chore(deps): patch critical and high dependency advisories

[askov]

Description

Patches the critical and high Dependabot alerts that have a patched release.

Changes

• Adds handlebars, source-map-js and tinypool overrides at their first patched versions.
• Raises the sharp override to 0.35.5.
• Bumps @modelcontextprotocol/sdk in packages/entity-inspector from 1.27.1 to 1.31.0.
• Installs handlebars 4.7.10 and source-map-js 1.2.2 with a one-time minimumReleaseAge exclusion, so the lockfile pins releases inside the 14-day window.
• Removes @solana-program/memo from minimumReleaseAgeExclude, so memo releases wait out the 14-day window again.

Alerts

Alert	Severity	Package	Before	After
532	critical	handlebars	4.7.9	4.7.10
514, 515	critical	tinypool	2.1.0	2.1.2
527, 530	high	@modelcontextprotocol/sdk	1.27.1	1.31.0
529	high	sharp	0.35.4	0.35.5
523	high	source-map-js	1.2.1	1.2.2

braces

No braces release fixes 511, so the alert stays open. The app does not import braces or micromatch. braces enters through chokidar (under sass and @sentry/nextjs) and fast-glob (under @fission-ai/openspec), which expand glob patterns from config, not from request input.

Whether to dismiss 511 as a tolerable risk is the maintainers' call.

Behavior Changes

• /mcp answers a JSON-RPC batch over 100 messages with 400, and a request body over 4 MiB with 413.

Type of change

• Other (please describe): dependency security patches

Screenshots

No UI changes.

Testing

• No critical or high advisory remains for the patched packages. Run pnpm audit --json | jq -r '.advisories[] | select((.severity == "high" or .severity == "critical") and (.module_name | IN("handlebars", "tinypool", "@modelcontextprotocol/sdk", "sharp", "source-map-js"))) | "\(.module_name) \(.github_advisory_id)"'. Expect no output. On master the same command prints the advisory behind each alert in the table.
• inspect_entity answers on SDK 1.31.0. Run pnpm build, then MCP_ENDPOINT_ENABLED=true MCP_ACCESS_KEYS=key pnpm start, and call curl localhost:3000/mcp -H 'Authorization: Bearer key' -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"inspect_entity","arguments":{"identifier":"TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"}}}'. Expect a bpf-upgradeable-loader entity with address_label Token Program.
• /mcp rejects an oversized batch. POST a JSON array of 101 {"jsonrpc":"2.0","id":N,"method":"ping"} requests to the same endpoint. Expect 400 with Batch must not exceed 100 messages.

Related Issues

Closes HOO-2054

Checklist

• My code follows the project's style guidelines
• I have added tests that prove my fix/feature works
• All checks pass locally (pnpm test, pnpm lint, pnpm typecheck)
• I have run build:info script to update build information
• For security-related features, I have included links to related information

Additional Notes

pnpm-workspace.yaml does not keep the one-time exclusion. A frozen install replays the handlebars and source-map-js pins.

[vercel]

@askov is attempting to deploy a commit to the Solana Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge, with the previous test-coverage concern addressed.

Summary

This PR updates dependency overrides and the MCP SDK to address advisories. It also removes the release-age exception for @solana-program/memo.

• Workspace installs patched libraries and restores memo's release wait.
• MCP requests now stop at 100 messages and 4 MiB.

_{Reviews (2) · Last reviewed commit: "test(entity-inspector): cover the /mcp b..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
explorer	Ready	Preview	Oct 13, 2026 10:50am UTC