potiuk opened a new pull request, #64: URL: https://github.com/apache/comdev/pull/64
Bumps `body-parser` in `mcp/apache-projects-mcp/package-lock.json` from 2.2.2 to 2.3.0, the release that fixes [GHSA-v422-hmwv-36x6](https://github.com/advisories/GHSA-v422-hmwv-36x6) (low severity: an invalid `limit` value silently disables request-size enforcement). `body-parser` is a transitive dependency (via `express`, from the MCP SDK's HTTP transport). The server runs over stdio in the usual Claude Code setup, so it is unlikely to be reachable there, but the lock file is what `npm ci` installs and what `npm audit` flags. Lock-file-only change, produced with `npm audit fix --package-lock-only`; `package.json` is untouched. Checked locally: - `node scripts/check-package-lock.mjs mcp/apache-projects-mcp/package-lock.json` — passes - `npm ci` + `npm audit` — 0 vulnerabilities - `npm test` — 2 passed --- 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
