From 12b86ec0ac9825fbed937965790cfb11bb74818f Mon Sep 17 00:00:00 2001 From: Akshay Dodeja Date: Wed, 21 Oct 2026 18:01:07 -0700 Subject: [PATCH 1/4] fix(ci): pin secure Node and dependency versions --- .github/workflows/ci.yml | 12 ++-- .github/workflows/generate_postman.yml | 2 +- .github/workflows/publish_typescript_cli.yml | 2 +- .github/workflows/publish_typescript_sdk.yml | 2 +- .github/workflows/shadow-risk.yml | 2 +- .github/workflows/trust-policy.yml | 2 +- .tool-versions | 2 +- package-lock.json | 68 +++++++------------- package.json | 9 ++- packages/mcp/package.json | 2 +- 10 files changed, 44 insertions(+), 59 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 75894b2d8..8c1c7470d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v6 with: - node-version: 24 + node-version-file: .tool-versions - name: Test coverage generators and verify generated artifacts run: npm run test:coverage @@ -30,7 +30,7 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v6 with: - node-version: 24 + node-version-file: .tool-versions cache: 'npm' cache-dependency-path: package-lock.json - name: Install workspace dependencies @@ -84,7 +84,7 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v6 with: - node-version: 24 + node-version-file: .tool-versions cache: 'npm' cache-dependency-path: package-lock.json - name: Install workspace deps @@ -139,7 +139,7 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v6 with: - node-version: 24 + node-version-file: .tool-versions cache: 'npm' cache-dependency-path: package-lock.json - name: Install MCP deps (published SDK) @@ -188,7 +188,7 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v6 with: - node-version: 24 + node-version-file: .tool-versions cache: 'npm' cache-dependency-path: package-lock.json - name: Install workspace dependencies @@ -232,7 +232,7 @@ jobs: - uses: actions/setup-node@v6 if: steps.credential.outputs.available == 'true' with: - node-version: 24 + node-version-file: .tool-versions cache: 'npm' cache-dependency-path: package-lock.json - name: Install workspace dependencies diff --git a/.github/workflows/generate_postman.yml b/.github/workflows/generate_postman.yml index f59e37749..769d5054d 100644 --- a/.github/workflows/generate_postman.yml +++ b/.github/workflows/generate_postman.yml @@ -30,7 +30,7 @@ jobs: - name: Set up Node.js uses: actions/setup-node@v6 with: - node-version: '24' + node-version-file: .tool-versions - name: Install dependencies run: npm ci diff --git a/.github/workflows/publish_typescript_cli.yml b/.github/workflows/publish_typescript_cli.yml index 3f0867b67..2031c59fd 100644 --- a/.github/workflows/publish_typescript_cli.yml +++ b/.github/workflows/publish_typescript_cli.yml @@ -30,7 +30,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v6 with: - node-version: 24 + node-version-file: .tool-versions registry-url: https://registry.npmjs.org/ cache: npm cache-dependency-path: package-lock.json diff --git a/.github/workflows/publish_typescript_sdk.yml b/.github/workflows/publish_typescript_sdk.yml index 8e751ddfa..4e8d8aeef 100644 --- a/.github/workflows/publish_typescript_sdk.yml +++ b/.github/workflows/publish_typescript_sdk.yml @@ -30,7 +30,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v6 with: - node-version: 24 + node-version-file: .tool-versions registry-url: https://registry.npmjs.org/ - name: Read SDK version diff --git a/.github/workflows/shadow-risk.yml b/.github/workflows/shadow-risk.yml index bdc9023a6..8ee7714e1 100644 --- a/.github/workflows/shadow-risk.yml +++ b/.github/workflows/shadow-risk.yml @@ -37,7 +37,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: - node-version: 24 + node-version-file: .tool-versions - name: Collect pull request context uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd diff --git a/.github/workflows/trust-policy.yml b/.github/workflows/trust-policy.yml index c5e539c58..e9ce703ad 100644 --- a/.github/workflows/trust-policy.yml +++ b/.github/workflows/trust-policy.yml @@ -56,7 +56,7 @@ jobs: persist-credentials: false - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 with: - node-version: 24 + node-version-file: .tool-versions - name: Reconcile fresh PR evidence uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd with: diff --git a/.tool-versions b/.tool-versions index 04d6e23bb..24809ed6f 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1,2 +1,2 @@ -nodejs 24.11.0 +nodejs 24.22.1 bun latest diff --git a/package-lock.json b/package-lock.json index 83d5a434a..513718188 100644 --- a/package-lock.json +++ b/package-lock.json @@ -18,7 +18,7 @@ "vite-plus": "1.3.0" }, "engines": { - "node": "24.x" + "node": ">=24.22.1 <25" } }, "node_modules/@babel/code-frame": { @@ -579,14 +579,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@faker-js/faker": { - "version": "5.5.3", - "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-5.5.3.tgz", - "integrity": "sha512-R11tGE6yIFwqpaIqcfkcg7AICXzFg14+5h5v0TfF/9+RMDL6jhzCy/pxHVOfbALGdtVYdt6JdR21tuxEgl34dw==", - "deprecated": "Please update to a newer version.", - "dev": true, - "license": "MIT" - }, "node_modules/@gerrit0/mini-shiki": { "version": "3.23.0", "resolved": "https://registry.npmjs.org/@gerrit0/mini-shiki/-/mini-shiki-3.23.0.tgz", @@ -3575,9 +3567,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.2", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.2.tgz", - "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==", + "version": "14.3.3", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz", + "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==", "dev": true, "funding": [ { @@ -3963,33 +3955,10 @@ "node": ">=18" } }, - "node_modules/openapi-to-postmanv2/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/puzrin" - }, - { - "type": "github", - "url": "https://github.com/sponsors/nodeca" - } - ], - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/openapi-to-postmanv2/node_modules/yaml": { - "version": "1.10.2", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz", - "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==", + "version": "1.10.3", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz", + "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==", "dev": true, "license": "ISC", "engines": { @@ -4328,6 +4297,14 @@ "node": ">=18" } }, + "node_modules/postman-collection/node_modules/@faker-js/faker": { + "version": "5.5.3", + "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-5.5.3.tgz", + "integrity": "sha512-R11tGE6yIFwqpaIqcfkcg7AICXzFg14+5h5v0TfF/9+RMDL6jhzCy/pxHVOfbALGdtVYdt6JdR21tuxEgl34dw==", + "deprecated": "Please update to a newer version.", + "dev": true, + "license": "MIT" + }, "node_modules/postman-url-encoder": { "version": "3.0.8", "resolved": "https://registry.npmjs.org/postman-url-encoder/-/postman-url-encoder-3.0.8.tgz", @@ -4813,14 +4790,17 @@ "license": "MIT" }, "node_modules/uuid": { - "version": "8.3.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz", - "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==", - "deprecated": "uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).", + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", "dev": true, + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], "license": "MIT", "bin": { - "uuid": "dist/bin/uuid" + "uuid": "dist/esm/bin/uuid" } }, "node_modules/validate.io-array": { @@ -5353,7 +5333,7 @@ "vite-plus": "1.3.0" }, "engines": { - "node": "24.x" + "node": ">=24.22.1 <25" } }, "sdks/typescript-sdk": { diff --git a/package.json b/package.json index c570cf227..985dc15d3 100644 --- a/package.json +++ b/package.json @@ -31,9 +31,14 @@ }, "overrides": { "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0", - "vitest": "5.0.5" + "vitest": "5.0.5", + "js-yaml@^4.0.0": "4.3.2", + "yaml@^1.0.0": "1.10.3", + "postman-collection": { + "uuid": "11.1.1" + } }, "engines": { - "node": "24.x" + "node": ">=24.22.1 <25" } } diff --git a/packages/mcp/package.json b/packages/mcp/package.json index e9be066c6..f7dc2a6cf 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -46,6 +46,6 @@ "vite-plus": "1.3.0" }, "engines": { - "node": "24.x" + "node": ">=24.22.1 <25" } } From 18a19c2821913969155af6b13c2f5fd1e01894bb Mon Sep 17 00:00:00 2001 From: Akshay Dodeja Date: Wed, 21 Oct 2026 18:01:25 -0700 Subject: [PATCH 2/4] docs: update the patched Node requirement --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index b72d6d01d..5cfb7407e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -40,7 +40,7 @@ Change the source and regenerate instead. ## Commands -Vite+ (`vp`) is the toolchain, and it delegates package installs to npm. The root `package-lock.json` is the only lockfile. The repo needs Node 24.11 or later (`.tool-versions` pins `24.11.0`), which is the Node 24 floor of Vite+ 1.3.0. +Vite+ (`vp`) is the toolchain, and it delegates package installs to npm. The root `package-lock.json` is the only lockfile. The repo pins Node `24.22.1` in `.tool-versions` for the October 2026 security fixes. Vite+ 1.3.0 requires Node 24.11 or later. - Install: `vp install`. CI and Vercel run `npm ci`. - Check: `vp run check`. It runs `vp check`, builds the SDK declarations that other workspaces import, and then runs `tsc` for `api/` and every workspace. Keep the `tsc` checks and the SDK-first order. Vite+ type-aware linting stays off until it respects each package's own Node types. From 9f9a9f015d591ec5e7d1dac202b97222e610768d Mon Sep 17 00:00:00 2001 From: Akshay Dodeja Date: Wed, 21 Oct 2026 21:02:42 -0700 Subject: [PATCH 3/4] docs: align setup with the patched Node requirement --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 710f0dba4..2b48cfa32 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ For ChatGPT, Claude Code, Cursor, VS Code, and other clients, see the [MCP serve ## Develop in this repository -This is an npm workspaces monorepo that uses [Vite+](https://viteplus.dev) (`vp`) as its toolchain. You need Node 24.11 or later (`.tool-versions` pins `24.11.0`). +This is an npm workspaces monorepo that uses [Vite+](https://viteplus.dev) (`vp`) as its toolchain. Use Node 24.22.1 or a newer Node 24 patch (`.tool-versions` pins `24.22.1`). ```bash vp install # or: npm ci From 04f8f05779f184d26efe8208dc4ef4ff8da6b8b4 Mon Sep 17 00:00:00 2001 From: Akshay Dodeja Date: Wed, 21 Oct 2026 21:02:44 -0700 Subject: [PATCH 4/4] test: validate generated Postman IDs without a fixed count --- tools/postman-generation.test.mjs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tools/postman-generation.test.mjs b/tools/postman-generation.test.mjs index f11c1993e..66f4c3e6d 100644 --- a/tools/postman-generation.test.mjs +++ b/tools/postman-generation.test.mjs @@ -81,12 +81,16 @@ test('every item and response has a unique id', () => { const ids = []; const walk = (entries) => { for (const entry of entries ?? []) { - if (entry.id) ids.push(entry.id); + if (entry.request || !entry.item) { + assert.equal(typeof entry.id, 'string', entry.name); + assert.ok(entry.id.length > 0, entry.name); + ids.push(entry.id); + } walk(entry.item); walk(entry.response); } }; walk(collection.item); - assert.equal(ids.length, 453); + assert.ok(ids.length > 0); assert.equal(new Set(ids).size, ids.length); });