Upgrade NodeJS dependencies and rebuild server/dist/**#189
Merged
data-douser merged 5 commits intomainfrom Mar 27, 2026
Merged
Conversation
![github-license-compliance[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Contributor
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issuesclient/package.json
server/package.json
OpenSSF ScorecardScorecard details
Scanned Files
|
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repo’s Node.js dependencies (notably the MCP SDK and test/lint tooling) and rebuilds the committed server bundle in server/dist/** so the published server artifact reflects the new dependency versions.
Changes:
- Bump
@modelcontextprotocol/sdkto^1.28.0in both server and client workspaces. - Update lint/test tooling versions (
typescript-eslint,vitest,@vitest/coverage-v8) across the root, server, and VS Code extension. - Regenerate
server/dist/codeql-development-mcp-server.jsand refreshpackage-lock.jsonaccordingly.
Reviewed changes
Copilot reviewed 4 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
package.json |
Updates repo-level typescript-eslint to keep root tooling consistent. |
package-lock.json |
Refreshes the lockfile to reflect updated direct + transitive dependencies across workspaces. |
client/package.json |
Bumps @modelcontextprotocol/sdk to ^1.28.0. |
server/package.json |
Bumps @modelcontextprotocol/sdk, vitest, @vitest/coverage-v8, and typescript-eslint. |
server/dist/codeql-development-mcp-server.js |
Rebuilt bundled server output incorporating SDK changes. |
extensions/vscode/package.json |
Bumps vitest, @vitest/coverage-v8, and typescript-eslint for extension tooling parity. |
Adds an `overrides` config in root `package.json` to force the vite dependency to not require the installation of transitive depdendencies related to lightningcss, which has licensing concerns yet is unused by this project.
This reverts commit 51f1f5a.
Collaborator
Author
There was a problem hiding this comment.
The lightningcss dependency is not actually used. It is a transitive dependency of vite, and we don't use vite for the things that would invoke some lightningcss dependency. I tried and failed to override the dependency config.
This was referenced Mar 27, 2026
Closed
Closed
Closed
This was referenced Mar 27, 2026
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency updates:
@modelcontextprotocol/sdkfrom^1.27.1to^1.28.0in bothclient/package.jsonandserver/package.jsonto use the latest SDK features and fixes. [1] [2]typescript-eslintfrom^8.57.1to^8.57.2inpackage.json,server/package.json, andextensions/vscode/package.jsonfor improved linting and TypeScript support. [1] [2] [3]vitestand@vitest/coverage-v8to^4.1.2inserver/package.jsonandextensions/vscode/package.jsonfor better test coverage and stability. [1] [2] [3]typescript-eslintandvitestinextensions/vscode/package.jsonto their latest versions for consistency across the codebase.