chore(deps): bump the mcp-minor-patch group across 1 directory with 6 updates by dependabot[bot] · Pull Request #1074 · silverstein/minutes

dependabot · 2026-09-30T23:44:59Z

Bumps the mcp-minor-patch group with 6 updates in the /crates/mcp directory:

Package	From	To
@modelcontextprotocol/ext-apps	`2.0.0`	`2.0.3`
@modelcontextprotocol/sdk	`1.31.0`	`1.32.0`
@types/node	`26.6.1`	`26.6.4`
tsx	`4.23.13`	`4.23.15`
vitest	`5.0.1`	`5.0.3`
@rollup/rollup-linux-x64-gnu	`4.63.3`	`4.64.0`

Updates @modelcontextprotocol/ext-apps from 2.0.0 to 2.0.3

Release notes

Sourced from @modelcontextprotocol/ext-apps's releases.

v2.0.3

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example packages, so that a fresh install of each published package resolves a dependency tree that passes vulnerability and supply-chain scans.

Security

@modelcontextprotocol/server-basic-solid now depends on solid-js 1.9.15 instead of the exact 1.9.10, which pulled in seroval 1.3 (open advisories, fixed in 1.5.3). The root overrides that pinned seroval are removed, and the lockfile is refreshed with npm audit fix (patch and minor updates only, npm audit reports 0 vulnerabilities). by @ochafik in #793

@modelcontextprotocol/server-pdf now depends on the exact @cantoo/pdf-lib 2.6.5 instead of ^2.6.5. The range resolved to 2.11.x, which the repository never tests and which added dependencies with open-ended ranges (culori, node-html-better-parser) that supply-chain scanners flag. by @ochafik in #792

2.0.2 already pinned pdfjs-dist to 5.4.530 for server-pdf (#789).

Full Changelog: modelcontextprotocol/ext-apps@v2.0.2...v2.0.3

v2.0.2

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fix is in the @modelcontextprotocol/server-pdf example package.

Security

@modelcontextprotocol/server-pdf now depends on the exact pdfjs-dist 5.4.530 instead of ^5.0.0. The range let a fresh install resolve pdfjs-dist 5.6.83 or later (currently 5.7.284), which is affected by GHSA-hq66-cqwq-w95j (arbitrary JavaScript execution when opening a crafted PDF). 5.4.530 is outside the affected range and is the version the repository already tests against. Node support is unchanged. by @ochafik in #789

Full Changelog: modelcontextprotocol/ext-apps@v2.0.1...v2.0.2

v2.0.1

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example servers, which are published as their own packages (including @modelcontextprotocol/server-pdf).

Bug fixes

Example servers no longer crash at startup on Node older than 20.11. They computed their dist directory from import.meta.filename / import.meta.dirname, which only exist from Node 20.11, so on Node 18 and 20.0 to 20.10 the module threw TypeError: Cannot read properties of undefined (reading 'endsWith') at load, before the server could answer initialize. All 21 affected servers and the quickstart now derive the path from import.meta.url with fileURLToPath. No behaviour change on Node 20.11+. Affected the published @modelcontextprotocol/server-pdf 1.7.5 and 2.0.0. by @ochafik in #787

engines.node: ">=20" is now declared on the 21 published example packages, matching the root package and the README.

CI

The build now also runs the pdf-server MCPB bundle on Node 20.0.0, so this regression fails the build. #787

The dependency isolation check adds the ES2022.Error lib to its consumer projects. @modelcontextprotocol/client 2.1.0's typings reference ErrorOptions, so a project compiling with skipLibCheck: false and a lib older than ES2022 needs the same. #788

Packaging

repository.url uses the canonical git+https://github.com/modelcontextprotocol/ext-apps.git form in all manifests, which removes the "repository.url" was normalized warning from every publish job. by @ochafik in #773

