Repository navigation
Harden dependency installs and refresh OBS/MCP baselines - #19
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the MCP server/client SDKs to 2.3.1, ws to 8.22.0, and Zod to 4.6.7, and refreshes the OBS/MCP reference baselines. The update clears the fixable client and development dependency advisories while preserving Node 20.19 support and all 171 tool contracts.
Dependency installs now disable lifecycle scripts. An offline policy check rejects drifting direct pins, manifest/lock mismatches, non-registry tarballs, missing SHA-512 integrity, and unreviewed install hooks before CI installation and packaging. CI actions are pinned to verified commits, weekly audits inspect the lockfile without installation, and Dependabot proposes bounded weekly updates.
The OBS protocol JSON is unchanged: 147 requests, 60 events, and 7 enums. The tool-contract snapshot changes only because Zod emits equivalent nullable primitive schemas differently. HTTP regression tests cover oversized requests in both protocol eras, oversized legacy batches, concurrent discovery, and continued availability. The package smoke test also checks that MCPB and node-forge are absent from the runtime bundle.
Validation:
npm run check: build, test typecheck, 268 unit tests, 18 end-to-end tests, and manifest validation passed.npm run test:package: build, extraction, and runtime smoke test passed.The full development audit still reports the unpatched node-forge advisory through MCPB. Reachability and the pre-existing SDK license discrepancy are documented in
docs/dependency-security.md; neither is suppressed. The project license is unchanged. Live OBS was unavailable on this machine; integration checks used the existing fake OBS boundary. No package release or deployment is included.