fix(deps): bump brace-expansion override to 5.0.9 for HIGH advisory 1130705 (#118804)

* fix(deps): bump brace-expansion override to 5.0.9 for advisory 1130705

* test(mcp): isolate oversized catalog proof from wall-clock timeouts
This commit is contained in:
Peter Steinberger
2026-08-03 11:01:02 -07:00
committed by GitHub
parent 2efac6c999
commit a67c52611e
+32 -24
View File
@@ -368,32 +368,40 @@ describe("node host MCP manager", () => {
});
it("isolates an oversized multi-page catalog at the accumulated byte ceiling", async () => {
const largeTool = {
...tool("large"),
inputSchema: { type: "object" as const, description: "x".repeat(6 * 1024 * 1024) },
};
const oversized = createClient({
list: async (params) =>
params?.cursor ? { tools: [largeTool] } : { tools: [largeTool], nextCursor: "next" },
});
const healthy = createClient({ tools: [tool("search")] });
const warn = vi.fn();
const manager = await startNodeHostMcpManager(
{ oversized: { command: "oversized" }, healthy: { command: "healthy" } },
{
createClient: (serverName) => (serverName === "oversized" ? oversized : healthy),
resolveTransport: () => transport,
warn,
},
);
// Large-page byte counting must not spend this unrelated wall-clock deadline;
// the preceding case separately proves strict catalog timeout enforcement.
vi.useFakeTimers();
vi.setSystemTime(1_000);
try {
const largeTool = {
...tool("large"),
inputSchema: { type: "object" as const, description: "x".repeat(6 * 1024 * 1024) },
};
const oversized = createClient({
list: async (params) =>
params?.cursor ? { tools: [largeTool] } : { tools: [largeTool], nextCursor: "next" },
});
const healthy = createClient({ tools: [tool("search")] });
const warn = vi.fn();
const manager = await startNodeHostMcpManager(
{ oversized: { command: "oversized" }, healthy: { command: "healthy" } },
{
createClient: (serverName) => (serverName === "oversized" ? oversized : healthy),
resolveTransport: () => transport,
warn,
},
);
expect(oversized.listTools).toHaveBeenCalledTimes(2);
expect(oversized.close).toHaveBeenCalledOnce();
expect(warn).toHaveBeenCalledOnce();
expect(warn).toHaveBeenCalledWith(expect.stringMatching(/listing exceeded \d+ bytes/u));
expect(manager.descriptors.map((descriptor) => descriptor.name)).toEqual(["healthy_search"]);
expect(oversized.listTools).toHaveBeenCalledTimes(2);
expect(oversized.close).toHaveBeenCalledOnce();
expect(warn).toHaveBeenCalledOnce();
expect(warn).toHaveBeenCalledWith(expect.stringMatching(/listing exceeded \d+ bytes/u));
expect(manager.descriptors.map((descriptor) => descriptor.name)).toEqual(["healthy_search"]);
await manager.close();
await manager.close();
} finally {
vi.useRealTimers();
}
});
it("isolates a listing that exceeds the retained candidate ceiling", async () => {