[maxigimenez]

Owner: @maxigimenez

Closes the Vanta finding for Dependabot alert 188.

What and why

package	from	to	severity	via
undici	7.29.1	7.30.1	HIGH	release-it (devDependency)

• GHSA-xjj6-f33q-929c / CVE-2026-109869, HIGH
• Vanta remediateByDate: 2026-11-26 — 29 days remaining
• Affected range: >= 7.18.0, < 7.30.1

Advisory impact, from the undici 7.30.1 release notes: returning more than five content codings could crash the process through an unhandled stream error.

Exposure

Development. npm ls undici resolves one path only:

@currents/mcp@2.7.0
`-- release-it@21.0.1 overridden
  `-- undici@7.30.1 overridden

release-it is a devDependency used by the release workflow. undici does not reach dist/, the published @currents/mcp package, or the Docker image — the bundle is built by tsdown from src/, and release-it is not among its inputs.

The fix

Mechanism: transitive-pin, bumping the override that is already in mcp-server/package.json.

   "overrides": {
     "release-it": {
-      "undici": "7.29.1"
+      "undici": "7.30.1"
     }
   }

Parent-scoped (release-it → undici) rather than a bare "undici" key, matching what the file already does. A plain lockfile refresh cannot do this: release-it@21.0.2 declares "undici": "7.29.0" as an exact pin, and the newest release-it on npm (21.1.1) still pins only 7.29.1, so no upstream release carries the fix yet. The override is the narrowest mechanism available.

Breaking-change check

undici v7.30.1 release notes — a security and maintenance release fixing eight advisories, with five backported changes, a cookie-parser fix and a TLS session-cache fix. No breaking-change, removal or deprecation section. Patch bump within 7.x.

Verification

Run in this session against this branch's head:

command	result
npm install	clean, no new peer-dependency warnings
git diff --name-only	mcp-server/package.json, mcp-server/package-lock.json
npm run verify (format → sync-readme:check → tsc --noEmit → build → vitest run)	pass — 35 files, 1198 tests

Lockfile diff is one stanza (undici) plus the one override line. The libc keys that npm 10.9.4 strips from optional platform packages were restored so the diff carries nothing unrelated.

CI coverage

Triggers test.yml (pull_request → main, no paths filter). Does not trigger publish.yaml, release.yaml, promote.yaml (all workflow_dispatch), linear-release.yaml or post-release.yaml (push/close on main), or sync-from-monorepo.yaml (scheduled).

What a human should still check

undici is on the sensitive-by-name list, so this is Tier B and does not auto-merge even though every entry it moves is development-scope. Two things worth a look:

1. The override forces undici past release-it's exact 7.29.0 pin. npm run verify passes, but it does not exercise a real release. A npm run release:dry before the next release would confirm the publish path still works.
2. Nothing else in the tree reads undici, so the blast radius is the release tooling alone.

Not in this PR

• body-parser 2.3.0 → 2.4.0 (alert 181, HIGH) is already covered by chore(deps): bump body-parser from 2.3.0 to 2.4.0 in /mcp-server #246; triaged there rather than duplicated here.
• qs 6.16.0 → 6.17.0 is covered by chore(deps): bump qs from 6.16.0 to 6.17.0 in /mcp-server #247.

Needs release

None. Development-scope only — nothing to publish.

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Raise the release-it transitive undici override to 7.30.1 to remediate a high-severity development dependency vulnerability. Update the package manifest and lockfile while preserving the release tooling dependency path.

Latest Contributors(2)

User	Commit	Date
noreply@anthropic.com	fix(deps): raise the r...	October 28, 2026
dj@currents.dev	Merge pull request #24...	October 27, 2026

---

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}

[maxigimenez]

Verdict: Tier B — needs a human decision, not auto-merged

CI on head c0bfb78, every check the diff triggers:

check	conclusion
Test (Node 20.x)	success
Test (Node 22.x)	success
Test (Node 24.x)	success
Baz Reviewer	success

test.yml is the only workflow this diff triggers, and it ran. Local npm run verify passed against the same head: 35 test files, 1198 tests.

Why it is not auto-merged

Everything this PR moves is development-scope — npm ls undici resolves one path, through release-it. On scope alone it would qualify. It does not, because undici is on the sensitive-by-name list, which is a Tier B trigger regardless of how a package resolves. That one line is the whole difference between this PR and one that merges itself.

The substantive thing to weigh is in the PR body: the override forces undici past release-it's exact 7.29.0 pin, and no upstream release-it yet ships a version that satisfies the advisory. Nothing in CI exercises a real publish, so a npm run release:dry before the next release is the check worth doing.

---

Generated by Claude Code