chore: close runtime Dependabot advisories, honour LOG_LEVEL - #23
Merged
Conversation
Two unrelated-but-small fixes found while checking why the v1.1.0
release did not clear the GitHub vulnerability alerts.
Dependabot: 83 of 90 alerts closed with the release; 7 remained. Five
are runtime, all transitive via @modelcontextprotocol/sdk 1.30.0 (which
is already the latest, so there is no upgrade to take):
fast-uri 3.1.4 -> 3.1.5 host confusion via backslash authority
hono 4.12.32 -> 4.13.1 4 advisories (memo() cross-user data
disclosure, CORS ReDoS, language
middleware DoS, proxy header leak)
Pinned via overrides within the existing major version - ^3.1.5 rather
than >=3.1.5, which had pulled fast-uri 4.x into ajv's schema
validation. `npm audit --omit=dev` now reports 0 vulnerabilities. The
two remaining alerts are js-yaml, development-only and not shipped.
Logger: production has been running silently at "warn" for months. The
host sets LOG_LEVEL=info but the code only ever read DS_LOG_LEVEL, so
every logger.info - the startup banner, session lifecycle, OAuth
diagnostics - was dropped. Container logs were the tool that diagnosed
the dev OAuth failure and they would have been empty on prod. Accept
LOG_LEVEL as a fallback; DS_LOG_LEVEL still wins when both are set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small fixes found while checking why the v1.1.0 release didn't clear the GitHub vulnerability alerts.
Dependabot
The release closed 83 of 90 alerts. Of the 7 remaining, 5 are runtime — all transitive via
@modelcontextprotocol/sdk@1.30.0, which is already the latest, so there was no SDK upgrade to take:fast-urihonomemo()cross-user data disclosure, CORS ReDoS, language-middleware DoS, proxy header leakPinned via
overrides, within the existing major version:^3.1.5rather than>=3.1.5, which had pulledfast-uri4.x into ajv's schema validation — an unnecessary major bump in a transitive dependency.npm audit --omit=devnow reports 0 vulnerabilities.The 2 remaining alerts are
js-yaml, development-only and absent from the production tree — left alone deliberately rather than pinning a dev dependency we don't ship.Worth noting the Hono advisories were unlikely to be reachable anyway (we use Express with our own CORS middleware, not Hono's), but the versions are patch-level and free to take.
Logger
Production has been running silently at
warnfor months. The host setsLOG_LEVEL=info, butsrc/logger.tsonly ever readDS_LOG_LEVEL:DS_LOG_LEVEL=debugDS_LOG_LEVELLOG_LEVEL=infoDS_LOG_LEVELwarn❌So every
logger.infowas dropped — startup banner, session lifecycle, OAuth diagnostics.docker logs digitalsamba-mcpreturns zero lines on prod. That's the exact tool that diagnosed the dev OAuth failure, and it would have been empty during Friday's prod OAuth work.LOG_LEVELis now accepted as a fallback;DS_LOG_LEVELstill wins when both are set, and the default stayswarn. 3 new tests cover all three cases.556 tests passing (was 553). Lint and format clean.
Still needs ops
The env var on apps3 should be renamed to
DS_LOG_LEVELregardless — this change means prod gets its logs back at the next deploy either way, but the host config is still misleading as written.