fix(deps): bump @forgespace/branding-mcp to ^0.56.0#47
Conversation
Closes Dependabot alert #22 (medium severity). Transitive vulnerability in @anthropic-ai/sdk 0.79.0 — Memory Tool Path Validation allows sandbox escape (GHSA, fixed in 0.81.0). brand-guide cannot bump @anthropic-ai/sdk directly because it does not depend on it; the SDK comes through @forgespace/branding-mcp. @forgespace/branding-mcp 0.56.0 already pins @anthropic-ai/sdk ^0.82.0, so the chain becomes: brand-guide (^0.55.3 -> ^0.56.0) -> branding-mcp 0.56.0 -> @anthropic-ai/sdk 0.82.0 (patched) api:check confirms the 12 re-exported types from branding-mcp are unchanged between 0.55.3 and 0.56.0, so this is non-breaking for brand-guide consumers.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 13 minutes and 2 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
1 participant
Summary
Closes Dependabot alert #22 (
@anthropic-ai/sdk0.79.0 — Memory Tool Path Validation sandbox escape, medium severity).brand-guidedoesn't depend on@anthropic-ai/sdkdirectly; the vulnerable version came in transitively through@forgespace/branding-mcp@^0.55.3.@forgespace/branding-mcp0.56.0 already pins@anthropic-ai/sdk@^0.82.0, so bumping the dep range closes the alert with no other changes:Test plan
npm install— lockfile resolved cleanlynpm run build:lib— greennpm test— 24/24 passnpm run api:check— green (confirms the 12 re-exported types are unchanged between branding-mcp 0.55.3 and 0.56.0, so this is non-breaking for downstream consumers)