GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — security: dependabot alert triage by nicktrn · Pull Request #2768 · triggerdotdev/trigger.dev

Conversation

nicktrn commented Dec 8, 2025

Copy link

Copy Markdown

Collaborator

Upgrade @modelcontextprotocol/sdk to 1.24.3
Override jws to 3.2.3

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nicktrn added 2 commits

December 8, 2025 15:21


          security: dependabot alert triage

8d75373


          add changeset

changeset-bot Bot commented Dec 8, 2025

Copy link

Copy Markdown

🦋 Changeset detected

Latest commit: 6334449

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 26 packages

Name	Type
trigger.dev	Patch
d3-chat	Patch
references-d3-openai-agents	Patch
references-nextjs-realtime	Patch
references-realtime-hooks-test	Patch
references-realtime-streams	Patch
references-telemetry	Patch
@trigger.dev/build	Patch
@trigger.dev/core	Patch
@trigger.dev/python	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/zod-worker	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

coderabbitai Bot commented Dec 8, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Walkthrough

This PR adds a changeset entry documenting a patch release for the trigger.dev package and updates the @modelcontextprotocol/sdk dependency from ^1.17.0 to ^1.24.0 in packages/cli-v3. Additionally, a new dependency override is introduced in the root package.json to pin jws to version 3.2.3 for versions below 3.2.3.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

The @modelcontextprotocol/sdk version jump spans 7 minor versions (1.17.0 → 1.24.0) — verify release notes and changelog for any breaking changes or migration requirements
The jws@<3.2.3 dependency override appears to address a security concern — verify the motivation and that the pinned version resolves the underlying issue
Confirm the changeset entry accurately reflects the dependencies being updated

Pre-merge checks and finishing touches

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is incomplete, missing required sections from the template including issue reference, testing steps, and changelog details; only a brief bullet-point list of changes is provided.	Follow the template structure: add issue reference (Closes #), describe testing steps in the Testing section, and provide a detailed changelog entry.
Title check	❓ Inconclusive	The title 'security: dependabot alert triage' is vague and generic, using non-descriptive language that doesn't convey the specific changes (dependency upgrades) being made in the PR.	Consider a more specific title like 'chore: upgrade @modelcontextprotocol/sdk to 1.24.3 and override jws to 3.2.3' to clearly indicate the main changes.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch security/dependabot-triage

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between cf63fc9 and 6334449.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

.changeset/ninety-cougars-remember.md (1 hunks)
package.json (1 hunks)
packages/cli-v3/package.json (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{js,ts,jsx,tsx,json,md,css,scss}

📄 CodeRabbit inference engine (AGENTS.md)

Format code using Prettier

Files:

package.json
packages/cli-v3/package.json

🧠 Learnings (3)

📓 Common learnings

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: .cursor/rules/writing-tasks.mdc:0-0
Timestamp: 2025-11-27T16:27:35.304Z
Learning: Applies to **/trigger/**/*.{ts,tsx,js,jsx} : Use `trigger.dev/sdk/v3` for all imports in Trigger.dev tasks

📚 Learning: 2025-11-27T16:27:48.109Z

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: AGENTS.md:0-0
Timestamp: 2025-11-27T16:27:48.109Z
Learning: pnpm version `10.23.0` and Node.js version `20.11.1` are required for development

Applied to files:

package.json
packages/cli-v3/package.json

📚 Learning: 2025-11-27T16:27:35.304Z

Learnt from: CR
Repo: triggerdotdev/trigger.dev PR: 0
File: .cursor/rules/writing-tasks.mdc:0-0
Timestamp: 2025-11-27T16:27:35.304Z
Learning: Applies to **/trigger/**/*.{ts,tsx,js,jsx} : Use `trigger.dev/sdk/v3` for all imports in Trigger.dev tasks

Applied to files:

.changeset/ninety-cougars-remember.md

🔇 Additional comments (3)

packages/cli-v3/package.json (1)

86-86: Verify compatibility of @modelcontextprotocol/sdk upgrade (^1.17.0 → ^1.24.0).

