Stage #9269

evereq · 2025-12-16T12:05:48Z

PR

Have you followed the contributing guidelines?
Have you explained what your changes do, and why they add value?

Please note: we will close your PR without comment if you do not check the boxes above and provide ALL requested information.

Summary by cubic

Fixes native Node.js module rebuilds in MCP and MCP Auth Docker images using a manual postinstall, improving build reliability on Alpine. Updates @modelcontextprotocol/sdk to 1.24.0 and aligns related dependencies; adds a few cspell dictionary entries.

Bug Fixes
- Use yarn postinstall.manual instead of npm rebuild for native modules.
- Add ts-node globally and include .scripts/postinstall.js in Docker builds.
- Stabilizes builds for bcrypt and better-sqlite3 in production.
Dependencies
- Bump @modelcontextprotocol/sdk to 1.24.0.
- Align deps: ajv v8 + ajv-formats, jose 6.1.3, zod 4.x, zod-to-json-schema 3.25.0.
- Update @typescript-eslint packages to 8.49.0.

^{Written for commit 4a6ba91. Summary will update automatically on new commits.}

#9268) * fix: use the correct rebuild patterns for all native packages * Update .deploy/mcp/Dockerfile Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * fix: add review suggestions --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

) * chore(deps): bump @modelcontextprotocol/sdk from 1.15.1 to 1.24.0 Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.15.1 to 1.24.0. - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.15.1...1.24.0) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.24.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * fix: add commands for native nodejs modules * fix: add typos spelling * fix: add typos spelling --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: rolandm99 <[email protected]>

coderabbitai · 2025-12-16T12:05:58Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch develop

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cla-assistant · 2025-12-16T12:06:08Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ RolandM99
❌ dependabot[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cubic-dev-ai

No issues found across 4 files

greptile-apps · 2025-12-16T12:11:00Z

Greptile Overview

Greptile Summary

This PR merges changes from develop to stage, including a dependency bump for @modelcontextprotocol/sdk from 1.15.1 to 1.24.0 and Docker build improvements.

Key Changes:

Updated @modelcontextprotocol/sdk with new dependencies (ajv@^8, ajv-formats, jose)
Added spell check entries for build tools and CI/CD terms
Modified Docker build process to use yarn postinstall.manual instead of explicit npm rebuild commands
Added [email protected] global installation in Dockerfiles

Critical Issue Found:
The change from npm rebuild bcrypt better-sqlite3 --build-from-source to yarn postinstall.manual introduces a regression. The .scripts/postinstall.js script attempts to rebuild native modules by running yarn add ${packageName} --force from inside the node_modules/{package} directory (line 96), which is incorrect. This will fail to properly compile native modules like bcrypt and better-sqlite3, causing runtime errors in the Docker containers.

Impact:
This affects both the MCP and MCP-AUTH Docker images. Native module compilation will likely fail, preventing the services from starting correctly.

Confidence Score: 1/5

This PR introduces a critical regression that will break native module compilation in Docker builds
Score reflects the critical bug in the Docker build process where native modules (bcrypt, better-sqlite3) will not be properly compiled due to incorrect rebuild logic in postinstall.js. This was a working pattern that was replaced with a broken implementation.
Pay critical attention to .deploy/mcp-auth/Dockerfile and .deploy/mcp/Dockerfile - both contain the broken native module rebuild logic that must be fixed before merge

Important Files Changed

File Analysis

Filename	Score	Overview
.cspell.json	5/5	Added spelling dictionary entries for build tools and CI/CD terms like `buildtools`, `choco`, `hostedtoolcache`, `MSVC`, `runneradmin`, `WARPBUILD`, etc.
.deploy/mcp-auth/Dockerfile	2/5	Replaced `npm rebuild bcrypt better-sqlite3 --build-from-source` with `yarn postinstall.manual`. Critical issue: postinstall.js script has incorrect rebuild logic.
.deploy/mcp/Dockerfile	2/5	Replaced `npm rebuild bcrypt --build-from-source` with `yarn postinstall.manual`. Same critical issue with postinstall.js script rebuild logic.
yarn.lock	5/5	Dependency updates including `@modelcontextprotocol/sdk` from 1.15.1 to 1.24.0, TypeScript ESLint packages, and related dependencies with no issues detected.

