@ni-c/mcp-hub 0.11.4 → 0.11.5

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.11.5] - 2026-10-06
+
+### Security
+
+- `proxy-addr` 2.0.8 (was 2.0.7, GHSA-jqcg-44mw-7w3h, critical). A trust
+  subnet written as an IPv4-mapped IPv6 block with a short prefix, such as
+  `::ffff:10.0.0.0/8`, matched every IPv4 address. `trustedProxies` is handed
+  to Express as `trust proxy`, so with such an entry any client could set its
+  own `req.ip` through `X-Forwarded-For` — the key of the per-caller rate limit
+  and the address in the consent log. Plain IPv4 notation (`10.0.0.0/8`) was
+  never affected.
+- `source-map-js` 1.2.2 (was 1.2.1, GHSA-68fv-2mgg-jv7q). A development
+  dependency only; it is not in the package or the image.
+- The documentation site builds with `vue` and `@vue/server-renderer` 3.5.43
+  (was 3.5.41, GHSA-g2v6-rqmx-r4w6). The site renders only its own Markdown at
+  build time; neither the package nor the image contains Vue.
+- The image overwrites npm's vendored `brace-expansion` with 5.0.11 instead of
+  5.0.9 and now also its vendored `undici`, with 6.28.1. npm 12.0.2 pins
+  `undici` 6.27.0, and the latest npm, 12.1.0, still ships 6.28.0 and
+  `brace-expansion` 5.0.9, which CVE-2026-19534 (`undici`) and CVE-2026-102276
+  and CVE-2026-102278 (`brace-expansion`) apply to. Only the npm CLI inside the
+  image uses these copies; the hub's own dependencies were not affected.
+
 ## [0.11.4] - 2026-09-24
 
 ### Security

package/dist/docker-proxy/server.js

@@ -30,6 +30,11 @@ function refuse(response, status, reason, closeConnection = false) {
     });
     response.end(body);
 }
+/**
+ * An upgrade is answered on the raw socket, and a refused one must not leave
+ * the caller holding a half-open connection: write, then destroy.
+ */
+const hangUp = (clientSocket, status, reason) => clientSocket.end(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Bad Gateway'}\r\nConnection: close\r\nContent-Length: ${Buffer.byteLength(reason)}\r\n\r\n${reason}`, () => clientSocket.destroy());
 function readBody(request) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -251,16 +256,13 @@ export function createDockerProxy(options) {
     server.on('upgrade', (request, clientSocket, head) => {
         void (async () => {
             const decision = decide(request.method ?? 'GET', request.url ?? '/', undefined);
-            // An upgrade is answered on the raw socket, and a refused one must not
-            // leave the caller holding a half-open connection: write, then destroy.
-            const hangUp = (status, reason) => clientSocket.end(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Bad Gateway'}\r\nConnection: close\r\nContent-Length: ${Buffer.byteLength(reason)}\r\n\r\n${reason}`, () => clientSocket.destroy());
             if (!decision.allow || !decision.upgrade) {
-                hangUp(decision.allow ? 403 : decision.status, decision.allow ? 'this endpoint does not support upgrades' : decision.reason);
+                hangUp(clientSocket, decision.allow ? 403 : decision.status, decision.allow ? 'this endpoint does not support upgrades' : decision.reason);
                 return;
             }
             const ownershipError = await verifyContainer(options, decision);
             if (ownershipError) {
-                hangUp(ownershipError.status, ownershipError.reason);
+                hangUp(clientSocket, ownershipError.status, ownershipError.reason);
                 return;
             }
             const upstream = http.request({
@@ -297,11 +299,11 @@ export function createDockerProxy(options) {
             });
             upstream.on('response', upstreamResponse => {
                 upstreamResponse.resume();
-                hangUp(502, `docker daemon answered ${upstreamResponse.statusCode} instead of upgrading`);
+                hangUp(clientSocket, 502, `docker daemon answered ${upstreamResponse.statusCode} instead of upgrading`);
             });
             upstream.on('error', error => {
                 console.error(`docker-proxy: upstream error on attach: ${error.message}`);
-                hangUp(502, `docker daemon unreachable: ${error.message}`);
+                hangUp(clientSocket, 502, `docker daemon unreachable: ${error.message}`);
             });
             upstream.end();
         })().catch(error => {