The upgrade spans multiple minor versions. Verify that this upgrade doesn't introduce any breaking changes or incompatibilities with other dependencies in the workspace.

package.json (1)

93-94: Security fix for jws CVE-2025-65945 is appropriately implemented.

The jws override addresses an HMAC signature bypass vulnerability where improper verification occurs in HMAC-based algorithms, allowing attackers to manipulate key lookup logic. The pnpm override correctly pins all versions below 3.2.3 to the patched version.

.changeset/ninety-cougars-remember.md (1)

1-5: Changeset entry properly documents the dependency upgrade.

The changeset correctly records the patch release with the @modelcontextprotocol/sdk upgrade. The version 1.24.3 aligns with the ^1.24.0 constraint in packages/cli-v3/package.json.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

myftija approved these changes

Dec 8, 2025

View reviewed changes

ericallam approved these changes

Dec 8, 2025

View reviewed changes

nicktrn merged commit 66c6da7 into main

Dec 8, 2025

31 checks passed

Uh oh!

There was an error while loading. Please reload this page.

nicktrn deleted the security/dependabot-triage branch

December 8, 2025 21:02

github-actions Bot mentioned this pull request

Dec 8, 2025

chore: release v4.3.0 #2770

Merged

myftija pushed a commit that referenced this pull request

Dec 12, 2025


          chore: release v4.3.0 (#2770)

7d34817

This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and publish to npm
yourself or [setup this action to publish
automatically](https://github.com/changesets/action#with-publishing). If
you're not ready to do a release yet, that's fine, whenever you add more
changesets to main, this PR will be updated.


# Releases
## [email protected]

### Minor Changes

- feat(cli): deterministic image builds for deployments
([#2778](#2778))
- feat(cli): enable zstd compression for deployment images
([#2773](#2773))

### Patch Changes

- The new `triggeredVia` field is now populated in deployments via the
CLI. ([#2767](#2767))
- fix(dev): stop max listeners exceeded warning messages when running
more than 10 runs concurrently
([#2771](#2771))
- Upgrade @modelcontextprotocol/sdk to 1.24.3
([#2768](#2768))
-   Updated dependencies:
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Minor Changes

- feat(cli): deterministic image builds for deployments
([#2778](#2778))

### Patch Changes

- The new `triggeredVia` field is now populated in deployments via the
CLI. ([#2767](#2767))

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

0ski pushed a commit that referenced this pull request

Dec 16, 2025


          chore: release v4.3.0 (#2770)

f028f26

This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and publish to npm
yourself or [setup this action to publish
automatically](https://github.com/changesets/action#with-publishing). If
you're not ready to do a release yet, that's fine, whenever you add more
changesets to main, this PR will be updated.


# Releases
## [email protected]

### Minor Changes

- feat(cli): deterministic image builds for deployments
([#2778](#2778))
- feat(cli): enable zstd compression for deployment images
([#2773](#2773))

### Patch Changes

- The new `triggeredVia` field is now populated in deployments via the
CLI. ([#2767](#2767))
- fix(dev): stop max listeners exceeded warning messages when running
more than 10 runs concurrently
([#2771](#2771))
- Upgrade @modelcontextprotocol/sdk to 1.24.3
([#2768](#2768))
-   Updated dependencies:
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Minor Changes

- feat(cli): deterministic image builds for deployments
([#2778](#2778))

### Patch Changes

- The new `triggeredVia` field is now populated in deployments via the
CLI. ([#2767](#2767))

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

## @trigger.dev/[email protected]

### Patch Changes

-   Updated dependencies:
    -   `@trigger.dev/[email protected]`

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Reviewers

ericallam

ericallam approved these changes

myftija

myftija approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

nicktrn commented Dec 8, 2025

Uh oh!

changeset-bot Bot commented Dec 8, 2025

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Pre-merge checks and finishing touches

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Dec 8, 2025 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.