Full Changelog: modelcontextprotocol/ext-apps@v2.0.0...v2.0.1

Commits

82221c0 Bump version to 2.0.3 (#794)
f20a1ff Update dependencies to clear npm audit findings (#793)
c9e00bd Pin @cantoo/pdf-lib to 2.6.5 in pdf-server (#792)
fe9a9f1 Bump version to 2.0.2
7bc2c5c Pin pdfjs-dist to 5.4.530 in pdf-server
a523ab3 Fix dependency isolation check against @modelcontextprotocol/client 2.1
b0ddf50 Bump version to 2.0.1
8e1b3bd Fix example servers crashing at startup on Node older than 20.11
6d9bdc7 Merge pull request #773 from modelcontextprotocol/repo-url-fix
2be172d Use the canonical git+https form for repository.url
See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.31.0 to 1.32.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.32.0

Upgrade notes

Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.

New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

[v1.x] fix(client): follow redirects only within the endpoint's origin by @claude[bot] in modelcontextprotocol/typescript-sdk#2902

docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @claude[bot] in modelcontextprotocol/typescript-sdk#2910

[v1.x] examples: close idle sessions and cap the session map by @maxisbey in modelcontextprotocol/typescript-sdk#2914

[v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @claude[bot] in modelcontextprotocol/typescript-sdk#2925

[v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @claude[bot] in modelcontextprotocol/typescript-sdk#2927

[v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @raashish1601 in modelcontextprotocol/typescript-sdk#2045

[v1.x] feat(auth): add expectedResource to requireBearerAuth by @claude[bot] in modelcontextprotocol/typescript-sdk#2930

[v1.x] test(e2e): cover tools/call and prompts/get without arguments by @claude[bot] in modelcontextprotocol/typescript-sdk#2931

chore: bump version to 1.32.0 by @claude[bot] in modelcontextprotocol/typescript-sdk#2935

New Contributors

@raashish1601 made their first contribution in modelcontextprotocol/typescript-sdk#2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

Commits

32549b0 chore: bump version to 1.32.0 (#2935)
588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
c2ce003 docs: point SECURITY.md at GitHub Security Advisories (v1.x) (#2910)
30bfe51 [v1.x] fix(client): follow redirects only within the endpoint's origin (#2902)
See full diff in compare view

Updates @types/node from 26.6.1 to 26.6.4

Commits

See full diff in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

exclude bare builtins from namespace inheritance (38e1588)

expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)

make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

npm package (@latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

npm package (@latest dist-tag)

Commits

ca66105 test: fix drive-less file URLs in ESM resolver fixtures
2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
38e1588 fix: exclude bare builtins from namespace inheritance
562c434 fix: make namespaced register() overloads portable for declaration emit
edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
70e7828 test: upgrade tinyspy for disposable API
9ed2022 ci: avoid duplicate release notifications
872e77f refactor: use disposables for cleanup
6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
See full diff in compare view

Updates vitest from 5.0.1 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

Isolate result.status between repeats runs - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)

Don't print an interceptor warning in browser mode - by @sheremet-va in vitest-dev/vitest#11377 (15cc0)

Don't retry when test.fails expectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)

Scope cache key generators to projects - by @ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)

browser:

Delay server listen until tests start running - by @sheremet-va in vitest-dev/vitest#11366 (7d8ed)

Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)

Keep config of browser-consumed environments - by @kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)

Ignore page crash while cancelling - by @sheremet-va in vitest-dev/vitest#11386 (7c367)

toMatchScreenshot uses wrong reference on retried tests - by @macarie in vitest-dev/vitest#11393 (c22ab)

cache:

Revalidate imports of cached modules - by @sheremet-va in vitest-dev/vitest#11381 (38f98)

deps:

Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE - by @AriPerkkio in vitest-dev/vitest#11403 (f6c9a)

expect:

Pass current equality testers to expect.extend asymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)

jsdom:

Support Blob on jsdom 30.1 - by @sheremet-va in vitest-dev/vitest#11379 (6c49b)

pool:

Preserve unique pool ids when groupOrder is set - by @mtorp in vitest-dev/vitest#11392 (50312)

ui:

