Repository navigation
chore: Snyk Security upgrade @modelcontextprotocol/sdk from 1.29.0 to 1.32.0 - #4219
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-MODELCONTEXTPROTOCOLSDK-21460687
|
This minor version upgrade introduces a potentially breaking behavioral change in how HTTP client transports handle redirects. Key Changes:
Recommendation: Verify if your application's endpoints rely on cross-origin redirects. If so, update your client transport configuration to explicitly set the redirect policy.
|
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update SDK dependency range modules/mcp/package.json |
The @modelcontextprotocol/sdk dependency range changed from ^1.29.0 to ^1.32.0. |
Priority:
Estimated code review effort: 1 (Trivial) | ~2 minutes
Change: Other
Suggested reviewers: sheelah, alanbsmith
Merge Risk: 
de6b5
-
The dependency update is reproducibly locked and presents no identified merge-blocking risk.
Pre-merge checks: 
-
Check name Status Explanation Resolution Linked Issues check Issue #4221requires a coding change in the shared useTooltip behavior. Keyboard activation (Space or Enter) of an interactive target wrapped by Tooltip must dismiss the tooltip, as pointer press does…Implement the keyboard dismiss in useTooltip for interactive targets (buttons, inputs, selects, textareas). Dismiss the tooltip on Space or Enter activation. Keep tab-to-show, blur-to-hide, Escape-to-hide, and the mouseDownRef behavior unch… Out of Scope Changes check The only changed file in the whole-PR summary is modules/mcp/package.json. Its change updates the @modelcontextprotocol/sdkdependency range from ^1.29.0 to ^1.32.0. This change addresses Snyk advisor…Remove the modules/mcp/package.json dependency upgrade from this PR and handle it in a separate Snyk fix PR. Keep this PR limited to the #4221tooltip change in useTooltip and its tests. If the dependency upgrade must stay in this PR, justi…-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title states a dependency upgrade of @modelcontextprotocol/sdkfrom 1.29.0 to 1.32.0, which matches the only file change (modules/mcp/package.json, the ^1.29.0 to ^1.32.0 range bump). The PR objec…Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Full details: Title check
-
Explanation
The title states a dependency upgrade of
@modelcontextprotocol/sdkfrom 1.29.0 to 1.32.0, which matches the only file change (modules/mcp/package.json, the ^1.29.0 to ^1.32.0 range bump). The PR objectives also mention a tooltip keyboard-dismiss fix (issue#4221) that the title does not cover. That part is outside the file changes shown in the summary, so the title is partially related to the changeset. The title is specific and clear about the primary change. Note: the title uses the 'chore:' prefix and names a Snyk-generated upgrade, which is accurate.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Full details: Linked Issues check
-
Explanation
Issue
#4221requires a coding change in the shared useTooltip behavior. Keyboard activation (Space or Enter) of an interactive target wrapped by Tooltip must dismiss the tooltip, as pointer press does. Tabbing must still show it, blur and Escape must still hide it, and the mouseDownRef flash prevention must stay unchanged. The whole-PR summary (merge base 21b0c64 to head de6b577) lists one changed file: modules/mcp/package.json, +1/-1, which changes the@modelcontextprotocol/sdkrange from ^1.29.0 to ^1.32.0. No useTooltip source, no onKeyDown or keyboard dismiss handler, and no test for this behavior appear in the changes. The PR description claims the fix for#4221, but the code evidence does not support that claim. The ignored yarn.lock file is excluded from review, but it does not affect the tooltip requirement. No evidence shows the required behavior already exists at the head. Therefore no#4221objective is implemented by this PR.Resolution
Implement the keyboard dismiss in useTooltip for interactive targets (buttons, inputs, selects, textareas). Dismiss the tooltip on Space or Enter activation. Keep tab-to-show, blur-to-hide, Escape-to-hide, and the mouseDownRef behavior unchanged. Add automated tests that cover keyboard activation dismissal and the unchanged show, hide, and mouseDown behaviors. Update the PR description so it no longer claims a fix for
#4221unless that change is included.
Full details: Out of Scope Changes check
-
Explanation
The only changed file in the whole-PR summary is modules/mcp/package.json. Its change updates the
@modelcontextprotocol/sdkdependency range from ^1.29.0 to ^1.32.0. This change addresses Snyk advisory SNYK-JS-MODELCONTEXTPROTOCOLSDK-21460687. It does not relate to the Tooltip or useTooltip behavior that issue#4221requests. The PR description also links the dependency upgrade and the tooltip fix in one PR. The two changes do not share code, tests, or documentation. The dependency upgrade is therefore a demonstrated unrelated change for this PR's linked issue. The PR author's comment reports possible HTTP redirect behavior changes in the SDK. Those changes are not part of the tooltip scope and need separate review.Resolution
Remove the modules/mcp/package.json dependency upgrade from this PR and handle it in a separate Snyk fix PR. Keep this PR limited to the
#4221tooltip change in useTooltip and its tests. If the dependency upgrade must stay in this PR, justify its connection to#4221with code evidence, or link it to its own issue.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Workday/canvas-kit
 |
||||||||||||||||||||||||||||||||||||||||
| Project |
Workday/canvas-kit
|
| Branch Review |
snyk-fix-48f6272e4e8ccc43a30489636c597281
|
| Run status |
|
| Run duration | 03m 01s |
| Commit |
|
| Committer | Manuel Carrera |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
 |
0
|
 |
0
|
 |
17
|
 |
0
|
 |
917
|
| View all changes introduced in this branch ↗︎ | |
UI Coverage
14.36%
|
|
|---|---|
|
|
2556
|
|
|
426
|
Accessibility
99.22%
|
|
|---|---|
|
|
4 critical
5 serious
3 moderate
2 minor
|
|
|
75
|
mannycarrera4
changed the title
…ithub.com/Workday/canvas-kit into snyk-fix-48f6272e4e8ccc43a30489636c597281
Summary
Fixes #4221
Keyboard activation now dismisses the tooltip without hiding it while the user types into a nested text field, and a pending show timer cannot reopen the tooltip after activation.
Release Category
Infrastructure
Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
modules/mcp/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-MODELCONTEXTPROTOCOLSDK-21460687
Breaking Change Risk
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Allocation of Resources Without Limits or Throttling
Summary by CodeRabbit