[Snyk] Fix for 1 vulnerabilities

[chelojimenez]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• mcpjam-inspector/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Inefficient Algorithmic Complexity SNYK-JS-BRACEEXPANSION-17706650

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

---

Note

Medium Risk
Major devDependency upgrades (especially ESLint 10) can break lint/CI; coverage-v8 v4 alongside vitest 3.x may cause test-coverage peer issues despite no runtime app code changes.

Overview
Snyk-driven dependency version bumps in mcpjam-inspector/package.json to address a high-severity brace-expansion inefficient-complexity issue (transitive via the upgraded toolchain).

@sentry/vite-plugin moves from ^4.3.0 to ^5.0.0 (build-time Sentry upload). @vitest/coverage-v8 moves from ^3.2.4 to ^4.0.0, while vitest remains on ^3.2.4—worth confirming coverage still runs cleanly. eslint moves from ^9 to ^10.0.0, which may require config or rule adjustments in CI and local lint.

^{Reviewed by Cursor Bugbot for commit a52b1e8. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades dev dependencies in mcpjam-inspector/package.json to fix a high-severity transitive vulnerability in brace-expansion (inefficient algorithmic complexity). This bumps @sentry/vite-plugin, @vitest/coverage-v8, and eslint to new major versions—please verify build, test, and lint configs.

• Dependencies
  • @sentry/vite-plugin: ^4.3.0 → ^5.0.0
  • @vitest/coverage-v8: ^3.2.4 → ^4.0.0
  • eslint: ^9 → ^10.0.0

^{Written for commit a52b1e8. Summary will update on new commits.}

[chelojimenez]

This update includes major version upgrades for eslint, vitest, and @sentry/vite-plugin, introducing significant breaking changes that require developer action. The overall risk is high due to mandatory configuration migrations and Node.js version requirements.

Top 3 Most Impactful Upgrades

• eslint 9.39.4 → 10.0.0 (High Risk)
  This major upgrade completely removes the legacy .eslintrc configuration system. You must migrate to the new flat config (eslint.config.js) format. Additionally, support for Node.js versions below 20.19.0 has been dropped. [2, 3]

  Recommendation: Before merging, create and validate an eslint.config.js file to replace your existing .eslintrc configuration. Ensure your development and CI environments are using Node.js v20.19.0 or later. [3]

• @vitest/coverage-v8 3.2.6 → 4.0.0 (High Risk)
  As part of the Vitest v4.0 release, this upgrade requires Node.js >= 20 and Vite >= 6.0.0. [10] The coverage provider has changed significantly: the coverage.all option has been removed, and you must now explicitly define coverage.include in your configuration to report on uncovered files. [10] Failure to do so will result in incomplete coverage reports.

  Recommendation: Update your vitest.config.ts to use Node.js v20+ and add a coverage.include pattern to maintain your desired coverage reporting behavior. [10]

• @sentry/vite-plugin 4.9.1 → 5.0.0 (Medium Risk)
  This major version drops support for Node.js versions older than v18. [19] While less strict than the other packages, this is an important environmental requirement to verify. The deprecated getBuildInformation function has also been removed. [16]

  Recommendation: Verify that your build environment uses Node.js v18 or newer.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b07a70fd-7128-4302-bf49-dfa36108376f)

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

Internal preview

Preview URL will appear in Railway after the deploy finishes.
Deployed commit: 2a43e63
PR head commit: a52b1e8
Backend target: staging fallback.
Access is employee-only in non-production environments.

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="mcpjam-inspector/package.json">

<violation number="1" location="mcpjam-inspector/package.json:141">
P1: Regenerate package-lock.json with these dependency bumps; current lockfile remains on old specs, so npm ci will not apply this security fix and may fail as out of sync.</violation>

<violation number="2" location="mcpjam-inspector/package.json:230">
P2: Keep @vitest/coverage-v8 on the same major/exact version as Vitest, or update vitest to 4.0.0 too; Vitest 4 coverage has an exact Vitest 4 peer and will create an invalid test toolchain with vitest 3.2.4.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Regenerate package-lock.json with these dependency bumps; current lockfile remains on old specs, so npm ci will not apply this security fix and may fail as out of sync.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At mcpjam-inspector/package.json, line 141:

<comment>Regenerate package-lock.json with these dependency bumps; current lockfile remains on old specs, so npm ci will not apply this security fix and may fail as out of sync.</comment>

<file context>
@@ -138,7 +138,7 @@
     "@sentry/node": "^8.47.0",
     "@sentry/react": "^8.47.0",
-    "@sentry/vite-plugin": "^4.3.0",
+    "@sentry/vite-plugin": "^5.0.0",
     "@tanstack/react-virtual": "^3.13.12",
     "@workos-inc/authkit-react": "^0.12.0",
</file context>

[cubic-dev-ai]

P2: Keep @vitest/coverage-v8 on the same major/exact version as Vitest, or update vitest to 4.0.0 too; Vitest 4 coverage has an exact Vitest 4 peer and will create an invalid test toolchain with vitest 3.2.4.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At mcpjam-inspector/package.json, line 230:

<comment>Keep @vitest/coverage-v8 on the same major/exact version as Vitest, or update vitest to 4.0.0 too; Vitest 4 coverage has an exact Vitest 4 peer and will create an invalid test toolchain with vitest 3.2.4.</comment>

<file context>
@@ -227,12 +227,12 @@
     "@typescript-eslint/parser": "^8.53.1",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.0.0",
     "autoprefixer": "^10.4.21",
     "concurrently": "^9.1.0",
</file context>