Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@modelcontextprotocol/inspector	2.2.0 → 2.8.0			devDependencies	minor
@modelcontextprotocol/sdk (source)	1.30.0 → 1.30.1			dependencies	patch
@types/node (source)	26.2.0 → 26.6.2			devDependencies	minor	26.6.3
@vitest/coverage-v8 (source)	4.1.10 → 4.1.11			devDependencies	patch
codecov/codecov-action	v7.0.0 → v7.1.1			action	minor
github/codeql-action	v4.37.7 → v4.38.2			action	minor
node (source)	26.7.0 → 26.10.0			volta	minor
oxfmt (source)	0.63.0 → 0.70.0			devDependencies	minor
oxlint (source)	1.78.0 → 1.85.0			devDependencies	minor
pnpm (source)	11.21.0 → 11.27.1			packageManager	minor	11.28.0
pnpm (source)	11.21.0 → 11.27.1			volta	minor	11.28.0
pnpm/action-setup	v6.0.10 → v6.1.0			action	minor
publint (source)	0.3.23 → 0.3.24			devDependencies	patch
tsdown (source)	0.22.14 → 0.23.0			devDependencies	minor
vitest (source)	4.1.10 → 4.1.11			devDependencies	patch
zod (source)	4.4.3 → 4.6.5			dependencies	minor

---

Release Notes

modelcontextprotocol/inspector (@​modelcontextprotocol/inspector)

v2.8.0

Compare Source

What's Changed

• fix(web): only DANGEROUSLY_OMIT_AUTH=true/1 disables /api auth by @​cliffhall in #​2390
• fix: stamp Mcp-Method on modern-era notification POSTs by @​cliffhall in #​2392
• fix: detach the OIDC compat's normal-path body releases by @​cliffhall in #​2393
• fix: resolve local $refs before choosing form widgets (#​2321) by @​cliffhall in #​2391
• feat: per-server setting to suppress the standalone GET notification stream by @​cliffhall in #​2394
• fix(core): reframe the type-union lint as a portability trade by @​cliffhall in #​2395
• docs: document read-only mcp.json interoperability for external tooling by @​cliffhall in #​2396
• Run skills:eval through the GitHub Copilot CLI by @​cliffhall in #​2398
• Make the testing → test-servers hand-off fire under Copilot on the pagination prompt by @​cliffhall in #​2402
• docs: re-align the H2 2026 roadmap with the published MCP roadmap and official extensions by @​cliffhall in #​2401
• chore: add the project LICENSE and point every manifest at it by @​cliffhall in #​2449
• docs: add the security-advisory skill, and reconcile the two rules it contradicts by @​cliffhall in #​2444
• feat: MCP_INSPECTOR_SECRET_KEY_FILE, and document secret storage for every runtime by @​cliffhall in #​2448
• docs(skills): stop board lookups from trusting item-list --limit by @​cliffhall in #​2452
• chore: bump version to 2.8.0 (release step 1) by @​cliffhall in #​2454
• chore(release): merge v2/main into main for v2.8.0 by @​cliffhall in #​2456

Full Changelog: modelcontextprotocol/inspector@2.7.0...2.8.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.8.0

