[akshay-neatlogs]

Found in the v0.2.10 release dependency audit (pnpm audit --prod); these advisories were published after rc.1.

Package	From → to	Advisory	Reaches neatroots?
zod (direct)	4.6.5 → 4.6.7	GHSA-mrhx-c7xc-m3w5 (high): a large array with failing elements exhausts memory	Yes: MCP tool input is validated with zod. The endpoint is local only, but a local client could crash the server.
fast-uri	3.1.8 → 3.1.9	GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr (moderate) and 2 low	Through the MCP SDK's ajv; not on a path that renders URIs
body-parser	2.3.0 → 2.4.0	high: DoS via trailing bytes	No: express comes with the MCP SDK, but neatroots serves MCP through its own server (webStandardStreamableHttp)
ip-address	10.7.3 → 10.7.5	moderate: quadratic zone-id match	No: express-rate-limit, same as above

The transitive ones are pinned through overrides in pnpm-workspace.yaml, as #355 did.

Not in this PR: undici, @opentelemetry/propagator-jaeger and @opentelemetry/core under the Neatlogs SDK. The SDK is installed here only for the TypeScript hook's tests. It isn't in the bundle, and users get their own resolution when they install it.

Tests: pnpm build, pnpm typecheck, the server tests (620) and the steer-ts tests (25) pass. Afterwards, pnpm audit --prod lists only the 5 SDK-side findings above.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated version ranges for Zod, Fast URI, body-parser, and ip-address in package configuration.
  • The update is limited to package configuration; no user-facing features or behavior changes are included.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: neatlogs/neatroots
• Branch: main
• File: .coderabbit.yaml
• Commit: 267f9b2
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: a1e9b3d9-714d-4049-a614-22eb3c098a5e

Commits

Reviewing files that changed from the base of the PR and between 267f9b2 and 4bde9fa.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml

Files selected for processing: 2

• packages/neatroots/package.json
• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The neatroots package updates its zod dependency range. The pnpm workspace adds overrides for zod, fast-uri, body-parser, and ip-address.

Changes: Dependency version constraints

Layer / File(s)	Summary
Update dependency ranges packages/neatroots/package.json, pnpm-workspace.yaml	The neatroots package changes its zod range to ^4.6.7. The workspace adds overrides for matching zod, fast-uri, body-parser, and ip-address versions.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: taranum-neatlogs

Merge Risk: Minimal · up to 4bde9

The dependency constraint changes are mergeable; no actionable regression is evidenced.

Architecture risk: Low · up to 4bde9

The change affects 2 systems.

Changed systems: packages/neatroots, pnpm-workspace.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — packages/neatroots (library) was modified; 1 changed file maps to changed impact.
• observed — pnpm-workspace.yaml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in packages/neatroots/package.json: The zod dependency range changed from ^4.6.5 to ^4.6.7.
• observed — Modified behavior in pnpm-workspace.yaml: Adds pnpm overrides for zod@>=4.0.0 <4.6.6, fast-uri@>=3.0.0 <3.1.9, body-parser@>=2.0.0 <2.4.0, and ip-address@<10.7.4, directing them to the specified patched version ranges.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the dependency security updates and matches the main changes in the pull request.
Description check		The description explains the dependency advisories, scope, exclusions, and test results. It does not use the template headings or include a linked issue and test checkboxes, but it provides the requir…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the dependency advisories, scope, exclusions, and test results. It does not use the template headings or include a linked issue and test checkboxes, but it provides the required information in substance.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}