This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
ReleasePort's take
Light signalGuardvibe v3.1.23 adds 20 new dependency CVE rules for tRPC prototype pollution and MCP prompt-injection. Self-audit status upgraded from WARN/C/63 to PASS/A/100.
Why it matters: Audit gate now PASS/A/100. Deploy to activate CVE detection rules; verify pinned dependencies (hono, fast-uri, ip-address) before production rollout.
Summary
AI summary20 new dep-CVE rules added and dependency hygiene improvements.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
20 new dep-CVE rules added for tRPC prototype pollution, MCP prompt-injection, and multiple upstream vulnerabilities. 20 new dep-CVE rules added for tRPC prototype pollution, MCP prompt-injection, and multiple upstream vulnerabilities. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Self-audit status upgraded from WARN / C / 63 to PASS / A / 100. Self-audit status upgraded from WARN / C / 63 to PASS / A / 100. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Performance | Medium |
Excluded `package-lock.json` from regex code scan to prevent false-positive caret-range peer dependency warnings. Excluded `package-lock.json` from regex code scan to prevent false-positive caret-range peer dependency warnings. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
`hono`, `fast-uri`, and `ip-address` dependencies pinned to patched releases via overrides. `hono`, `fast-uri`, and `ip-address` dependencies pinned to patched releases via overrides. Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
- 20 new dep-CVE rules added (390 → 406): tRPC prototype pollution, MCP tool description prompt-injection markers, plus the upstream daily-briefing batch (Next.js May 2026 cluster, Drizzle, MikroORM, angular-expressions, Clerk SSRF, Kysely, sandboxjs, @tanstack supply chain, OpenClaude, protobuf.js, Strapi, LangSmith, systeminformation, et al.)
- Dependency hygiene:
hono,fast-uri,ip-addresspinned viaoverridesto patched releases;package-lock.jsonexcluded from regex code scan so caret-range peer-deps don't false-positive - Self-audit returns to PASS / A / 100 (was WARN / C / 63 since v3.1.22)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Beta — feedback welcome: [email protected]