v2.7.0

Compare Source

What's Changed

• chore: bump the vitest trio to 4.1.11 past GHSA-82fw-gwwq-j7x9 by @​cliffhall in #​2315
• feat(test-servers): a CIMD showcase fixture that serves its own client metadata document by @​cliffhall in #​2307
• chore: land the #​2247 round-9 review findings on v2/main by @​cliffhall in #​2322
• feat: bound every OAuth-path request with a deadline by @​cliffhall in #​2324
• fix: bold the labels, not the values, and give Connection Info's URLs full width by @​cliffhall in #​2329
• fix: exempt loopback hosts from the CIMD metadata URL HTTPS requirement by @​cliffhall in #​2326
• fix: state every test-gate timeout instead of inheriting a library default by @​cliffhall in #​2334
• fix: force the Storybook dep pre-bundle on every run (#​2340) by @​cliffhall in #​2342
• chore: run each client's test suite once in local:gate, not twice by @​cliffhall in #​2343
• feat: queue concurrent local:gate runs on a machine-wide lease (#​2339) by @​cliffhall in #​2344
• docs: record why maxWorkers stays unset, with the measurement (#​2336) by @​cliffhall in #​2345
• chore: state the smoke-helper and CI wall-clock budgets (#​2333) by @​cliffhall in #​2349
• chore: remove gate-lease.test.mjs temp directories after the suite by @​cliffhall in #​2351
• docs: stop justifying the asyncUtilTimeout pin by pointing at #​2335 by @​cliffhall in #​2352
• fix: sample the SkillsScreen geometry only once the Frontmatter highlighter has landed by @​cliffhall in #​2353
• docs: correct two stale gate comments after #​2354 (gate-lease MAX_WAIT_MS, main.yml table pointer) by @​cliffhall in #​2357
• docs: bring quality-gate.md up to date after #​2338 and document the gate lease by @​cliffhall in #​2355
• chore(deps): bump ext-apps to 2.0.0 and drop the SDK-v1 shims by @​cliffhall in #​2358
• chore: refresh the stale ext-apps example in the sdk-watch comments by @​cliffhall in #​2361
• feat: bound connect attempts with a 30 s default connectionTimeout by @​cliffhall in #​2362
• fix: reset relay request-response waits on progress notifications (#​2028) by @​cliffhall in #​2363
• docs: add an environment-variable reference by @​cliffhall in #​2366
• feat(core): report outstanding-request and notification-stream state on a request timeout (#​2318) by @​cliffhall in #​2364
• fix: accept a path-less skill root URI in normalizeSkillUri by @​cliffhall in #​2368
• feat: add --protocol-era launch flag for ad-hoc servers by @​cliffhall in #​2372
• feat: make the skills verification catalog budget configurable per server (#​2294) by @​cliffhall in #​2367
• fix: record an intercepted 401's status, headers and body in the network log by @​cliffhall in #​2371
• feat(web): configurable public addresses for the MCP Apps listeners by @​cliffhall in #​2370
• fix: report a gate-lease wait only when the run actually queued by @​cliffhall in #​2375
• Declare the skills extension in the Inspector's client capabilities by @​cliffhall in #​2374
• chore(release): bump to 2.7.0, audit clean, and fix sdk-watch suppression by @​cliffhall in #​2379
• feat(test-servers): stall an OAuth endpoint so #​2319's timeouts can be driven by @​cliffhall in #​2383
• fix(test): AppRenderer theme flip — happy-dom drops GC'd MutationObserver callbacks by @​cliffhall in #​2386
• docs: pack:verify is not a local:gate stage — name it as its own release step by @​cliffhall in #​2387
• chore(release): merge v2/main into main for v2.7.0 by @​cliffhall in #​2381

Full Changelog: modelcontextprotocol/inspector@2.6.0...2.7.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.7.0

