- Node: puppeteer 25 is ESM-only and needs Node >= 22, so package.json now
  declares engines.node >= 22 and the Docker image moves from node:20-slim
  (EOL) to node:26-slim.
- mcp: repair the build broken since #62 bumped the MCP SDK to 1.25.3 —
  capabilities moved to McpServer's options argument, zod ^3.25.0 with an
  npm override so the SDK no longer nests zod 4 next to the app's zod 3,
  @qdrant/js-client-rest pinned to ^1.16.2 (1.17+ drops the search method
  the server relies on).
- tests: stub puppeteer.executablePath in the four crawlWebsite tests that
  run it under fake timers (it does real I/O since v25 and the retry timer
  was scheduled after the timer advance, hanging the crawl); restore real
  timers in the crawlWebsite afterEach so a failing test can no longer leak
  frozen timers into the rest of the block.

Verified on Node 26.7.0: root build, mcp build, full vitest suite
(723 passed / 8 skipped). npm audit: axios/puppeteer/extract-zip advisories
cleared; mcp reports 0 vulnerabilities.

Signed-off-by: Denis Jannot <denis.jannot@solo.io>

* fix(docker): drop fonts-kacst, removed in Debian trixie (node:26-slim base)

The package was orphaned and dropped from trixie; it only provided Arabic
display fonts, which doc2vec never needs — pages are text-extracted, not
rendered to images.

Signed-off-by: Denis Jannot <denis.jannot@solo.io>

* fix(deps): bump @qdrant/js-client-rest to 1.19 for Node 26 fetch compatibility

The 1.13 client builds an Agent from its bundled undici 5 and passes it as
the dispatcher to the global fetch — on Node 26 that's undici 7, whose
dispatch-handler protocol differs, so every request dies with
'fetch failed' (cause: InvalidArgumentError: invalid onError method).
1.19.0 ships undici 7.29 and works against a real Qdrant from the image
(verified with docker). The root sync code doesn't use the search API that
1.17 removed, so unlike mcp it can take the latest client.

Signed-off-by: Denis Jannot <denis.jannot@solo.io>

* fix(embeddings): fail loudly instead of silently losing chunks when embedding fails

A rejected embedding request (e.g. an invalid OpenAI API key) was swallowed
at every layer: createEmbeddings caught all errors and returned [], callers
logged 'Embedding failed for chunk' per chunk and moved on, and both
processChunksForUrl and the GitHub processIssue path deleted the item's
existing chunks BEFORE embedding — so a bad key deleted stored chunks,
stored nothing back, advanced the sync markers (ETag/lastmod, last-run
date), and the run finished green.

Now:
- createEmbeddings throws FatalEmbeddingError on 401/403 — an auth failure
  is permanent, so the source aborts instead of degrading every chunk into
  a logged-and-skipped failure. Transient errors still return [].
- FatalEmbeddingError is rethrown through every per-item catch (website
  page callback + crawl loop, GitHub issue, Zendesk ticket, local dir, S3,
  code file), so a bad key fails the source on the first chunk.
- processChunksForUrl and processIssue embed all chunks BEFORE deleting
  the old ones; on any embedding failure the existing chunks are kept and
  the item fails: websites don't store ETag/lastmod (page retried next
  run), GitHub counts it toward failedChunks (last-run date not advanced),
  Zendesk counts failedTickets.

Tests: 6 new cases covering the fatal 401/403 path, transient-failure
tolerance, and that existing chunks are never deleted when embedding fails.

Signed-off-by: Denis Jannot <denis.jannot@solo.io>

---------

Signed-off-by: Denis Jannot <denis.jannot@solo.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@peterj @djannot @snyk-bot