Sequence Diagram

sequenceDiagram
    participant Developer
    participant Docker as Docker Build
    participant Yarn as Yarn Install
    participant PostInstall as postinstall.js
    participant NPM as npm rebuild
    participant NativeModules as Native Modules (bcrypt, better-sqlite3)

    Developer->>Docker: Build Docker image
    Docker->>Yarn: yarn install --frozen-lockfile --ignore-scripts
    Yarn-->>Docker: Dependencies installed (scripts skipped)
    
    Docker->>PostInstall: yarn postinstall.manual (ts-node .scripts/postinstall.js)
    PostInstall->>PostInstall: Find postinstall scripts in node_modules
    PostInstall->>PostInstall: Run found postinstall scripts
    
    Note over PostInstall,NativeModules: ISSUE: postinstall.js attempts to rebuild native modules<br/>using "yarn add {package} --force" from inside<br/>node_modules/{package} directory - INCORRECT!
    
    PostInstall->>NativeModules: yarn add bcrypt --force (from wrong directory)
    NativeModules-->>PostInstall: Rebuild fails or incomplete
    
    Note over Docker,NPM: MISSING: Explicit npm rebuild command<br/>that was removed in this PR
    
    Docker->>Docker: Continue build (with potentially broken native modules)

greptile-apps

_{3 files reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2025-12-16T12:10:57Z

.deploy/mcp-auth/Dockerfile


 RUN yarn install --network-timeout 1000000 --frozen-lockfile --ignore-scripts \
-    && npm rebuild bcrypt better-sqlite3 --build-from-source \
+    && yarn postinstall.manual \


logic: The postinstall.js script (line 96) runs yarn add ${packageName} --force from inside node_modules/{package}, which is incorrect. This will fail to properly rebuild native modules. The previous approach using npm rebuild bcrypt better-sqlite3 --build-from-source was correct and should be restored.

Suggested change

&& yarn postinstall.manual \

&& node ./.scripts/postinstall.js && npm rebuild bcrypt better-sqlite3 --build-from-source \

Prompt To Fix With AI

This is a comment left during a code review. Path: .deploy/mcp-auth/Dockerfile Line: 68:68 Comment: **logic:** The postinstall.js script (line 96) runs `yarn add ${packageName} --force` from inside `node_modules/{package}`, which is incorrect. This will fail to properly rebuild native modules. The previous approach using `npm rebuild bcrypt better-sqlite3 --build-from-source` was correct and should be restored. ```suggestion && node ./.scripts/postinstall.js && npm rebuild bcrypt better-sqlite3 --build-from-source \ ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2025-12-16T12:10:58Z

.deploy/mcp-auth/Dockerfile


 RUN yarn install --network-timeout 1000000 --frozen-lockfile --ignore-scripts --production \
-    && npm rebuild bcrypt better-sqlite3 --build-from-source \
+    && yarn postinstall.manual \


logic: Same issue in production dependencies stage - the postinstall.js script has incorrect rebuild logic. Restore the explicit npm rebuild command.

