chore(deps): patch critical and high dependency advisories

package.json

@@ -241,6 +241,7 @@
             "fast-xml-parser@>=4.1.3 <4.5.4": "4.5.4",
             "flatted@<=3.4.1": "3.4.2",
             "form-data@>=4.0.0 <4.0.6": "4.0.6",
+            "handlebars@<4.7.10": "4.7.10",
             "immutable@<4.3.9": "4.3.9",
             "ip-address@<=10.3.0": "10.3.1",
             "is-core-module": "2.13.1",
@@ -259,10 +260,12 @@
             "semver@>=7.0.0 <7.7.2": "7.7.2",
             "semver@<=6.3.1": "6.3.1",
             "sha.js@<=2.4.11": "2.4.12",
-            "sharp@<0.35.4": "0.35.4",
+            "sharp@<0.35.5": "0.35.5",
             "shell-quote@<=1.8.4": "1.9.0",
             "smol-toml@<1.7.1": "1.7.1",
+            "source-map-js@<1.2.2": "1.2.2",
             "strip-ansi": "7.1.0",
+            "tinypool@<2.1.2": "2.1.2",
             "toml@<4.2.0": "4.2.0",
             "tough-cookie@<4.1.3": "4.1.3",
             "uuid@<11.1.1": "11.1.1",

packages/entity-inspector/package.json

@@ -50,7 +50,7 @@
         "@explorer/idl-decode": "workspace:*",
         "@explorer/parsers": "workspace:*",
         "@explorer/utils": "workspace:*",
-        "@modelcontextprotocol/sdk": "1.27.1",
+        "@modelcontextprotocol/sdk": "1.31.0",
         "@noble/hashes": "1.5.0",
         "@solana-program/address-lookup-table": "0.14.1",
         "@solana-program/loader-v3": "0.6.0",

packages/entity-inspector/src/mcp/__tests__/handler.integration.spec.ts

@@ -169,6 +169,56 @@ describe('createMcpRequestHandler — real MCP SDK transport', () => {
     });
 });
 
+describe('createMcpRequestHandler — request limits', () => {
+    const handler = createMcpRequestHandler(TEST_CONFIG);
+    const MAX_BODY_BYTES = 4 * 1024 * 1024;
+
+    it('should answer a batch of 100 messages', async () => {
+        const response = await handler(pingBatch(100));
+
+        expect(response.status).toBe(200);
+        await expect(response.json()).resolves.toHaveLength(100);
+    });
+
+    it('should reject a batch of 101 messages', async () => {
+        const response = await handler(pingBatch(101));
+
+        expect(response.status).toBe(400);
+        await expect(response.json()).resolves.toMatchObject({ error: { code: -32600 } });
+    });
+
+    it('should answer a body of exactly 4 MiB', async () => {
+        const response = await handler(pingOfSize(MAX_BODY_BYTES));
+
+        expect(response.status).toBe(200);
+        await expect(response.json()).resolves.toMatchObject({ id: 1, result: {} });
+    });
+
+    it('should reject a body one byte over 4 MiB', async () => {
+        const response = await handler(pingOfSize(MAX_BODY_BYTES + 1));
+
+        expect(response.status).toBe(413);
+    });
+});
+
+function pingBatch(size: number): Request {
+    const messages = Array.from({ length: size }, (_, id) => ({ id, jsonrpc: '2.0', method: 'ping' }));
+    return new Request('http://localhost/mcp', {
+        body: JSON.stringify(messages),
+        headers: MCP_HEADERS,
+        method: 'POST',
+    });
+}
+
+function pingOfSize(bytes: number): Request {
+    const padding = 'x'.repeat(bytes - pingMessage('').length);
+    return new Request('http://localhost/mcp', { body: pingMessage(padding), headers: MCP_HEADERS, method: 'POST' });
+}
+
+function pingMessage(padding: string): string {
+    return JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'ping', params: { padding } });
+}
+
 describe('createMcpRequestHandler — a deployment that enables one cluster', () => {
     const handler = createMcpRequestHandler({ ...TEST_CONFIG, enabledClusterNames: ['devnet'] });