jlxq0/hevy-mcp
Watch
1
0
Fork
You've already forked hevy-mcp
 0
Code Issues 2 Pull requests Projects Releases 1 Packages 1 Wiki Activity Actions

fix: update vulnerable MCP, tracing and hashing dependencies #18

Merged
jlxq0 merged 1 commit from fix/dependency-gates-20261029 into main 2026-10-28 20:55:04 +00:00
Conversation 0 Commits 1 Files changed 5 +101 -60
jlxq0 commented 2026-10-28 20:51:39 +00:00
Owner

Update RMCP, the coherent OpenTelemetry dependency set and SHA-2 to fixed release lines, preserving bearer forwarding, API behavior and SHA-256 cache identities. Add a checksum-pinned OSV check to the required cargo CI job so GitHub advisories missing from RustSec also fail the build.

Validation: 59 tests passed; Rust 1.93 MSRV check, pinned Clippy 1.98, fmt, cargo audit and cargo deny passed. OSV 2.5.1 finds zero results in the updated lockfile (six before). Fixed SHA-256 compatibility vectors include Unicode and block boundaries. Fresh independent read-only Codex review approved exact head f41981960d before this PR; exact-head CI remains required. No runtime image/base or release-version change is included; final image scanning is a separate gate.

Update RMCP, the coherent OpenTelemetry dependency set and SHA-2 to fixed release lines, preserving bearer forwarding, API behavior and SHA-256 cache identities. Add a checksum-pinned OSV check to the required cargo CI job so GitHub advisories missing from RustSec also fail the build. Validation: 59 tests passed; Rust 1.93 MSRV check, pinned Clippy 1.98, fmt, cargo audit and cargo deny passed. OSV 2.5.1 finds zero results in the updated lockfile (six before). Fixed SHA-256 compatibility vectors include Unicode and block boundaries. Fresh independent read-only Codex review approved exact head f41981960d9fc17c122297409980de75df9e59a1 before this PR; exact-head CI remains required. No runtime image/base or release-version change is included; final image scanning is a separate gate.
fix(deps): clear MCP, telemetry and digest advisories
All checks were successful
CI / cargo (pull_request) Successful in 1m16s
Details
CI / docker (pull_request) Successful in 1m10s
Details
f41981960d
jlxq0 merged commit 746b812fe9 into main 2026-10-28 20:55:04 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
waiting-on-julian
Blocked on Julian. The ask is in the issue.

No labels
waiting-on-julian
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jlxq0/hevy-mcp!18
No description provided.