fix(deps): patch engine.io (#93) & body-parser (#92) Dependabot alerts

[Marfuen]

Clears the last 2 open Dependabot alerts. Both are runtime scope (not dev-only), so fixed — not dismissed. Branched off main after #3462 (adm-zip) merged; bun.lock regenerated cleanly.

#93 — engine.io (High): Engine.IO polling connection-exhaustion DoS

• Vulnerable engine.io@6.5.5 (<6.6.7) was pulled transitively via @trigger.dev/core → socket.io@4.7.4.
• Added a bun override: "engine.io": "^6.6.7". bun.lock now resolves a single engine.io@6.6.9 — the same version the top-level socket.io@4.8.3 already uses (so wire/protocol compat is proven in-repo). Diff is scoped to engine.io + its own sub-deps only.
• Reachability note: we run no engine.io server (grep found no socket.io server usage); trigger.dev uses it client-side, so this wasn't a reachable DoS — but the override removes the version entirely.

#92 — body-parser (Low): DoS via invalid limit silently disabling size enforcement

• Runtime dep (dev=false) of the published @trycompai/mcp-server, pulled by express@5.2.1. Resolved 2.2.2 (<2.3.0).
• Bumped the transitive dep to 2.3.0 (lockfile-only). express's ^2.2.1 range already permits 2.3.0, so it stays transitive (package.json untouched) and survives Speakeasy SDK regeneration.

Validation

• bun.lock change is scoped to the engine.io subtree; mcp-server package.json unchanged.
• ⚠️ engine.io override touches a trigger.dev transitive dep (6.5.5→6.6.9, minor bump, same Engine.IO v4 protocol). Low risk, but worth a CI/runtime sanity check that Trigger.dev tasks still connect.

---

Summary by cubic

Fixes two runtime security alerts by upgrading engine.io and body-parser. No app code changes; resolves DoS risks flagged by Dependabot.

• Dependencies
  • engine.io: Add override to ^6.6.7, locking to 6.6.9 across the repo (transitive via @trigger.dev/core → socket.io). Matches the version used by top-level socket.io@4.8.3; we don’t run an engine.io server but this removes the vulnerable version.
  • body-parser: Bump transitive dep in apps/mcp-server from 2.2.2 to 2.3.0 via lockfile (pulled by express@5.2.1) to fix invalid limit DoS.

^{Written for commit 31aca30. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	Jul 21, 2026 3:31am
comp-framework-editor	Ready	Preview, Comment	Jul 21, 2026 3:31am
portal	Ready	Preview, Comment	Jul 21, 2026 3:31am

[cubic-dev-ai]

1 issue found across 3 files

Confidence score: 3/5

• In package.json, the global override forcing engine.io to 6.6.9 can put socket.io@4.7.4 outside Trigger.dev’s expected ~6.5.2 range, which risks task/realtime connection failures after merge. Revert or narrow the override to a Trigger.dev-compatible engine.io version and verify a Trigger.dev connection smoke test before merging.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="package.json">

<violation number="1" location="package.json:109">
P2: Trigger.dev task/realtime connections can break if socket.io 4.7.4 relies on engine.io 6.5-specific behavior, because this global override forces 6.6.9 outside its declared `~6.5.2` range. A Trigger.dev connection smoke test or an upgrade to a Trigger.dev/socket.io version declaring the patched range would make this compatibility change safe rather than relying only on the top-level socket.io 4.8.3 consumer.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Trigger.dev task/realtime connections can break if socket.io 4.7.4 relies on engine.io 6.5-specific behavior, because this global override forces 6.6.9 outside its declared ~6.5.2 range. A Trigger.dev connection smoke test or an upgrade to a Trigger.dev/socket.io version declaring the patched range would make this compatibility change safe rather than relying only on the top-level socket.io 4.8.3 consumer.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 109:

<comment>Trigger.dev task/realtime connections can break if socket.io 4.7.4 relies on engine.io 6.5-specific behavior, because this global override forces 6.6.9 outside its declared `~6.5.2` range. A Trigger.dev connection smoke test or an upgrade to a Trigger.dev/socket.io version declaring the patched range would make this compatibility change safe rather than relying only on the top-level socket.io 4.8.3 consumer.</comment>

<file context>
@@ -106,6 +106,7 @@
     "@vitest/ui": "^3.2.7",
     "form-data": "^4.0.6",
     "ws": "^8.21.0",
+    "engine.io": "^6.6.7",
     "semver": "^7.8.5",
     "hono": "^4.12.25",
</file context>