v2.6.0

Compare Source

What's Changed

• fix(web): reset pending OAuth slots during render, not in an effect by @​cliffhall in #​2237
• fix: terminate the OAuth connection-details refresh promise chain by @​cliffhall in #​2236
• fix: key the OAuth clear's active-session check on the storage key by @​cliffhall in #​2238
• chore(deps): npm audit fix before release bump; monthly npm-outdated issue by @​cliffhall in #​2232
• chore(deps): remove dependabot.yml, fold action bumps into the monthly sweep by @​cliffhall in #​2239
• chore(deps): sweep Dependabot alerts into board-tracked issues by @​cliffhall in #​2243
• test(auth): make the revocation fixture a real form-urldecoder by @​cliffhall in #​2246
• chore(deps): refresh fast-uri, qs and browserslist to clear npm audit by @​cliffhall in #​2249
• feat(skills): measure a skill reached from another skill by @​cliffhall in #​2245
• fix(web): remove the wall-clock race in the import-JSON debounce guard test by @​cliffhall in #​2255
• fix(auth): floor the shared revocation budget instead of racing zero by @​cliffhall in #​2256
• feat: support the Skills extension (SEP-2640) with digest verification by @​cliffhall in #​2251
• chore: grant artifact-metadata:write to the GHCR publish job by @​cliffhall in #​2258
• fix: type-discriminate progress toast ids, and a CSPRNG fallback for newAttemptId by @​cliffhall in #​2259
• chore: widen verify:dep-lockstep to declared cross-install copies by @​cliffhall in #​2260
• Reshape the testing → test-servers pointer into an imperative step by @​cliffhall in #​2261
• fix: cap the re-auth banner width and move its flat CSS into the Paper theme by @​cliffhall in #​2266
• feat: refactor the Skills detail pane into collapsible sections with an internally-scrolling file viewer by @​cliffhall in #​2265
• feat: watch the MCP SDK nightly and file an upgrade issue by @​cliffhall in #​2268
• fix: swap the toast ref Set on teardown instead of clearing it by @​cliffhall in #​2267
• docs: specify screenshot capture width and Monitor sidebar width in /pr-flow by @​cliffhall in #​2271
• docs: rule that a wait is a notification, never a tight poll loop by @​cliffhall in #​2272
• docs: reply to each review comment in its own thread, not in a rollup comment by @​cliffhall in #​2273
• docs: add a reusable CLI smoke-testing guide for v2 by @​cliffhall in #​2275
• fix: send an empty-string pagination cursor verbatim on every list adapter by @​cliffhall in #​2277
• fix: decline a union branch requiring a name it never declares by @​cliffhall in #​2276
• fix: strip ANSI from TUI test frames so FORCE_COLOR cannot break assertions by @​cliffhall in #​2279
• fix: key resource list rows by position so duplicate URIs cannot collide by @​cliffhall in #​2281
• feat: seed the MCP org example server as a remote first-run card by @​cliffhall in #​2283
• feat(web): collapse the schema-portability section by default by @​cliffhall in #​2285
• fix: preserve CIMD registration provenance across SDK issuer binding by @​cliffhall in #​2287
• docs: ALLOWED_ORIGINS recipe for a *.localhost proxy by @​cliffhall in #​2290
• fix: report a terminal OAuth token-endpoint refusal instead of a dead retry by @​cliffhall in #​2288
• fix: two load-dependent Storybook flakes — SkillsScreen geometry and the Ace-worker wait by @​cliffhall in #​2291
• feat: Skills extension phase 3 — CLI methods, TUI pane, resources/directory/read, and the frontmatter cross-check by @​cliffhall in #​2293
• docs(release): make the two-PR flow, the production smoke, the ledger and the UI tag explicit by @​cliffhall in #​2299
• chore(release): audit, hono advisory fix, and bump to 2.6.0 by @​cliffhall in #​2302
• chore: merge v2/main for the v2.6.0 milestone release by @​cliffhall in #​2304

Full Changelog: modelcontextprotocol/inspector@2.5.0...2.6.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.6.0
SEP-2640 support added: Verifying Skills over MCP

v2.5.0

Compare Source

What's Changed

• test(smoke): run the headless web smokes in Firefox via the pre-push gate by @​cliffhall in #​2133
• fix: render tool schemas with root-level anyOf/oneOf composition by @​cliffhall in #​2137
• chore(web): move App.tsx's module-level block into files by @​cliffhall in #​2149
• chore(web): extract App.tsx's leaf hooks by @​cliffhall in #​2150
• chore(web): collapse App.tsx's six session refs into useSessionRef by @​cliffhall in #​2152
• fix(scripts): make smoke:tui assert the TUI survives its first frame (#​2147) by @​cliffhall in #​2158
• ci: run the coverage gate in a parallel job instead of serially after validate by @​cliffhall in #​2160
• chore(web): extract App.tsx's OAuth recovery cluster into useOAuthRecovery by @​cliffhall in #​2162
• chore(web): connected-flow smoke for the Tools, Resources and Prompts tabs by @​cliffhall in #​2164
• chore(web): extract App.tsx's MCP Apps wiring into useMcpApps by @​cliffhall in #​2166
• chore(scripts): rename the local pre-push gate off ci, and guard it out of CI (#​2146) by @​cliffhall in #​2167
• chore(web): extract App.tsx's connection lifecycle into useConnectionLifecycle by @​cliffhall in #​2169
• feat(web): use the Ace JSON editor everywhere, and restore the raw-JSON toggle by @​cliffhall in #​2170
• chore(web): extract App.tsx's server commands into useServerCommands by @​cliffhall in #​2173
• fix: say why a never-acknowledged subscriptions/listen ended, instead of retrying it eight times by @​cliffhall in #​2176
• fix(web): surface failed resource subscribe/unsubscribe by @​cliffhall in #​2179
• fix(web): refuse a raw-JSON tool argument the schema would retype by @​cliffhall in #​2175
• fix(scripts): give the render-smoke overlap test room for process startup by @​cliffhall in #​2178
• test(scripts): anchor the render-smoke overlap paint to the parent's clock by @​cliffhall in #​2181
• chore(web): collapse InspectorView's prop wall into domain bundles by @​cliffhall in #​2182
• fix: cancel a Streamable HTTP call by closing its stream (#​2140) by @​cliffhall in #​2185
• feat(auth): revoke OAuth tokens at the authorization server on clear (RFC 7009) by @​cliffhall in #​2186
• fix(auth): accept RFC 8414 metadata served at the OIDC well-known path by @​cliffhall in #​2184
• fix(core): read state stores during render instead of re-syncing in an effect by @​cliffhall in #​2193
• chore(web): resolve the react-hooks findings App.tsx's decomposition unmasked (#​2161) by @​cliffhall in #​2191
• fix(web): terminate the five void-discarded OAuth recovery promises by @​cliffhall in #​2190
• chore: lint core/react with eslint-plugin-react-hooks by @​cliffhall in #​2194
• chore: extract AGENTS.md recipes into agent skills by @​cliffhall in #​2189
• chore: consolidate duplicated runtime dependencies into the root package.json by @​cliffhall in #​2200
• chore: consolidate shared toolchain devDependencies into the root package.json by @​cliffhall in #​2199
• docs: tune skill eval cases and document how to write them by @​cliffhall in #​2203
• chore: bump version to 2.5.0 by @​cliffhall in #​2213
• chore: merge v2/main for the v2.5.0 milestone release by @​cliffhall in #​2215

