fix(deps): close the sharp and hono/node-server alerts by reachability - #1611
Conversation
The two alerts #1599 deliberately left open, both blocked on a parent's declared range, now close on a different basis: the vulnerable code is unreachable from Push, so forcing past the range risks nothing Push runs. sharp (Dependabot #101, high) goes to ^0.35.0 (resolves 0.35.3, libvips 8.18.3), above @huggingface/transformers@4.2.0's declared ^0.34.5. Push's only transformers usage is the text feature-extraction pipeline in cli/embedding-provider-local.ts; sharp is transformers' image path and is never invoked by it. This also retires the older ^0.33.5 pin that held sharp a minor below the parent's own range. The override comment records the decision and its re-check condition: any future image or vision pipeline revisits this before shipping. hono/node-server (Dependabot #100, medium; Windows path traversal in serve-static) goes to ^2.0.5 (resolves 2.0.12), a major across @modelcontextprotocol/sdk's declared ^1.19.9. mcp/github-server is stdio-only - StdioServerTransport at its sole entry point - and the SDK's HTTP transports, the only consumers of @hono/node-server, never load at runtime. Drop the override when the SDK declares 2.x. Verified by execution, not inference: sharp 0.35.3 loads from the pnpm store with its rebuilt native binding, @huggingface/transformers imports with pipeline intact, and Biome's ride-along patch bump (2.5.4 to 2.5.5) produced zero format drift across 1,566 files. Suites: MCP 74, CLI 3,658, app 7,472, typecheck:all - all clean. app/electron's separate lockfile contains neither package. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DaybLeYWBmRbfmgT9zjuxE
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
push | 5f7a1b5 | Jul 26 2026, 10:56 PM |
![push-agent[bot]](https://avatars.githubusercontent.com/in/2801157?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is a clean, well-documented security dependency bump: the vulnerable Sharp (<0.35) and @hono/node-server (<2.0.5) versions are replaced, and the regenerated lockfile is internally consistent (color/simple-swizzle dropped in favor of @img/colour, new platform variants added, peer @types/node threaded through). I traced both out-of-range overrides to their production entry points and confirmed the workspace comments' reachability claims hold: the MCP server is stdio-only and never imports the SDK's Hono-backed HTTP transports, and the local embedding path uses only Transformers' text feature-extraction pipeline, never Sharp's image code. Node-version floors (>=20.9 / >=20) are satisfied since all CI jobs and both package.json engines require Node 24.
Review by Push · fugu
1 participant
The two Dependabot alerts #1599 deliberately left open — both blocked on a patched version violating the range its parent declares — close on a different basis: the vulnerable code is unreachable from Push, so forcing past the range risks nothing Push runs.
sharp — alert #101 (high) →
^0.35.0(resolves 0.35.3)Forced above
@huggingface/transformers@4.2.0's declared^0.34.5, justified by usage: Push's only transformers surface is the textfeature-extractionpipeline incli/embedding-provider-local.ts(an optional dependency at that, loaded via computed specifier). sharp is transformers' image path — never invoked by text embedding. This also retires the pre-existing^0.33.5pin that #1599 flagged as an unexplained below-range downgrade holding sharp in the vulnerable set. The override comment records the decision and its re-check trigger: any future image/vision pipeline revisits this before shipping.@hono/node-server — alert #100 (medium) →
^2.0.5(resolves 2.0.12)A major forced across
@modelcontextprotocol/sdk's declared^1.19.9— which #1599 rightly called "an upgrade of the MCP server," if the HTTP transports ran. They don't:mcp/github-serveris stdio-only (StdioServerTransportat its sole entry point), and the SDK's HTTP transports are the only consumers of@hono/node-server. The vulnerableserve-static(Windows path traversal) never loads. Drop condition documented: SDK declaring 2.x.Verified by execution, not inference
sharp@0.35.3loads from the pnpm store with its rebuilt native binding —versions.sharp: 0.35.3, libvips: 8.18.3@huggingface/transformersimports withpipelineintactformat:checkclean across 1,566 filesTMPDIRinvocation), app 7,472 / 4 todo,typecheck:allcleanapp/electron's separate lockfile contains neither package — no mirror needed (the fix(deps): patch fast-uri and tar, cover app/electron in Dependabot #1599 gotcha checked)Lockfile diff is the two package moves, their platform-binary dependents, and the biome patch.
🤖 Generated with Claude Code
https://claude.ai/code/session_01DaybLeYWBmRbfmgT9zjuxE