[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-39w2-rjm5-chcv	next	None	16.3.6	16.3.8		confirmed

Not Included

• Deferred by batch limit: 72 advisories. They will be considered by future runs.
• Other deferred scanner findings: 2.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	proxy-addr	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	tar	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Dev-only dependency and lockfile changes with no runtime code edits; main risk is tooling or peer-resolution behavior around MCP SDK 1.32.0.

Overview
This PR bumps the devDependency @modelcontextprotocol/sdk from 1.26.0 to 1.32.0 in package.json and refreshes bun.lock accordingly. There are no application or config source changes—only the manifest and lockfile.

The lockfile update also widens the resolved SDK dependency on @hono/node-server (now ^1.19.9 || ^2.0.5) and drops the previous nested @modelcontextprotocol/sdk/zod → zod@3.25.76 entry, so dependency resolution for the SDK subtree is slightly different after the upgrade.

^{Reviewed by Cursor Bugbot for commit 4609629. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 21, 2026 3:20am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​modelcontextprotocol/​sdk@​1.26.0 ⏵ 1.32.0	+1	+31

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4609629. Configure here.}

[cursor]

Claimed Next.js upgrade not applied

Medium Severity

The PR marks GHSA-39w2-rjm5-chcv as confirmed by moving next from 16.3.6 to 16.3.8, but next remains resolved at 16.3.6. The commit instead bumps test-only @modelcontextprotocol/sdk, so the Next.js development MCP origin check stays unpatched.

Additional Locations (2)

• bun.lock#L36-L37
• bun.lock#L138-L139

 

^{Reviewed by Cursor Bugbot for commit 4609629. Configure here.}