[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-22jm-h49p-29qw	%40modelcontextprotocol/sdk	None	1.26.0	1.32.0		confirmed

Not Included

• Deferred by batch limit: 90 advisories. They will be considered by future runs.
• Other deferred scanner findings: 3.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	next	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	proxy-addr	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	tar	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Dependency-only security patch with no runtime code changes; minor lockfile resolution churn under the MCP SDK tree.

Overview
Bumps the devDependency @modelcontextprotocol/sdk from 1.26.0 to 1.32.0 to address GHSA-22jm-h49p-29qw, with matching updates in bun.lock. The lockfile also drops the nested @modelcontextprotocol/sdk/zod entry (zod 3.x) that was pulled in under the older SDK resolution.

No application source changes—only manifest and lockfile updates. Still within @posthog/mcp’s >=1.26.0 peer range.

^{Reviewed by Cursor Bugbot for commit 44e72a1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Nov 11, 2026 3:14am UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​modelcontextprotocol/​sdk@​1.26.0 ⏵ 1.32.0	+1	+40		+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4609629. Configure here.}

[cursor]

Claimed Next.js upgrade not applied

Medium Severity

The PR marks GHSA-39w2-rjm5-chcv as confirmed by moving next from 16.3.6 to 16.3.8, but next remains resolved at 16.3.6. The commit instead bumps test-only @modelcontextprotocol/sdk, so the Next.js development MCP origin check stays unpatched.

Additional Locations (2)

• bun.lock#L36-L37
• bun.lock#L138-L139

 

^{Reviewed by Cursor Bugbot for commit 4609629. Configure here.}

[vercel]

Additional Suggestion:

The PR claims to remediate GHSA-39w2-rjm5-chcv by upgrading Next.js to 16.3.8, but package.json still declared next: ^16.3.3 and bun.lock still resolved next to the vulnerable 16.3.6, leaving the vulnerability unpatched.