v1.0.0: release audit for the SDK 1.x release branch

[cliffhall]

Part of #5080

Stacked on #5086 (base v2/chore/5080-release-cherry-picks); retargeted to the one-time release branch v2/release/1.0.0 once #5086 merges. Stacked because this branch's gate needs #5078's Node 26 test fix.

The v1.0.0 release audit (step 2a) for the SDK 1.x release tree (d8120439). Same outcomes as #5082 (fix every finding with an in-range fix, one commit each), redone here because this tree's lockfiles differ, plus three findings that only exist on SDK 1.x.

Description

npm, runtime (root overrides, never npm audit fix):

Package	Was	Now	Advisories
proxy-addr	2.0.7	2.0.8	GHSA-jqcg-44mw-7w3h (critical)
ip-address	10.2.0	10.7.3	GHSA-mwp4-54f8-5fhr and six more (high)
brace-expansion	5.0.8	5.0.12	GHSA-rgw5-rvv9-x895 and three more (high)
fast-uri	3.1.4	3.1.8	high, via ajv (new on this tree)
hono		4.13.13	GHSA-8j4g-w8fx-2239 and seven more; override raised
qs	6.15.2	6.16.0	GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g; override raised

@modelcontextprotocol/sdk (new on this tree): GHSA-6qxp-vccf-f47h (high, >=1.12.0 <1.31.0): the SDK's OAuth client could send credentials to an authorization server chosen by the MCP server. These servers do not use the OAuth client, so it is not reachable from them, but their declared ^1.30.0 let an install resolve an affected SDK (the lockfile had 1.30.0). The floor is raised to ^1.31.0 in all four servers and the root (locked at 1.32.1), with a patch changeset per server, since this changes a published dependency range.

npm, dev only: nanoid 3.3.20, source-map-js 1.2.2 (overrides), vitest / @vitest/coverage-v8 ^4.1.11 in all four workspaces (lockstep).

Python:

Package	Server(s)	Now	How
gitpython	git	3.2.0	gitpython>=3.1.60 + uv lock
protego	fetch	0.7.0	protego>=0.6.2 + uv lock
anyio	fetch, git, time	4.15.1	uv lock --upgrade-package (new on this tree, fixed in 4.14.2)
cryptography	fetch, git, time	50.0.2	uv lock --upgrade-package
pyjwt	fetch, git, time	2.15.1	uv lock --upgrade-package
urllib3	fetch	2.8.0	uv lock --upgrade-package
soupsieve	fetch	2.10	uv lock --upgrade-package

Not fixed: npm braces (GHSA-vfj7-8cjw-p6xm, every version): no patched release. Dev only, through shx.

Server Details

• Server: everything, filesystem, memory, sequential-thinking (SDK floor); fetch, git (floors); all (lockfiles)
• Changes to: dependency ranges and lockfiles only

Motivation and Context

#5080, release audit for the SDK 1.x tree. Report posted on #5080.

How Has This Been Tested?

$ npm audit                      -> only `braces` remains (no fix released)
$ pip-audit (fetch, git, time)   -> "No known vulnerabilities found" x3
$ npm run local:gate; echo EXIT=$?
EXIT=0   (everything 258, filesystem 326/2 skipped, memory 176, sequentialthinking 101; fetch 121, git 165, time 122; coverage gates; skills validator; smoke 9/9)

The SDK moves 1.30.0 → 1.32.1 within its major; every server is exercised again through a client in the release ledger on this tree.

Breaking Changes

None. All changes are inside declared ranges, except raised floors that only exclude vulnerable versions.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the MCP Protocol Documentation (not applicable: no protocol surface changes)
• My changes follow MCP security best practices
• I have updated the server's README accordingly (not applicable)
• I have added a changeset (*-sdk-floor-1-31.md, patch, one per TypeScript server)
• I have tested this with an LLM client (each server driven over stdio in the release ledger)
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling (not applicable)
• I have documented all environment variables and configuration options (not applicable)

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: dd1e437

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@modelcontextprotocol/server-everything	Patch
@modelcontextprotocol/server-filesystem	Patch
@modelcontextprotocol/server-memory	Patch
@modelcontextprotocol/server-sequential-thinking	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cliffhall]

Retargeted to v2/release/1.0.0 now that #5086 merged (merge commit 3f5e9ead); the diff is this PR's 17 audit commits only. Copilot round 1 is pending.

[Copilot]

🟢 Approval recommended

The dependency floors, generated lockfiles, changesets, and successful validation checks are consistent and complete.

0 open findings

What changed in this PR

Updates the SDK 1.x release branch to remediate audited dependency vulnerabilities before v1.0.0.

Changes:

• Raises SDK and Python dependency security floors.
• Refreshes npm/Python lockfiles and Vitest tooling.
• Adds patch changesets for all published TypeScript servers.

File	Description
.changeset/​everything-sdk-floor-1-31.md	Records the everything server patch.
.changeset/​filesystem-sdk-floor-1-31.md	Records the filesystem server patch.
.changeset/​memory-sdk-floor-1-31.md	Records the memory server patch.
.changeset/​sequentialthinking-sdk-floor-1-31.md	Records the sequential-thinking server patch.
package.json	Adds npm security overrides and raises the SDK floor.
package-lock.json	Locks remediated npm dependencies.
src/​everything/​package.json	Updates SDK and Vitest dependencies.
src/​filesystem/​package.json	Updates SDK and Vitest dependencies.
src/​memory/​package.json	Updates SDK and Vitest dependencies.
src/​sequentialthinking/​package.json	Updates SDK and Vitest dependencies.
src/​fetch/​pyproject.toml	Raises the Protego security floor.
src/​fetch/​uv.lock	Locks remediated fetch dependencies.
src/​git/​pyproject.toml	Raises the GitPython security floor.
src/​git/​uv.lock	Locks remediated git dependencies.
src/​time/​uv.lock	Locks remediated time dependencies.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[cliffhall]

Copilot round 1: clean (0 findings, approval recommended). CI 30/30 green after the branch update. Loop ended on the first clean round; merged.