[shihchengwei-lab]

Summary

• Upgrade Fusion’s MCP SDK from 2.0.0 to 2.3.1 and Zod from 4.4.3 to 4.6.7 to clear the Fusion dependency-audit findings; regenerate its packaged artifacts and notices.
• Linux Fusion and marketplace checks pass, and Fusion’s runtime and full dependency audits report zero findings. The full Windows master remains incomplete because of a baseline-reproduced cold-package timeout.
• Hosted macOS verification of this update is pending; live Fusion/cloud/vault qualification was not run. ReviewOps’ separate audit finding is tracked in #38; required hosted checks and maintainer approval remain outstanding.

Appendix: impact, verification and merge requirements

Plugin impact

Fusion’s MCP client, server and shared core move to 2.3.1, with a single shared core. Zod moves from 4.4.3 to 4.6.7, shared by the plugin and SDK. These are the only four dependency version changes.

The SDK update addresses the Fusion finding in #37. The Zod update addresses GHSA-mrhx-c7xc-m3w5, which stopped the first hosted run at its audit step.

The existing builder regenerates bundles, the build receipt, software inventory and third-party notices. Current-version documentation now points to the pinned manifest.

The inventory records the SDK as Apache-2.0, retaining upstream’s licensing-transition text and MIT notices.

Application TypeScript/Python source, public TypeScript declarations, file-access permissions, network destinations, authentication and secret handling are unchanged. The regenerated operation catalog now states fixed tuple lengths and forbids extra items, matching the existing runtime validators.

Verification

Check	Environment	Result
Fusion master	WSL/Linux; Node 22.19.0, 24.14.0 and 26.12.1	Passed, including packaged stdio, legacy/modern JSON/SSE and write-replay rejection
Package rebuild	Each Linux Node version above	Rebuilt bytes matched the included distribution
Complete marketplace master and repository validation	WSL/Linux; Node 22.19.0	Passed
Fusion runtime and full dependency audits	WSL/Linux	Zero findings
Marketplace runner contracts	Windows; prior run, unchanged runner	Passed
Credential-binding source build and module load	Windows; Node 24.14.0, Rust 1.98.0; prior run, unchanged native source/assets	Passed; no vault access
MCP client transport contracts	Windows; Node 24.14.0	Passed with Zod 4.6.7
Full Windows master	Windows; Node 24.14.0	Incomplete; cold artifact workflow timed out

Reproduce the passing WSL/Linux checks with Node 22.19+ and Python 3.12+:

npm run validate:marketplace
npm run test:autodesk-fusion:package
npm --prefix plugins/autodesk-fusion ci --ignore-scripts
npm --prefix plugins/reviewops-auditor-benchmark ci --ignore-scripts
npm run test:autodesk-fusion
npm run test:marketplace
npm run validate
npm audit --prefix plugins/autodesk-fusion --omit=dev

Author checklist:

• npm run validate:marketplace
• Changed plugin master on the Linux versions above; full Windows master remains incomplete
• Required security checks
• Cold-start setup instructions reviewed
• Licenses and third-party notices reviewed
• No credentials, customer data, private URLs or personal paths added

Reviewer notes

With Zod 4.6.7, the Windows cold-package artifact workflow still hits the 20-second tools/call deadline. This scenario also failed on the unmodified 62844ca baseline. The full Windows master remains incomplete after this cold-package gate.

Hosted macOS verification of this update is pending. The earlier run passed its initial Fusion master and rebuild check before stopping at the Zod audit finding. Live Fusion, real cloud and OS-vault qualification were not run.

ReviewOps’ separate fast-uri audit finding is tracked in #38.

Maintainer merge requirements

• Applicable CLA verified
• CDE code owner approved the latest changes
• Required test and security checks pass for the changes being merged
• Execution, file access, off-machine data flows, dependencies and secrets reviewed