Repository navigation
chore(deps): build the bundled ajv with fast-uri 3.1.9 #3108
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| --- | ||
| '@modelcontextprotocol/client': patch | ||
| '@modelcontextprotocol/server': patch | ||
| --- | ||
|
|
||
| The bundled Ajv validator is now built with fast-uri 3.1.9 (was 3.1.8). A schema no longer compiles when a `$id` or `$ref` has a percent-encoded character before its first colon (`%61:b`), or `{` or `}` in the host of an `http`, `https`, `ws` or `wss` URL (`http://{host}/a`). Relative values keep their leading `..` segments: a `$ref` to a `$id` such as `../a` now resolves, and a `$ref` of only dot segments (`.`, `../`) no longer resolves to the root schema. Plain names, `#/$defs/...` references, other URLs and URNs are not affected. | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ | |
| * `dts.compilerOptions.paths` so the type is inlined as a plain named export. | ||
| * Runtime code is unaffected (this is a `.d.ts`; the path mapping is dts-only). | ||
| */ | ||
| // Field-for-field copy of fast-uri@3.1.9's URIComponent (types/index.d.ts). | ||
|
Contributor
Author
There was a problem hiding this comment. 🟣 pre-existing, not blocking: nit: CLAUDE.md principle 8 asks for one-line inline comments: the line this diff edits in fastUriShim.d.ts is the first of a two-line Why this was flaggedNothing fails at runtime. The instruction guards against inline comments growing past one line. This is a pre-existing layout nit: the comment was already two lines at the base commit, and the diff re-touches line 14 only to change 3.1.8 to 3.1.9, so the violation is unchanged in substance. The consequence is cosmetic. The 12-line header JSDoc above it is on a non-public file as well, but the diff does not touch it, so it is not part of this finding. Verification: Instruction: root CLAUDE.md at base b415e60, principle 8, verbatim as quoted: "Brief comments — Keep inline comments to one line and JSDoc to the public API; the reasoning goes in the commit message or PR description." It is a root-level convention, so it binds packages/core-internal/src/validators/fastUriShim.d.ts. Code: the diff changes line 14 ("// Field-for-field copy of fast-uri@ 3.1.9's URIComponent (types/index.d.ts).") which is the first line of a two-line Finding ID: |
||
| // Keep in sync when bumping fast-uri/ajv. | ||
| export interface URIComponent { | ||
| scheme?: string; | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 nit (optional): Users are told of four
$id/$refbehaviour changes that no test in the repo checks, so the changeset wording cannot be confirmed or kept true. The diff changes only the lockfile, a comment and the changeset;packages/core-internal/test/validators/validators.test.tshas one$idcase (https://example.com/schemas/test, line 328). Fix: add validator tests that compile schemas with the listed values (%61:b,http://{host}/a, a$refto$id../a, a$refof.or../) and assert the stated result for each. [also at: .changeset/bundled-fast-uri-3-1-9.md:6 - nit: CLAUDE.md principle 7 ("Test what users see") asks for tests of user-visible behaviour: this changeset announces four$id/$refbehaviour changes in the bundled Ajv validator (%61:bandhttp://{host}/ano longer compile, a$refto../anow resolves, a dot-segment-only$refno longer resolves to the root), and the diff adds no test for any of them.]Why this was flagged
No runtime failure; this is the check CLAUDE.md principle 7 asks for. The trigger is a schema whose
$idor$refis one of the values named in .changeset/bundled-fast-uri-3-1-9.md:6, reaching the bundled Ajv throughengine.compile(schema)at packages/core-internal/src/validators/ajvProvider.ts:135. The diff changes what that call does for those values (pnpm-lock.yaml:8821 moves ajv@ 8.18.0 to fast-uri 3.1.9) but adds no test, and a repo-wide search finds no test using%61,{host}or a dot-segment$id/$ref. On the base branch these schemas compiled (or resolved differently) and that was equally untested, but the base made no published claim about them. After merging, the released changelog states exact outcomes that nothing in CI verifies, and the next fast-uri bump can change them silently. No safeguard applies: node_modules is absent from the checkout, so the claims cannot be checked against the 3.1.9 source in review either.Verification: The diff touches only
.changeset/bundled-fast-uri-3-1-9.md, a one-line comment inpackages/core-internal/src/validators/fastUriShim.d.ts, andpnpm-lock.yaml. No test file is added or changed.packages/core-internal/test/validators/validators.test.ts:326-334is that file's only$idcase ($id: 'https://example.com/schemas/test').Finding ID:
f-03139411