step-security · Raj-StepSecurity · Aug 10, 2026 · Aug 10, 2026
diff --git a/base-action/bun.lock b/base-action/bun.lock
diff --git a/base-action/osv-scanner.toml b/base-action/osv-scanner.toml
@@ -0,0 +1,3 @@
+[[IgnoredVulns]]
+id = "GHSA-frvp-7c67-39w9"
+reason = "@hono/node-server is a transitive dependency of @modelcontextprotocol/sdk used only for SSE/HTTP transport, not serve-static middleware; the vulnerability requires serve-static with prefix-mounted middleware guards which is not used anywhere; additionally Windows-only, this action runs on Linux GitHub Actions runners"
diff --git a/base-action/package.json b/base-action/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "@actions/core": "^2.0.3",
     "@anthropic-ai/claude-agent-sdk": "^0.3.220",
-    "axios": "^1.16.1",
+    "axios": "^1.18.0",
     "shell-quote": "^1.8.4"
   },
   "devDependencies": {

diff --git a/base-action/test/mcp-test/bun.lock b/base-action/test/mcp-test/bun.lock