Split-pane handle overlapping iframe - by @macarie in vitest-dev/vitest#11221 (f91db)

vitest:

Remove root temp dir on close - by @abhinav-phi in vitest-dev/vitest#11248 (7c711)

vm:

Do not optimize deps from index.html - by @ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)

Don't reuse scripts across vite environments - by @MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

Bind process in case global is overwritten - by @AriPerkkio in vitest-dev/vitest#11343 (0b792)

detect-async-leaks:

Ignore process.stdio handles - by @AriPerkkio in vitest-dev/vitest#11333 (0fd6b)

expect:

Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)

jsdom:

Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in vitest-dev/vitest#11295 (d1c3e)

reporter:

agent to respect --silent - by @Raj4478 and @AriPerkkio in vitest-dev/vitest#11271 (5b95e)

reporters:

Handle concurrent createReport calls - by @7rulnik in vitest-dev/vitest#11278 (e8e55)

hanging-process to use ESM entrypoint - by @AriPerkkio in vitest-dev/vitest#11316 (4e91e)

spy:

Fix stack overflow when spying Set.prototype.add - by @fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

33cadea chore: release v5.0.3 (#11409)
346d389 fix(vm): don't reuse scripts across vite environments (#11395)
f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
062c75d chore: fix standalone docs build, update exports maps (#11394)
caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
7c36748 fix(browser): ignore page crash while cancelling (#11386)
92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
38f9885 fix(cache): revalidate imports of cached modules (#11381)
b24585f fix: don't retry when test.fails expectedly failed (#11219)
Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.63.3 to 4.64.0

Release notes

Sourced from @rollup/rollup-linux-x64-gnu's releases.

v4.64.0

4.64.0

2026-10-02

Features

Improve try-catch deoptimization to cover calling methods on objects (#6541)

Bug Fixes

Fix a situation where some feature-detections of core-js were not triggering properly (#6541)

Pull Requests

#6541: Retain callbacks of helper methods called from try statements (@lukastaegert)

#6542: Run additional tests as part of the coverage job (@lukastaegert)

#6544: Update msys2/setup-msys2 digest to ec48f7c (@renovate[bot], @lukastaegert)

#6545: Update minor/patch updates (@renovate[bot])

#6546: Update dependency @mermaid-js/mermaid-cli to v12 (@renovate[bot])

#6547: Update Rust crate swc_compiler_base to v65 (@renovate[bot])

v4.63.6

4.63.6

2026-10-01

Bug Fixes

Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

#6527: Update minor/patch updates (@renovate[bot])

#6529: Update dependency eslint-plugin-unicorn to v76 (@renovate[bot])

#6530: Lock file maintenance (@renovate[bot])

#6535: Lock file maintenance (@renovate[bot], @lukastaegert)

#6540: Import external re-exports used by shared-chunk namespace objects (@00200200)

v4.63.5

4.63.5

2026-09-24

Bug Fixes

Fix an issue where watch mode would hang instead of terminating when closing via Ctrl+C (#6521)

Avoid starting overlapping watch mode runs when plugins invalidate files at the wrong time (#6526)

Fix many edge cases where watch mode events were not properly emitted to listeners, especially when errors occur (#6526)

... (truncated)

Changelog

Sourced from @rollup/rollup-linux-x64-gnu's changelog.

4.64.0

2026-10-02

Features

Improve try-catch deoptimization to cover calling methods on objects (#6541)

Bug Fixes

Fix a situation where some feature-detections of core-js were not triggering properly (#6541)

Pull Requests

#6541: Retain callbacks of helper methods called from try statements (@lukastaegert)

#6542: Run additional tests as part of the coverage job (@lukastaegert)

#6544: Update msys2/setup-msys2 digest to ec48f7c (@renovate[bot], @lukastaegert)

#6545: Update minor/patch updates (@renovate[bot])

#6546: Update dependency @mermaid-js/mermaid-cli to v12 (@renovate[bot])

#6547: Update Rust crate swc_compiler_base to v65 (@renovate[bot])

