[zyl71]

Updates

• Affected products

Comments
The advisory text recommends "@modelcontextprotocol/core 2.2.0 or later if you import it directly", but only @modelcontextprotocol/sdk and @modelcontextprotocol/client are listed. The fix commit edd12e2 (PR 2887) changes packages/core/src/auth.ts, adding issuer to OAuthTokensSchema and OAuthClientInformationSchema, and its changeset bumps @modelcontextprotocol/core. The commit is contained in the tag @modelcontextprotocol/[email protected] but not in @modelcontextprotocol/[email protected]. This change adds @modelcontextprotocol/core with the range >= 2.0.0, < 2.2.0.

Evidence

• Fix PR 2887: fix(client): deprecate omitting expectedIssuer and apply the SEP-2352 issuer check consistently modelcontextprotocol/typescript-sdk#2887
• Fix commit edd12e2: modelcontextprotocol/typescript-sdk@edd12e2
• Compare [email protected]@2.2.0: modelcontextprotocol/typescript-sdk@@modelcontextprotocol/[email protected]...@modelcontextprotocol/[email protected]
• npm @modelcontextprotocol/core: https://www.npmjs.com/package/@modelcontextprotocol/core

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The advisory update is limited to documenting the affected @modelcontextprotocol/core range and fixed version, with no active review issues identified.

No open issues 🎉

What changed in this PR

Updates the GHSA advisory to include @modelcontextprotocol/core as an affected npm package, matching the documented upgrade guidance.

Changes:

• Adds @modelcontextprotocol/core to the affected package list.
• Marks versions 2.0.0 through before 2.2.0 as affected.
• Records 2.2.0 as the fixed version.

File	Description
advisories/​github-reviewed/​2026/​10/​GHSA-6qxp-vccf-f47h/​GHSA-6qxp-vccf-f47h.json	Adds the affected range and fixed version for @modelcontextprotocol/core.

_{Review effort: Lite (auto)}