Suggested change

&& yarn postinstall.manual \

&& node ./.scripts/postinstall.js && npm rebuild bcrypt better-sqlite3 --build-from-source \

Prompt To Fix With AI

This is a comment left during a code review. Path: .deploy/mcp-auth/Dockerfile Line: 119:119 Comment: **logic:** Same issue in production dependencies stage - the postinstall.js script has incorrect rebuild logic. Restore the explicit `npm rebuild` command. ```suggestion && node ./.scripts/postinstall.js && npm rebuild bcrypt better-sqlite3 --build-from-source \ ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2025-12-16T12:10:58Z

.deploy/mcp/Dockerfile


 RUN yarn install --network-timeout 1000000 --frozen-lockfile --ignore-scripts \
-    && npm rebuild bcrypt --build-from-source \
+    && yarn postinstall.manual \


logic: The postinstall.js script cannot properly rebuild native modules - it runs yarn add from inside the package directory instead of running npm rebuild from the root. Restore the explicit rebuild command.

Suggested change

&& yarn postinstall.manual \

&& node ./.scripts/postinstall.js && npm rebuild bcrypt --build-from-source \

Prompt To Fix With AI

This is a comment left during a code review. Path: .deploy/mcp/Dockerfile Line: 114:114 Comment: **logic:** The postinstall.js script cannot properly rebuild native modules - it runs `yarn add` from inside the package directory instead of running `npm rebuild` from the root. Restore the explicit rebuild command. ```suggestion && node ./.scripts/postinstall.js && npm rebuild bcrypt --build-from-source \ ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2025-12-16T12:10:59Z

.deploy/mcp/Dockerfile


 RUN yarn install --network-timeout 1000000 --frozen-lockfile --ignore-scripts --production \
-    && npm rebuild bcrypt --build-from-source \
+    && yarn postinstall.manual \


logic: Same issue in production dependencies - restore the explicit npm rebuild command to properly build native modules.

Suggested change

&& yarn postinstall.manual \

&& node ./.scripts/postinstall.js && npm rebuild bcrypt --build-from-source \

Prompt To Fix With AI

This is a comment left during a code review. Path: .deploy/mcp/Dockerfile Line: 164:164 Comment: **logic:** Same issue in production dependencies - restore the explicit `npm rebuild` command to properly build native modules. ```suggestion && node ./.scripts/postinstall.js && npm rebuild bcrypt --build-from-source \ ``` How can I resolve this? If you propose a fix, please make it concise.

RolandM99 and others added 2 commits December 16, 2025 10:58

evereq merged commit b229557 into stage Dec 16, 2025
25 of 31 checks passed

cubic-dev-ai bot reviewed Dec 16, 2025

View reviewed changes

greptile-apps bot reviewed Dec 16, 2025

View reviewed changes

evereq temporarily deployed to stage December 16, 2025 12:18 — with GitHub Actions Inactive

evereq temporarily deployed to stage December 16, 2025 12:27 — with GitHub Actions Inactive

evereq temporarily deployed to stage December 16, 2025 14:59 — with GitHub Actions Inactive

evereq temporarily deployed to demo December 16, 2025 15:32 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Stage #9269

Stage #9269

Uh oh!

evereq commented Dec 16, 2025 •

edited by cubic-dev-ai bot

Loading

Uh oh!

coderabbitai bot commented Dec 16, 2025

Review skipped

Uh oh!

Uh oh!

cla-assistant bot commented Dec 16, 2025

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

greptile-apps bot commented Dec 16, 2025

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Dec 16, 2025

Uh oh!

greptile-apps bot Dec 16, 2025

Uh oh!

greptile-apps bot Dec 16, 2025

Uh oh!

greptile-apps bot Dec 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	&& yarn postinstall.manual \
	&& node ./.scripts/postinstall.js && npm rebuild bcrypt better-sqlite3 --build-from-source \

Stage #9269

Stage #9269

Uh oh!

Conversation

evereq commented Dec 16, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR

Summary by cubic

Uh oh!

coderabbitai bot commented Dec 16, 2025

Review skipped

Uh oh!

Uh oh!

cla-assistant bot commented Dec 16, 2025

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Dec 16, 2025

Greptile Overview

Greptile Summary

Confidence Score: 1/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

evereq commented Dec 16, 2025 •

edited by cubic-dev-ai bot

Loading