docs(security): record why the open advisories are unreachable here - #58
Open
CDVolvik wants to merge 1 commit into
Open
docs(security): record why the open advisories are unreachable here#58CDVolvik wants to merge 1 commit into
CDVolvik wants to merge 1 commit into
Conversation
Seven Dependabot alerts are open against the default branch, one of them high. All seven are transitive through @modelcontextprotocol/sdk: sdk -> @hono/node-server -> hono (4) sdk -> express-rate-limit -> ip-address (3, incl. the high SSRF one) They are production-tree dependencies, not dev-only, so dismissing them as dev noise would be wrong. What makes them unreachable is the transport: src/index.ts only ever constructs StdioServerTransport, never an HTTP or SSE one, so none of that code is loaded or bundled. Verified against a fresh build - dist/index.js has zero matches for any of the three. Adds a Dependency advisories section to SECURITY.md with the reasoning and a two-line command so a reader can confirm it rather than take it on faith. States explicitly that reachability is a reason not to panic, not a reason to skip the bump, so this does not become a standing excuse to stop patching. Docs only. No dependency, behaviour, or tool-surface change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
GitHub reports seven open advisories on the default branch, one of them high. Anyone landing on this repo sees that badge before they read a line of code, and for an EHR-adjacent tool that is the wrong first impression to leave unexplained.
All seven are transitive through
@modelcontextprotocol/sdk:These are production-tree dependencies, not dev-only — writing them off as dev noise would be wrong. What makes them unreachable is the transport.
src/index.tsonly ever constructsStdioServerTransport; it never instantiates an HTTP or SSE transport, so none of that code is loaded, and none of it is bundled. Confirmed against a fresh build:dist/index.jshas zero matches forhono,express-rate-limit, orip-address.This adds a Dependency advisories section to SECURITY.md recording that reasoning, plus a two-line command so a reader can verify it instead of taking it on faith.
It also says plainly that reachability is a reason not to panic, not a reason to skip the bump — so this does not calcify into a standing excuse to stop patching.
Note on overlap
Does not touch the stale-account line in SECURITY.md; #56 already fixes that. This section is additive and sits lower in the file.
Checklist
format:check,lint,typecheck,test,buildall pass locally