[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-22jm-h49p-29qw	%40modelcontextprotocol/sdk	None	1.26.0	1.32.0		confirmed

Not Included

• Deferred by batch limit: 90 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	next	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	proxy-addr	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	tar	Missing CVE/GHSA identifier required for Socket fix planning.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Oct 28, 2026 3:15am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​modelcontextprotocol/​sdk@​1.26.0 ⏵ 1.32.0	+1	+40

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4609629. Configure here.}

[cursor]

Claimed Next.js upgrade not applied

Medium Severity

The PR marks GHSA-39w2-rjm5-chcv as confirmed by moving next from 16.3.6 to 16.3.8, but next remains resolved at 16.3.6. The commit instead bumps test-only @modelcontextprotocol/sdk, so the Next.js development MCP origin check stays unpatched.

Additional Locations (2)

• bun.lock#L36-L37
• bun.lock#L138-L139

 

^{Reviewed by Cursor Bugbot for commit 4609629. Configure here.}

[vercel]

Additional Suggestion:

The PR claims to remediate GHSA-39w2-rjm5-chcv by upgrading Next.js to 16.3.8, but package.json still declared next: ^16.3.3 and bun.lock still resolved next to the vulnerable 16.3.6, leaving the vulnerability unpatched.