Waleed 4b133984c6 fix(mcp): make SSRF-guarded fetch structurally mandatory in OAuth auth() calls (#5419) ...

PR #5399 fixed the callback route forgetting to pass fetchFn into the SDK's
auth(), but every call site (start + callback routes) still imported the raw
SDK auth() directly and had to remember to pass fetchFn: createSsrfGuardedMcpFetch()
by hand — the same omission was possible again at any future call site.

Add mcpAuthGuarded() in lib/mcp/oauth/auth.ts, a thin wrapper around the SDK's
auth() that always defaults fetchFn to the SSRF-guarded fetch (still overridable
for tests). Both routes now import mcpAuthGuarded from @/lib/mcp/oauth instead
of the raw SDK auth, so omitting the guard is no longer possible by omission.

2026-07-04 15:40:38 -07:00

..

src

fix(mcp): make SSRF-guarded fetch structurally mandatory in OAuth auth() calls (#5419)

2026-07-04 15:40:38 -07:00

package.json

fix(deps): upgrade vitest to ^4.1.0 to patch critical Vitest UI advisory (GHSA-5xrq-8626-4rwp) (#4837)

2026-06-01 16:11:35 -07:00

tsconfig.json

improvement(monorepo): added tsconfig package, resolved type errors in testing package (#2613)

2025-12-28 00:36:48 -08:00