[solomonjames]

Closes #309

Summary

Clears the OSV-Scanner findings that fail osv-scanner / osv-scan on both open Dependabot PRs (#307, #308), and that would fail it on main at its next run. All the advisories were published 2026-10-20 to 2026-10-23. Lockfiles, one override pin, and a raised fastmcp floor for yea-mcp. No other range changes, and no scanner ignores.

 yea-site > vitepress (override vite ^6.4.3), vitest
-  vite 6.4.3            # 5 advisories (launch-editor command exec / fs.allow bypass), High
+  vite 6.4.5            # npm update vite
 yea-demo-worker > wrangler > miniflare (pins undici 7.29.1 exactly)
-  overrides.undici "7.29.1"   # GHSA-xjj6-f33q-929c (High), GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472
+  overrides.undici "7.30.1"
 python/mcp (fastmcp>=4.0.10,<5 extra)
-  fastmcp, fastmcp-slim 4.0.10   # GHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4
+  fastmcp, fastmcp-slim 4.1.3
-  opentelemetry-api 1.45.0       # GHSA-xcq7-p3pf-p88h
+  opentelemetry-api 1.45.1

• vite: npm resolves 6.4.5 (2026-10-21), one patch past the 6.4.4 fix. It was published from vite's GitHub Actions with provenance.

• undici: miniflare still pins 7.29.1 exactly, so the override from deps: undici 7.29.1 for GHSA-3wwx-pv8p-q78v #185 moves to 7.30.1 (2026-10-15, published with provenance).

• python/mcp/uv.lock: uv lock --upgrade-package fastmcp --upgrade-package fastmcp-slim --upgrade-package opentelemetry-api. fastmcp 4.1.3 also pulls in certifi and openapi-pydantic 0.5.1 → 0.6.0, and on Python 3.15 only, beartype 0.23.1 (hence the new >= '3.15' resolution marker).

• fastmcp floor: yea-mcp[fastmcp] (and the dev group) now require fastmcp>=4.1.2,<5, the first release with both fixes, so an install can't resolve a vulnerable version. docs/framework/SPEC-mcp-py.md states the new floor. Its line recording the versions the SDK facts were checked against (fastmcp 4.0.10) stays, because that records history.

I wrote the npm lockfile with npm 11.21.1, so the diff holds only the vite and undici entries.

Evidence

• Before (origin/main, osv-scanner scan source -r ., v2.7.0): 13 vulnerabilities in 5 packages (vite ×5, undici ×3, fastmcp ×2, fastmcp-slim ×2, opentelemetry-api ×1).
  After (this branch, same command):

  No issues found
  

• npm ls vite shows only vite@6.4.5.

Checks run locally after a fresh npm ci from the new lockfile, which left the lockfile unchanged: npm run lint, npm run lint:style, npm run lint:structure, npm run build, npm test (all pass; 5 skipped by existing skipIf guards), npm run site (builds), wrangler deploy --dry-run for deploy/demo (bundles), uv run pytest in python/ (883 passed) and uv run --all-extras pytest in python/mcp (165 passed, run again after the floor change).

Merge danger

Door: two-way

Reverting restores the old lockfiles and pin. Nothing on the wire, in Lens output or in a published package's API changes. The one published-metadata change is yea-mcp[fastmcp]'s fastmcp floor (4.0.10 → 4.1.2). That's a tighter dependency range, not an API change, and yea-mcp has no users yet.

Blast radius: dev tooling and CI only. That covers the site build and vitest (vite), wrangler dev/deploy for deploy/demo (undici under miniflare), and the python/mcp test environment (fastmcp). The TS SDK keeps zero runtime dependencies.

🤖 Generated with Claude Code