Skip to content

Conversation

@27Bslash6
Copy link
Contributor

@27Bslash6 27Bslash6 commented Oct 30, 2025

Changes

Dependency Updates

  • @modelcontextprotocol/sdk: 1.0.1 → 1.20.2 (critical updates, 20 versions behind)
  • axios: removed (unused dependency)
  • dotenv: 16.3.1 → 16.6.1
  • shx: 0.3.4 → 0.4.0
  • typescript: 5.6.2 → 5.9.3
  • vitest: 4.0.5 (new, for testing)

Resolves:

Bug Fixes

  • Add validation for API response structure (prevents null pointer crashes)
  • Add message structure validation in all tool handlers (zero-trust validation)
  • Fix timeout handling to read env var dynamically (was stale at module load)
  • Export functions for proper testing

Testing

  • 47 tests total (31 unit + 16 integration)
  • Coverage: API responses, error handling, edge cases, concurrency, all 4 tool types
  • Test configuration with proper env vars

Code Quality

  • Extract validation helper to eliminate duplication (DRY)
  • Follows MCP security best practices for input validation

Test Results

Test Files  2 passed (2)
      Tests  47 passed (47)
  Duration  447ms

Build: ✓ Clean
Security: ✓ 0 vulnerabilities
MCP: ✓ All tools functional

Breaking Changes

None. All changes are backward compatible.

- update @modelcontextprotocol/sdk 1.0.1 → 1.20.2
- update axios 1.6.2 → 1.13.1
- update dotenv 16.3.1 → 16.6.1
- update shx 0.3.4 → 0.4.0
- update typescript 5.6.2 → 5.9.3
- add vitest 4.0.5 for testing

resolves npm warnings for deprecated [email protected] and [email protected]
fixes 5 moderate severity vulnerabilities in vitest dependency chain
- validate choices array exists and is non-empty
- validate message content is string type
- add message structure validation in tool handlers
- export functions for testing

prevents null pointer crashes on malformed API responses
follows MCP security best practices for zero-trust validation
unit tests:
- formatSearchResults edge cases
- performChatCompletion success and error paths
- performSearch parameter handling
- API response validation
- timeout and error handling
- concurrent requests
- special characters and long content

integration tests:
- all four tool types (ask, research, reason, search)
- real-world scenarios
- multi-turn conversations
- performance and reliability

tests run against actual implementation via imports
vitest configured with proper env vars and exclusions
@27Bslash6 27Bslash6 marked this pull request as draft October 30, 2025 12:23
@27Bslash6 27Bslash6 force-pushed the fix/deps-security-tests branch from 08f5599 to c9e9d59 Compare October 30, 2025 12:24
- Add coverage configuration to vitest for improved test reporting
- Introduce a new GitHub Actions workflow for automated testing on push and pull requests
- Update .gitignore to exclude coverage directory
- Add @vitest/coverage-v8 as a development dependency for coverage analysis
- Introduce a new test command for coverage reporting in package.json
@27Bslash6 27Bslash6 marked this pull request as ready for review October 30, 2025 12:28
@kesku
Copy link
Contributor

kesku commented Nov 4, 2025

Awesome work! Thank you very much, will include in next release

@kesku kesku merged commit d0b358a into perplexityai:main Nov 4, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants