Security audit: close MCP/channel auth gaps, fix critical CVE, add CI - #85

Merged

johnnyclem merged 10 commits into

mainfrom

claude/code-review-security-audit-hyxm9a

Aug 15, 2026

Commits on Aug 15, 2026

fix(deps): resolve critical vitest CVE and 11 transitive high/moderate vulns
claude
committed
f0ef437
fix(mcp): close auth/rate-limit gaps on the MCP HTTP server
claude
committed
a69533a
fix(channel): auth-gate /sse, constant-time secret check, escape content
claude
committed
abc2be0
fix(transport): make timeoutMs actually bound non-cooperating handlers
claude
committed
65d4ada
fix(core,mcp): harden SCDictionary.unwrap() and use safeJsonParse in artifact.ts
claude
committed
782aa21
ci: add GitHub Actions workflow (lint, test, build, dependency audit)
claude
committed
641aa91
chore: small hygiene fixes (.gitignore, README doc drift, repo URL typo)
claude
committed
050a4bb
docs: add structured audit report and CHANGELOG entries
claude
committed
bc3f9b3
fix(docs): resolve 22 of 44 docs-site vulnerabilities, fix broken link
claude
committed
6866756
ci: add packages/docs job; update audit report with docs-site findings
claude
committed
85d724d