fix(deps): resolve dependabot security vulnerabilities

Author: vados-cosmonic

examples/components/node-mcp-server/package.json

@@ -17,12 +17,12 @@
     "dependencies": {
         "@bytecodealliance/jco-std": "^0.5.0",
         "@bytecodealliance/preview2-shim": "0.27.1",
-        "@modelcontextprotocol/server": "2.0.0",
-        "zod": "4.5.4"
+        "@modelcontextprotocol/server": "2.3.0",
+        "zod": "4.6.7"
     },
     "devDependencies": {
         "@bytecodealliance/jco": "workspace:*",
-        "@modelcontextprotocol/client": "2.2.0"
+        "@modelcontextprotocol/client": "2.3.0"
     },
     "engines": {
         "node": ">=24"

examples/components/node-sveltekit-server/README.md

@@ -15,7 +15,8 @@ process.
 ## How it works
 
 The standard SvelteKit Node deployment flow starts when Vite builds the
-application with `@sveltejs/adapter-node`. The adapter produces
+application with `@sveltejs/adapter-node`, configured through the SvelteKit 3
+plugin in [`vite.config.js`](./vite.config.js). The adapter produces
 `build/handler.js`, containing SvelteKit's SSR server, form-action routing, and
 static asset middleware. Normally, an application imports that handler, passes
 it to a `node:http` server, and starts listening.
@@ -120,7 +121,8 @@ HTTP callbacks.
 
 jco-std's `AsyncLocalStorage` support is intentionally synchronous, while
 SvelteKit uses async request-local storage. The component-only bundle config
-selects SvelteKit's existing serialized-request fallback. It also bypasses
+selects SvelteKit's existing serialized-request fallback and disables optional
+Node diagnostics that use the unsupported `process.getBuiltinModule`. It also bypasses
 `String.prototype.normalize` for generated ASCII asset names because that
 method is not currently available in StarlingMonkey.
 
@@ -140,7 +142,7 @@ resulting Wasm. The future runtime's host capabilities are not attached during
 that build-time execution.
 
 Loading `node:http` initializes host-backed Node state, and the Node adapter
-reads `process.env` and indexes its generated client directory. The wrapper
+reads `process.env` and locates its generated client directory. The wrapper
 therefore dynamically imports [`src/runtime.ts`](./src/runtime.ts), which loads
 `node:http` and the adapter entry point, inside `start` after the component
 embedder has supplied HTTP, process, filesystem, and TTY capabilities.

examples/components/node-sveltekit-server/package.json

@@ -28,14 +28,14 @@
     },
     "devDependencies": {
         "@bytecodealliance/jco": "workspace:*",
-        "@sveltejs/adapter-node": "5.5.7",
-        "@sveltejs/kit": "2.70.3",
+        "@sveltejs/adapter-node": "6.0.0",
+        "@sveltejs/kit": "3.1.0",
         "@types/node": "^24.3.0",
         "puppeteer": "catalog:",
-        "svelte": "5.57.0",
+        "svelte": "5.57.2",
         "svelte-check": "4.7.6",
         "typescript": "6.0.3",
-        "vite": "8.3.0"
+        "vite": "8.3.3"
     },
     "engines": {
         "node": ">=24"

examples/components/node-sveltekit-server/scripts/bundle-config.mjs

@@ -5,11 +5,10 @@ export default {
             transform(code, id) {
                 const normalizedId = id.replaceAll('\\', '/');
 
-                if (normalizedId.endsWith('/build/env.js')) {
-                    return code.replace(
-                        'path.dirname(fileURLToPath(import.meta.url))',
-                        "path.resolve(process.cwd(), 'build')",
-                    );
+                if (normalizedId.endsWith('/build/adapter-node.js')) {
+                    return code
+                        .replace("import { dirname } from 'node:path';", "import { resolve } from 'node:path';")
+                        .replace('dirname(fileURLToPath(import.meta.url))', "resolve(process.cwd(), 'build')");
                 }
 
                 if (normalizedId.includes('/build/server/')) {
@@ -19,9 +18,19 @@ export default {
                         // requests and carries the same context without it.
                         .replaceAll('!!globalThis.process?.versions?.webcontainer', 'true')
                         .replaceAll(
-                            "import('node:async_hooks')",
+                            /import\((['"])node:async_hooks\1\)/g,
                             "Promise.reject(new Error('AsyncLocalStorage is unavailable in this component'))",
-                        );
+                        )
+                        // jco-std throws for getBuiltinModule. Let SvelteKit's
+                        // optional Node diagnostics use their non-Node fallback.
+                        .replaceAll('globalThis.process?.getBuiltinModule', 'undefined')
+                        // Vite retains an unused Node metadata read. Resolving
+                        // import.meta after snapshotting traps in StarlingMonkey.
+                        .replaceAll('import.meta.dirname;', '')
+                        // StarlingMonkey lacks this Unicode property escape in
+                        // dynamic regexes. Keep the equivalent range and u flag
+                        // so valid surrogate pairs remain intact when escaping HTML.
+                        .replaceAll(String.raw`\\p{Surrogate}`, String.raw`[\\uD800-\\uDFFF]`);
 
                     // StarlingMonkey does not currently implement
                     // String.prototype.normalize. SvelteKit's static asset server

examples/components/node-sveltekit-server/svelte.config.js

@@ -159,6 +159,12 @@ for (const target of targets) {
         assert.equal(invalid.status, 400);
         assert.match(await invalid.text(), /Give this task a short, useful name\./);
 
+        const escaped = await submit(url, 'add', { title: 'Escape <script>alert("x")</script> & 🌍' });
+        assert.equal(escaped.status, 200);
+        const escapedHtml = await escaped.text();
+        assert.ok(escapedHtml.includes('Escape &lt;script>alert("x")&lt;/script> &amp; 🌍'));
+        assert.ok(!escapedHtml.includes('<script>alert("x")</script>'));
+
         const missing = await fetch(new URL('/missing', url));
 
         assert.equal(missing.status, 404);

examples/components/node-sveltekit-server/test/e2e.ts

@@ -1,5 +1,7 @@
 {
-    "extends": "./.svelte-kit/tsconfig.json",
+    "extends": "$app/tsconfig",
+    "include": ["src", "test", "*.js"],
+    "exclude": ["node_modules", "build", "dist"],
     "compilerOptions": {
         "allowImportingTsExtensions": true,
         "esModuleInterop": true,

examples/components/node-sveltekit-server/tsconfig.json

@@ -1,6 +1,7 @@
+import adapter from '@sveltejs/adapter-node';
 import { sveltekit } from '@sveltejs/kit/vite';
 import { defineConfig } from 'vite';
 
 export default defineConfig({
-    plugins: [sveltekit()],
+    plugins: [sveltekit({ adapter: adapter({ out: 'build' }) })],
 });

examples/components/node-sveltekit-server/vite.config.js

@@ -756,7 +756,7 @@
     "hono": "^4.13.11",
     "rolldown": "^1.0.0-beta.46",
     "typescript": "catalog:",
-    "vitest": "^4.1.11",
+    "vitest": "^4.1.12",
     "which": "^5.0.0"
   },
   "peerDependencies": {

packages/jco-std/package.json

@@ -86,7 +86,7 @@
         "typescript": "catalog:",
         "typescript-compiler-api": "npm:typescript@6.0.3",
         "vite": "^7.3.7",
-        "vitest": "^4.1.11",
+        "vitest": "^4.1.12",
         "which": "catalog:"
     }
 }