[lidge-jun]

Summary

The 2.90.0 release dry run (https://github.com/lidge-jun/opencodex/actions/runs/39592379346) failed in publish at bun run audit:high, the dependency gate release.yml and prepublishOnly run before any publication. Nothing was published. This clears the findings:

• @modelcontextprotocol/sdk 1.31.0 → 1.32.1 (floor raised to ^1.32.1): GHSA-22jm-h49p-29qw (experimental tasks not tied to the creating session) and GHSA-46jr-4wx8-v453 (one request within the default size limit could exhaust server memory during validation). It is a direct dependency, used by src/adapters/coding-agent/mcp-server.ts and src/adapters/cursor/mcp-manager.ts.
• gui vite 8.2.1 → 8.2.4 (range ^8.2.4, patch line only): GHSA-587h-7wmj-h5pm (a launch-editor existence check bypass on Windows). The lockfile moves vite's own toolchain with it (rolldown 1.2.3 → 1.2.14, @oxc-project/types).

Only manifests and lockfiles change. This is a dependency-installation change, so it needs security review per MAINTAINERS.md.

Verification

• bun run audit:high (root and gui): no vulnerabilities at high (it failed before).
• bun x tsc --noEmit: pass. bun run build:gui: pass.
• MCP consumers: bun test tests/providers/codebuddy-mcp-server.test.ts tests/providers/cursor/cursor-tool-continuation.test.ts tests/providers/cursor/cursor-mcp-stdio.test.ts tests/providers/cursor/cursor-mcp-manager.test.ts tests/providers/qoder-mcp-server.test.ts: 46 pass, 0 fail.
• The full suite is left to CI on this PR.

GUI evidence

This PR changes no UI. It touches gui/ only to bump the vite build tool from 8.2.1 to 8.2.4. The dashboard below was built from this branch with vite v8.2.4 (bun run build:gui) and served by the proxy from this branch on an isolated home and port, which shows the bumped toolchain still produces a working dashboard.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Chores
  • Updated development tooling and the Model Context Protocol SDK to newer versions.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T11:48:49.832598Z	75ce8b0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e85c84c6-797f-4a05-b2e3-65ee92bed7ae

📥 Commits

Reviewing files that changed from the base of the PR and between d82b217 and 75ce8b0.

⛔ Files ignored due to path filters: 2

• bun.lock is excluded by !**/*.lock
• gui/bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 2

• gui/package.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

The pull request updates the Vite development dependency range in gui/package.json and the @modelcontextprotocol/sdk dependency range in the root package.json.

Changes: GUI Vite update

Layer / File(s)	Summary
Update the GUI Vite range gui/package.json	The Vite dependency range changes from ^8.2.1 to ^8.2.4.

Model Context Protocol SDK update

Layer / File(s)	Summary
Update the SDK range package.json	The @modelcontextprotocol/sdk dependency range changes from ^1.30.0 to ^1.32.1.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: wibias

Merge Risk: ⚪ Minimal · up to 75ce8

The dependency updates introduce no established merge-blocking behavior; the PR is mergeable with normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately summarizes the main change: dependency updates to address high-severity audit findings that blocked the 2.90.0 release.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Merged with owner authority per maintainer decision 2026-10-21 (jun): option A, approved for the 2.90.0 release on the owner path (--admin). No second-maintainer approval or security review is available.

Security note. This is a dependency bump for GHSA-22jm-h49p-29qw and GHSA-46jr-4wx8-v453 (@modelcontextprotocol/sdk 1.31.0 → 1.32.1, floor ^1.32.1) and GHSA-587h-7wmj-h5pm (gui vite 8.2.1 → 8.2.4). Only manifests and lockfiles change, and bun run audit:high is clean (root and gui). The same commit reached main for 2.90.0 through #7481 (994d15e).

Exact-head verification on 75ce8b01f2e9df02c00600277184dc76e03b1e08: all PR checks succeeded, including test 1–4/4 and desktop shell, with no failures. The earlier screenshot-gate failures were rerun green after the GUI evidence was added. The Codex review had no findings, and there are no unresolved threads. A local squash of this head onto current dev d82b2173e passed typecheck, structure:check and the file-size, import-cycle and test-layout ratchets (103 pass, 0 fail). The merge is a squash pinned with --match-head-commit.