fix(deps): patch sharp librsvg CVE and MCP SDK OAuth issuer binding

- sharp 0.35.4 -> 0.35.5 (librsvg 2.63.2, CVE-2026-96889)
- @modelcontextprotocol/sdk 1.29.0 -> 1.31.0 (GHSA-6qxp-vccf-f47h)
- bind preregistered MCP OAuth client secrets to an issuer
- skip token revocation when the advertised AS differs from the token issuer

Author: waleedlatif1

apps/sim/lib/credential-groups/managed-mcp-connectors.ts

@@ -31,6 +31,8 @@ interface DatabricksManagedMcpConnector extends ManagedMcpConnectorMetadata {
 interface FixedPreregisteredManagedMcpConnector extends ManagedMcpConnectorMetadata {
   id: 'hubspot' | 'zoom'
   url: string
+  /** The only authorization server the deployment client secret is ever presented to. */
+  authorizationServer: string
   oauthClientRegistration: 'preregistered'
 }
 
@@ -45,6 +47,7 @@ export const MANAGED_MCP_CONNECTORS = {
     name: 'Zoom',
     description: 'Search past meetings, transcripts and notes using your Zoom account',
     url: 'https://mcp.zoom.us/mcp/meeting/streamable',
+    authorizationServer: 'https://zoom.us',
     oauthClientRegistration: 'preregistered',
   },
   lucid: {
@@ -60,6 +63,7 @@ export const MANAGED_MCP_CONNECTORS = {
     name: 'HubSpot',
     description: 'Search CRM records using each person’s HubSpot permissions',
     url: 'https://mcp.hubspot.com',
+    authorizationServer: 'https://mcp.hubspot.com',
     oauthClientRegistration: 'preregistered',
   },
   coda: {

apps/sim/lib/mcp/oauth/managed-provider.ts

@@ -78,6 +78,7 @@ export class ManagedMcpOauthProvider implements OAuthClientProvider {
       token_endpoint_auth_method:
         this.preregistered.tokenEndpointAuthMethod ??
         (this.preregistered.clientSecret ? 'client_secret_post' : 'none'),
+      issuer: this.preregistered.issuer ?? this.currentTokens?.issuer,
     }
   }
 

apps/sim/lib/mcp/oauth/provider.ts

@@ -43,6 +43,11 @@ export interface PreregisteredClient {
   configurationFingerprint?: string
   scope?: string
   tokenEndpointAuthMethod?: 'client_secret_basic' | 'client_secret_post'
+  /**
+   * Authorization server the credentials are registered with. When unset, they are bound to
+   * the issuer of the current grant, so the SDK never presents the secret to another server.
+   */
+  issuer?: string
 }
 
 interface SimMcpOauthProviderInit {
@@ -107,6 +112,7 @@ export class SimMcpOauthProvider implements OAuthClientProvider {
         token_endpoint_auth_method:
           this.preregistered.tokenEndpointAuthMethod ??
           (this.preregistered.clientSecret ? 'client_secret_post' : 'none'),
+        issuer: this.preregistered.issuer ?? this.row.tokens?.issuer,
       }
     }
     return undefined
@@ -226,6 +232,8 @@ export async function loadPreregisteredClient(
     if (!row.clientId || !row.clientSecret)
       throw new Error('HubSpot OAuth registration is incomplete')
   }
+  const issuer =
+    row.connectorId === 'hubspot' ? MANAGED_MCP_CONNECTORS.hubspot.authorizationServer : undefined
   if (!row.clientId) return undefined
   let clientSecret: string | undefined
   if (row.clientSecret) {
@@ -240,5 +248,5 @@ export async function loadPreregisteredClient(
       throw new Error('Failed to decrypt preregistered MCP OAuth client secret')
     }
   }
-  return { clientId: row.clientId, clientSecret }
+  return { clientId: row.clientId, clientSecret, issuer }
 }

apps/sim/lib/mcp/oauth/revoke.ts

@@ -41,7 +41,14 @@ export async function revokeMcpOauthTokens(
     const info = await discoverOAuthServerInfo(server.url, { fetchFn: ssrfGuardedFetch }).catch(
       () => undefined
     )
-    const metadata = info?.authorizationServerMetadata as
+    if (
+      !info ||
+      (row.tokens.issuer &&
+        !isSameAuthorizationServer(row.tokens.issuer, info.authorizationServerUrl))
+    ) {
+      return
+    }
+    const metadata = info.authorizationServerMetadata as
       | (Record<string, unknown> & { revocation_endpoint?: string })
       | undefined
     const revocationEndpoint = metadata?.revocation_endpoint
@@ -79,6 +86,21 @@ export async function revokeMcpOauthTokens(
   }
 }
 
+/**
+ * Mirrors the SDK's issuer binding: tokens stamped for one authorization server are never
+ * posted, with the client secret, to a different one the MCP server now advertises.
+ */
+function isSameAuthorizationServer(issuer: string, authorizationServerUrl: string): boolean {
+  const normalize = (value: string) => {
+    try {
+      return new URL(value).href.replace(/\/$/, '')
+    } catch {
+      return value.replace(/\/$/, '')
+    }
+  }
+  return normalize(issuer) === normalize(authorizationServerUrl)
+}
+
 async function postRevoke(
   endpoint: string,
   token: string,

apps/sim/lib/mcp/oauth/shared-clients.ts

@@ -15,6 +15,7 @@ export function getSharedHubSpotMcpClient() {
   return {
     clientId,
     clientSecret,
+    issuer: MANAGED_MCP_CONNECTORS.hubspot.authorizationServer,
     configurationFingerprint: sha256Hex(
       JSON.stringify([
         'shared-hubspot-mcp',
@@ -40,6 +41,7 @@ export function getSharedZoomMcpClient() {
     clientSecret,
     scope,
     tokenEndpointAuthMethod,
+    issuer: MANAGED_MCP_CONNECTORS.zoom.authorizationServer,
     configurationFingerprint: sha256Hex(
       JSON.stringify([
         'shared-zoom-mcp',

apps/sim/package.json

@@ -88,7 +88,7 @@
     "@hookform/resolvers": "5.2.2",
     "@linear/sdk": "91.0.0",
     "@marsidev/react-turnstile": "1.4.2",
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/sdk": "1.31.0",
     "@monaco-editor/react": "4.7.0",
     "@napi-rs/canvas": "0.1.100",
     "@opentelemetry/api": "^1.9.0",
@@ -247,7 +247,7 @@
     "remark-stringify": "11.0.0",
     "resend": "^4.1.2",
     "rss-parser": "3.13.0",
-    "sharp": "0.35.4",
+    "sharp": "0.35.5",
     "sim": "workspace:*",
     "socket.io-client": "4.8.1",
     "ssh2": "^1.17.0",