4.63.6

2026-10-01

Bug Fixes

Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

#6527: Update minor/patch updates (@renovate[bot])

#6529: Update dependency eslint-plugin-unicorn to v76 (@renovate[bot])

#6530: Lock file maintenance (@renovate[bot])

#6535: Lock file maintenance (@renovate[bot], @lukastaegert)

#6540: Import external re-exports used by shared-chunk namespace objects (@00200200)

4.63.5

2026-09-24

Bug Fixes

Fix an issue where watch mode would hang instead of terminating when closing via Ctrl+C (#6521)

Avoid starting overlapping watch mode runs when plugins invalidate files at the wrong time (#6526)

Fix many edge cases where watch mode events were not properly emitted to listeners, especially when errors occur (#6526)

Pull Requests

#6520: Lock file maintenance (@renovate[bot], @lukastaegert)

... (truncated)

Commits

77773bf 4.64.0
7fc443c Retain callbacks of helper methods called from try statements (#6541)
a77225f Update msys2/setup-msys2 digest to ec48f7c (#6544)
ec48a7d Update dependency @mermaid-js/mermaid-cli to v12 (#6546)
06afd97 Update Rust crate swc_compiler_base to v65 (#6547)
06f6426 Update minor/patch updates (#6545)
f2e3c9d Run additional tests as part of the coverage job (#6542)
966ac85 4.63.6
cf36f1c Import external re-exports used by shared-chunk namespace objects (#6540)
5376264 Lock file maintenance (#6535)
Additional commits viewable in compare view

… updates Bumps the mcp-minor-patch group with 6 updates in the /crates/mcp directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) | `2.0.0` | `2.0.3` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.31.0` | `1.32.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.1` | `26.6.4` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.3` | | [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.63.3` | `4.64.0` | Updates `@modelcontextprotocol/ext-apps` from 2.0.0 to 2.0.3 - [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases) - [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md) - [Commits](modelcontextprotocol/ext-apps@v2.0.0...v2.0.3) Updates `@modelcontextprotocol/sdk` from 1.31.0 to 1.32.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.31.0...1.32.0) Updates `@types/node` from 26.6.1 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `vitest` from 5.0.1 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `@rollup/rollup-linux-x64-gnu` from 4.63.3 to 4.64.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.63.3...v4.64.0) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/ext-apps" dependency-version: 2.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: "@rollup/rollup-linux-x64-gnu" dependency-version: 4.63.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: "@types/node" dependency-version: 26.6.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: vitest dependency-version: 5.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 30, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-26daa67cc4 branch 8 times, most recently from 213dd70 to 8563f69 Compare October 7, 2026 14:40

dependabot Bot force-pushed the dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-26daa67cc4 branch from 8563f69 to 9ebb620 Compare October 8, 2026 04:16

dependabot Bot force-pushed the dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-26daa67cc4 branch from 9ebb620 to 62e349a Compare October 8, 2026 05:08

Navigation Menu

Repository navigation

chore(deps): bump the mcp-minor-patch group across 1 directory with 6 updates - #1074

chore(deps): bump the mcp-minor-patch group across 1 directory with 6 updates#1074
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-26daa67cc4

dependabot Bot commented on behalf of github Sep 30, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.0.3

What's Changed

Security

v2.0.2

What's Changed

Security

v2.0.1

What's Changed

Bug fixes

CI

Packaging

1.32.0

Upgrade notes

What's Changed

New Contributors

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

v5.0.3

🐞 Bug Fixes

View changes on GitHub

v5.0.2

🐞 Bug Fixes

v4.64.0

4.64.0

Features

Bug Fixes

Pull Requests

v4.63.6

4.63.6

Bug Fixes

Pull Requests

v4.63.5

4.63.5

Bug Fixes

4.64.0

Features

Bug Fixes

Pull Requests

4.63.6

Bug Fixes

Pull Requests

4.63.5

Bug Fixes

Pull Requests

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 30, 2026 •

edited

Loading