package/dist/hub.js

@@ -178,6 +178,41 @@ const requireAllowedTool = (managed, tool, server) => {
     console.warn(`[${managed.name}] refused "${loggableToolName(tool)}": not permitted by allowTools/denyTools`);
     return toolError(`Unknown tool "${tool}" on server "${server}". Use list_tools to see available tools.`);
 };
+/**
+ * `hub: false` hides a server's TOOLS from the aggregate — those are meant
+ * to be used through the server's own endpoint. Its lifecycle is a different
+ * matter: wake_server/sleep_server manage hidden servers too, so the error
+ * points at the right door instead of pretending the server does not exist
+ * (/health names every server to the same token anyway).
+ */
+const requireExposed = (managed) => {
+    if (managed.config.hub)
+        return undefined;
+    return toolError(`Server "${managed.name}" is not exposed through /hub — connect to its own endpoint /${managed.name}/mcp instead.`);
+};
+/**
+ * Asking about an on-demand server's tools is the strongest hint that a
+ * call follows, so a sleeping server is pre-warmed in the background while
+ * the cached snapshot answers. Only a server with nothing cached yet (first
+ * ever run) blocks on the start — there is nothing truthful to answer from.
+ * Always-running servers pass through untouched.
+ */
+const prepare = async (managed) => {
+    if (!managed.onDemand)
+        return undefined;
+    if (!managed.hasSnapshot) {
+        try {
+            await managed.wake();
+        }
+        catch (error) {
+            return toolError(`Server "${managed.name}" failed to start: ${reason(error)}`);
+        }
+    }
+    else if (managed.state === 'sleeping') {
+        void managed.wake().catch(() => { });
+    }
+    return undefined;
+};
 /**
  * The aggregate, built for the era it will serve.
  *
@@ -190,41 +225,6 @@ const requireAllowedTool = (managed, tool, server) => {
 export function buildHubServer(supervisor, secret, era) {
     const hub = new McpServer({ name: 'mcp-hub', version: VERSION });
     const findServer = (name) => supervisor.get(name);
-    /**
-     * `hub: false` hides a server's TOOLS from the aggregate — those are meant
-     * to be used through the server's own endpoint. Its lifecycle is a different
-     * matter: wake_server/sleep_server manage hidden servers too, so the error
-     * points at the right door instead of pretending the server does not exist
-     * (/health names every server to the same token anyway).
-     */
-    const requireExposed = (managed) => {
-        if (managed.config.hub)
-            return undefined;
-        return toolError(`Server "${managed.name}" is not exposed through /hub — connect to its own endpoint /${managed.name}/mcp instead.`);
-    };
-    /**
-     * Asking about an on-demand server's tools is the strongest hint that a
-     * call follows, so a sleeping server is pre-warmed in the background while
-     * the cached snapshot answers. Only a server with nothing cached yet (first
-     * ever run) blocks on the start — there is nothing truthful to answer from.
-     * Always-running servers pass through untouched.
-     */
-    const prepare = async (managed) => {
-        if (!managed.onDemand)
-            return undefined;
-        if (!managed.hasSnapshot) {
-            try {
-                await managed.wake();
-            }
-            catch (error) {
-                return toolError(`Server "${managed.name}" failed to start: ${reason(error)}`);
-            }
-        }
-        else if (managed.state === 'sleeping') {
-            void managed.wake().catch(() => { });
-        }
-        return undefined;
-    };
     hub.registerTool('list_servers', {
         title: 'List MCP servers',
         description: 'List all MCP servers available through this hub, with their status. Call this first to see what is available. ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ni-c/mcp-hub",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "Serve multiple stdio MCP servers from one container: Claude-Code-style mcpServers config, path-based routing, hub meta-tools, and CIMD-first OAuth 2.1 + API tokens for ChatGPT, Claude and any Streamable-HTTP MCP client.",
   "keywords": [
     "mcp",
@@ -78,7 +78,7 @@
     "@types/node": "^26.2.0",
     "@types/oidc-provider": "^9.11.1",
     "@types/supertest": "^7.2.1",
-    "@vitest/coverage-v8": "5.0.1",
+    "@vitest/coverage-v8": "5.0.2",
     "fast-check": "^4.9.0",
     "oxlint": "^1.80.0",
     "supertest": "^7.0.0",