Security updates: upgrade @modelcontextprotocol/sdk and @reduxjs/toolkit

[RomneyDa]

This PR consolidates security updates from PRs #9468 and #9430 with proper package lock updates.

Changes

@modelcontextprotocol/sdk upgrade (core)

• From: 1.24.0 → To: 1.25.2
• Location: core/package.json
• Fixes: SNYK-JS-MODELCONTEXTPROTOCOLSDK-14871802
  • Vulnerability: Regular Expression Denial of Service (ReDoS)
  • Severity: High (score: 828/1000)

@reduxjs/toolkit upgrade (gui)

• From: 2.3.0 → To: 2.11.2
• Location: gui/package.json
• Fixes: SNYK-JS-DAGRED3ES-13110069
  • Vulnerability: Prototype Pollution in transitive dependency
  • Severity: Medium (score: 636/1000)
• Additional improvements:
  • Immer v11 with ~25-60% performance improvements
  • Better SSR handling
  • Improved fetchBaseQuery headers
  • Enhanced retry behavior and request abort handling
  • TypeScript 5.4+ support

Package Lock Updates

✅ Updated package-lock.json with all dependency changes
✅ Successfully ran npm install to ensure all locks are in sync
✅ No breaking changes expected

Testing

• Dependencies successfully installed and resolved
• No functional changes to application code
• Both upgrades are within semver minor/patch ranges

Related PRs

• Consolidates [Snyk] Security upgrade @modelcontextprotocol/sdk from 1.24.1 to 1.25.2 #9468 (@modelcontextprotocol/sdk)
• Consolidates [Snyk] Upgrade @reduxjs/toolkit from 2.9.0 to 2.11.2 #9430 (@reduxjs/toolkit)

---

This task was co-authored by dallin and Continue.

---

Continue Tasks

Status	Task	Actions
▶️ Queued	changelog	View
▶️ Queued	test coverage	View
▶️ Queued	Review Agent	View
▶️ Queued	test	View

_{Powered by Continue}

---

Summary by cubic

Upgraded @modelcontextprotocol/sdk and @reduxjs/toolkit to fix security vulnerabilities and improve performance. No application code changes.

• Dependencies
  • core: @modelcontextprotocol/sdk 1.24.0 → 1.25.2; fixes ReDoS (SNYK-JS-MODELCONTEXTPROTOCOLSDK-14871802, High).
  • gui: @reduxjs/toolkit 2.3.0 → 2.11.2; fixes prototype pollution in a transitive dep (SNYK-JS-DAGRED3ES-13110069, Medium).
  • Redux Toolkit brings Immer v11 performance gains, better SSR, improved fetchBaseQuery headers, enhanced retry/abort, and TS 5.4+ support.
  • package-lock.json updated; installs clean; no breaking changes expected.

^{Written for commit 6203b99. Summary will update on new commits.}

[continue-staging]

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

---

Unsubscribe from All Green comments

[continue]

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

---

Unsubscribe from All Green comments

[continue-development-app]

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

---

Unsubscribe from All Green comments

[github-actions]

⚠️ PR Title Format

Your PR title doesn't follow the conventional commit format, but this won't block your PR from being merged. We recommend using this format for better project organization.

Expected Format:

<type>[optional scope]: <description>

Examples:

• feat: add changelog generation support
• fix: resolve login redirect issue
• docs: update README with new instructions
• chore: update dependencies

Valid Types:

feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert

This helps with:

• 📝 Automatic changelog generation
• 🚀 Automated semantic versioning
• 📊 Better project history tracking

This is a non-blocking warning - your PR can still be merged without fixing this.

[github-actions]

✅ Review Complete

Code Review Summary

⚠️ Continue API authentication failed. Please check your CONTINUE_API_KEY.

---

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="core/package.json">

<violation number="1" location="core/package.json:67">
P2: Security bump incomplete: another workspace still pins @modelcontextprotocol/sdk ^1.24.0, leaving the vulnerable version in the repo</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}