Skip to content

feat: update critical dependencies and fix vulnerabilities#184

Open
0xAxiom wants to merge 2 commits intomainfrom
feat/update-critical-dependencies
Open

feat: update critical dependencies and fix vulnerabilities#184
0xAxiom wants to merge 2 commits intomainfrom
feat/update-critical-dependencies

Conversation

@0xAxiom
Copy link
Owner

@0xAxiom 0xAxiom commented Mar 14, 2026

Dependency Updates & Security Fixes

This PR updates critical dependencies with major version changes and resolves additional security vulnerabilities.

Major Updates:

  • @anthropic-ai/mcpb: 1.2.0 → 2.1.2 ✨ (latest MCP features)
  • eslint: 9.39.2 → 10.0.3 ✨ (improved linting rules)
  • @eslint/js: 9.39.2 → 10.0.1 ✨ (ESLint core updates)
  • globals: 15.15.0 → 17.4.0 ✨ (updated global definitions)
  • typescript: 5.3.0 → 5.8.4 ✨ (latest TypeScript features)

Security Fix:

  • 🔴 Fixed: flatted DoS vulnerability (unbounded recursion in parse())

Benefits:

  • Latest MCP protocol support via @anthropic-ai/mcpb 2.x
  • Improved ESLint rules with better error detection
  • TypeScript 5.8 features (decorators, satisfies operator improvements)
  • Zero vulnerabilities in root dependencies
  • Better IDE support with updated type definitions

Testing:

  • All packages install successfully
  • npm audit shows 0 vulnerabilities in root
  • Linting and formatting work correctly
  • No breaking changes in existing code

Related:

This brings AppFactory dependencies up to latest major versions for security and feature improvements.

- Updated @anthropic-ai/mcpb from 1.2.0 to 2.1.2 (MAJOR)
- Updated eslint from 9.39.2 to 10.0.3 (MAJOR)
- Updated @eslint/js from 9.39.2 to 10.0.1 (MAJOR)
- Updated globals from 15.15.0 to 17.4.0 (MAJOR)
- Updated typescript from 5.3.0 to 5.8.4
- Fixed flatted DoS vulnerability (CVE high)

Improves: security, MCP compatibility, linting rules, TypeScript features
@0xAxiom 0xAxiom requested a review from MeltedMindz as a code owner March 14, 2026 06:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant