[robertoecf]

O lock MCP contém @hono/node-server2.1.0, na faixa afetada por GHSA-rmxm-3fg6-px4f/CVE-2026-118663. Override exato resolve2.1.3, mantendo major2 e todas as demais versões. Lock muda somente versão/URL/integridade desse pacote.

Cadeia: agents0.20.1 → MCP SDK1.32.1 → @hono/node-server. A falha exige serveStatic e middleware de caminho estático; não há import/uso de serveStatic no código Worker. Removemos uma versão afetada do grafo; não afirmamos exploração comprovada no Workers.2.1.3 rejeita percentuais remanescentes após decode; não ativamos allowPercentInPath.

Fontes: GHSA-rmxm-3fg6-px4f e https://github.com/honojs/node-server/releases/tag/v2.1.3 .

Validação no SHA0ba32a06f048abc2baa9c1bb5b35caf526693b50:

• Node24.22.1; npm ci --ignore-scripts --no-audit PASS.
  -51 testes MCP PASS; PYTHONPATH="$PWD/src" bash scripts/ship/preflight.sh PASS: Ruffformat/lint,mypy91arquivos,369Python;16integration deselected,1warningStarlette existente.
• npm audit zero vulnerabilidades conhecidas retornadas,281dependências.
• Review cumulativo local DEGRADED_LOCAL_ONLY, sem revisor externo/bot ou código/contexto transmitido; no removable slop found. Não é aprovação formal de PR.
• MCP Trust NOT_APPLICABLE à superfície: sem mudança de tools/code mode/limites/audience/instâncias/dados;51 testes de segurança/contrato preservados.

Sem credenciais,dados de produção,permissões/configuração alteradas. Sem PyPI/tag/deploy. Rollout MCP anterior continua aguardando aprovação específica; source publicado não comprova runtime instalado. CI no SHA atual necessário antes de merge.

Summary by CodeRabbit

• Chores
  • Updated server-side package configuration as part of routine maintenance. No user-facing changes are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 54aef3b8-fcd4-4b4c-82f6-f06a386f34b4

Commits

Reviewing files that changed from the base of the PR and between e81d15c and 0ba32a0.

Files ignored due to path filters: 1

• workers/mcp/package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 1

• workers/mcp/package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The MCP package adds an override that resolves @hono/[email protected] to 2.1.3. The existing body-parser override remains unchanged.

Changes: MCP dependencies

Layer / File(s)	Summary
Pin the node server dependency workers/mcp/package.json	The package adds an override for @hono/[email protected] that resolves to 2.1.3. The existing body-parser override remains.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• robertoecf/OpenFinData#63: Pins the MCP SDK version and modifies the same dependency graph.

Merge Risk: Minimal · up to 0ba32

The dependency override is narrowly scoped, with no unresolved review risk identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies a dependency fix for Hono Node static middleware. This matches the main change: overriding @hono/node-server from 2.1.0 to 2.1.3.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[robertoecf]

Revisão local do SHA 0ba32a0 — DEGRADED_LOCAL_ONLY, sem aprovação formal de PR.

Diff completo restrito a dois arquivos: override exato @hono/node-server 2.1.0 → 2.1.3 e versão/URL/integridade no lock. Demais versões, scripts, permissões e controles MCP preservados. Cadeia instalada confirmada por npm ls. O advisory exige serveStatic com middleware de prefixo; nenhum uso foi encontrado no código Worker, portanto exposição produtiva não foi comprovada.

51 testes MCP, preflight completo (369 testes Python, Ruff e mypy) e audit npm no head atual passaram. Sem novo código, abstração ou superfície MCP; no removable slop found. Nenhum achado bloqueante no diff. CI próprio e scanners passaram; check automático CodeRabbit ainda pendente no momento desta anotação. Não houve solicitação de reviewer externo nem envio separado de código/contexto.

Rollout MCP segue pendente da autorização específica anterior, mesmo se este source for mergeado.