dotnet-mcp-builder: pin sample dependency versions - #2699
Open
jeanpaulhassane-225 wants to merge 1 commit into
Open
dotnet-mcp-builder: pin sample dependency versions#2699jeanpaulhassane-225 wants to merge 1 commit into
jeanpaulhassane-225 wants to merge 1 commit into
Conversation
The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an unpinned major-version tag (@1), which Snyk flags as an unverifiable external dependency / third-party content exposure risk (indirect prompt-injection surface, since the imported module can call app.updateModelContext and app.callServerTool). Pin it to the current release (1.7.5). Also pin the sample `dotnet add package` commands for the ModelContextProtocol* and Microsoft.Extensions.Hosting packages to their current exact versions (2.2.0 / 10.0.11), and correct a stale "2.0.0 is current" note in packages.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@modelcontextprotocol/ext-appsfrom esm.sh using an unpinned major-version tag (@1). Snyk flags this as a medium-risk unverifiable external dependency / third-party content exposure (indirect prompt-injection surface, since the imported module can callapp.updateModelContextandapp.callServerTool). Pinned to the current release,1.7.5.dotnet add packagecommands forModelContextProtocol,ModelContextProtocol.AspNetCore,ModelContextProtocol.Core, andMicrosoft.Extensions.Hostingto their current exact versions (2.2.0/10.0.11) acrosspackages.md,transport-stdio.md,transport-http.md, andclient.md.2.0.0is current" note inpackages.mdto2.2.0.Test plan