JanssenProject / JanssenProject/jans
Security: upgrade demos/mcp mcp-sdk from 0.16.0 to >=1.1.1 (GHSA-8jxr-pr72-r468, GHSA-hv2w-8mjj-jw22)
@pujavs is already working on this.
Since Jun 2, 2026.
- Dominant language
- Java
- Stars
- 648
- Forks
- 174
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
## Summary
The MCP demo at `demos/mcp/config-api/mcp-config-api-server` uses `io.modelcontextprotocol.sdk:mcp:0.16.0`, which is affected by:
- **GHSA-8jxr-pr72-r468** — fixed in mcp-core 1.0.0
- **GHSA-hv2w-8mjj-jw22** — fixed in mcp-core 1.1.1
## Why not fixed in PR #14187
The 0.x → 1.x migration involves breaking API changes that require Java compile + runtime verification:
- `McpServer.sync()` / `McpSyncServer` — signature changes in 1.0.0 RC cleanup
- `StdioServerTransportProvider` constructor — changed
- Module layout: `mcp-json-jackson2` replaces older Jackson modules; upgrade path is 0.16.0 → 0.18.1 (resolve deprecations) → 1.1.1
Per the [official MIGRATION-1.0.md](https://github.com/modelcontextprotocol/java-sdk/blob/main/MIGRATION-1.0.md), the recommended path is to first upgrade to 0.18.1 and resolve all deprecation warnings before jumping to 1.x.
## Files to update
- `demos/mcp/config-api/mcp-config-api-server/pom.xml` — bump version, update module declarations
- `demos/mcp/config-api/mcp-config-api-server/src/main/java/io/jans/demo/configapi/mcp/server/McpServerMain.java` — update call sites
## Security note
This demo should only be run in a trusted, non-production environment until upgraded.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.