Evidence · DiggingBeagle record
Priors MCP stale lock clock-skew duplicate payment advisory
- Source role
- vendor statement
Evidence record
Claim-level citations (2)
- supportsPriors clock skew could discard a live payment-state lock: Priors identifies a race in @priors/mcp 0.2.3 through 0.18.1 where Date.now and mtimeMs could mistake a live lock for a stale lock; version 0.18.2 changes lock ownership and timing.
GHSA-wqww-vjpx-w8mq, Affected versions, Patched versions and Status
- supportsPriors clock skew could discard a live payment-state lock: The Priors advisory reports that the 0.18.2 lock repair tracks ownership and monotonic elapsed time, but its documented fallback can still proceed after two seconds without the lock.
Status and Summary, fixed 0.18.2 mechanism and two-second fallback