Fix: upgrade @modelcontextprotocol/sdk to ^1.26.0#241
Conversation
… data leak CVE Upgrades @modelcontextprotocol/sdk from ^1.25.2 to ^1.26.0 (resolved 1.27.1) to address a cross-client data leak vulnerability caused by transport and server/protocol instance reuse in stateless deployments. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Updates the workspace’s Model Context Protocol (MCP) SDK dependency to a newer minor release in order to pick up fixes for a reported cross-client data leak vulnerability related to transport/server/protocol instance reuse.
Changes:
- Bump
@modelcontextprotocol/sdkin the workspace catalog from^1.25.2to^1.26.0. - Refresh
pnpm-lock.yamlto resolve the SDK to1.27.1and update related transitive dependencies.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Updates the workspace catalog version range for @modelcontextprotocol/sdk. |
| pnpm-lock.yaml | Updates the resolved MCP SDK version (to 1.27.1) and adjusts transitive dependency graph accordingly. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
|
||
| # Model Context Protocol SDK | ||
| "@modelcontextprotocol/sdk": "^1.25.2" | ||
| "@modelcontextprotocol/sdk": "^1.26.0" |
There was a problem hiding this comment.
PR description says the upgrade resolves to 1.27.1, but with the catalog specifier set to ^1.26.0 (and resolutionMode: "highest" in this workspace), the actual resolved version will float to the highest compatible release (currently 1.29.0 per the lockfile). Please update the PR description to match what will be installed, or pin the catalog entry to the intended tested version if you need to control the exact patch/minor used for the security fix.
Upgrades @modelcontextprotocol/sdk from ^1.25.2 to ^1.26.0 (resolved 1.27.1) to address a cross-client data leak vulnerability caused by transport and server/protocol instance reuse in stateless deployments.