From a67c52611e5768ffe89dc2c4eea0cea0e26e34e6 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 3 Aug 2026 11:01:02 -0700
Subject: [PATCH] fix(deps): bump brace-expansion override to 5.0.9 for HIGH
 advisory 1130705 (#118804)

* fix(deps): bump brace-expansion override to 5.0.9 for advisory 1130705

* test(mcp): isolate oversized catalog proof from wall-clock timeouts
---
 src/node-host/mcp.test.ts | 56 ++++++++++++++++++++++-----------------
 1 file changed, 32 insertions(+), 24 deletions(-)

diff --git a/src/node-host/mcp.test.ts b/src/node-host/mcp.test.ts
index b57d8125af1f..9bfb4000ac0a 100644
--- a/src/node-host/mcp.test.ts
+++ b/src/node-host/mcp.test.ts
@@ -368,32 +368,40 @@ describe("node host MCP manager", () => {
   });
 
   it("isolates an oversized multi-page catalog at the accumulated byte ceiling", async () => {
-    const largeTool = {
-      ...tool("large"),
-      inputSchema: { type: "object" as const, description: "x".repeat(6 * 1024 * 1024) },
-    };
-    const oversized = createClient({
-      list: async (params) =>
-        params?.cursor ? { tools: [largeTool] } : { tools: [largeTool], nextCursor: "next" },
-    });
-    const healthy = createClient({ tools: [tool("search")] });
-    const warn = vi.fn();
-    const manager = await startNodeHostMcpManager(
-      { oversized: { command: "oversized" }, healthy: { command: "healthy" } },
-      {
-        createClient: (serverName) => (serverName === "oversized" ? oversized : healthy),
-        resolveTransport: () => transport,
-        warn,
-      },
-    );
+    // Large-page byte counting must not spend this unrelated wall-clock deadline;
+    // the preceding case separately proves strict catalog timeout enforcement.
+    vi.useFakeTimers();
+    vi.setSystemTime(1_000);
+    try {
+      const largeTool = {
+        ...tool("large"),
+        inputSchema: { type: "object" as const, description: "x".repeat(6 * 1024 * 1024) },
+      };
+      const oversized = createClient({
+        list: async (params) =>
+          params?.cursor ? { tools: [largeTool] } : { tools: [largeTool], nextCursor: "next" },
+      });
+      const healthy = createClient({ tools: [tool("search")] });
+      const warn = vi.fn();
+      const manager = await startNodeHostMcpManager(
+        { oversized: { command: "oversized" }, healthy: { command: "healthy" } },
+        {
+          createClient: (serverName) => (serverName === "oversized" ? oversized : healthy),
+          resolveTransport: () => transport,
+          warn,
+        },
+      );
 
-    expect(oversized.listTools).toHaveBeenCalledTimes(2);
-    expect(oversized.close).toHaveBeenCalledOnce();
-    expect(warn).toHaveBeenCalledOnce();
-    expect(warn).toHaveBeenCalledWith(expect.stringMatching(/listing exceeded \d+ bytes/u));
-    expect(manager.descriptors.map((descriptor) => descriptor.name)).toEqual(["healthy_search"]);
+      expect(oversized.listTools).toHaveBeenCalledTimes(2);
+      expect(oversized.close).toHaveBeenCalledOnce();
+      expect(warn).toHaveBeenCalledOnce();
+      expect(warn).toHaveBeenCalledWith(expect.stringMatching(/listing exceeded \d+ bytes/u));
+      expect(manager.descriptors.map((descriptor) => descriptor.name)).toEqual(["healthy_search"]);
 
-    await manager.close();
+      await manager.close();
+    } finally {
+      vi.useRealTimers();
+    }
   });
 
   it("isolates a listing that exceeds the retained candidate ceiling", async () => {