Full Changelog: modelcontextprotocol/inspector@2.4.0...2.5.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.5.0

v2.4.0

Compare Source

What's Changed

• ci: drop the redundant PR-head checkout from claude.yml by @​cliffhall in #​2070
• feat(apps): negotiated app-rendered form elicitations by @​cliffhall in #​2083
• feat(auth): file-backed and in-memory SecretStore for hosts with no keychain by @​cliffhall in #​2076
• chore(lint): fail lint on warnings (--max-warnings 0) by @​cliffhall in #​2090
• fix(web): roll a failed settings write back to what actually landed by @​cliffhall in #​2091
• chore: three small cleanups flagged in the v2.2.0 merge review by @​cliffhall in #​2092
• feat(auth): give the secrets file a real cross-process lock by @​cliffhall in #​2088
• feat: allow complex JSON values in request _meta by @​cliffhall in #​2094
• fix(web): surface a failed post-write server-list reload by @​cliffhall in #​2087
• fix(web): read MCP App UI resource metadata from _meta.ui by @​cliffhall in #​2098
• chore: remove the Claude Code GitHub Actions workflow by @​cliffhall in #​2103
• fix(proxy): route through undici's own fetch and keep undici external by @​cliffhall in #​2099
• fix(auth): don't answer token_expired from an unknowable local expiry by @​cliffhall in #​2105
• fix(web): state the expected shape when dropping a CSP source (#​2064) by @​cliffhall in #​2106
• fix(web): honor _meta.ui.domain with a dedicated app origin by @​cliffhall in #​2100
• chore(ci): render an MCP App from the installed tarball in pack:verify (#​2003) by @​cliffhall in #​2107
• fix(web): let tool string arguments be typed as multiline by @​cliffhall in #​2109
• fix(cli): apply a server's persisted mcp.json metadata by @​cliffhall in #​2112
• chore: pin esbuild past the GHSA-g7r4-m6w7-qqqr range in web/cli/tui by @​cliffhall in #​2116
• fix(auth): pass the challenge's resource_metadata URL to SDK auth() by @​cliffhall in #​2113
• fix(web): open the monitoring sidebar when a connect fails during OAuth by @​cliffhall in #​2115
• feat(oauth): make the refresh_token grant opt-out per server by @​cliffhall in #​2114
• chore(scripts): build test-servers unconditionally from one shared helper (#​2111) by @​cliffhall in #​2120
• feat: flag unportable tool schemas in all three clients by @​cliffhall in #​2121
• fix(oauth): persist the requested scope when the token response omits it by @​cliffhall in #​2118
• fix(web): carry a landed stdio env/cwd onto the config it connects with by @​cliffhall in #​2119
• fix: keep the pagination toggle on the last write across a server switch by @​cliffhall in #​2131
• fix(core): carry the in-progress SSE frame across chunk boundaries by @​cliffhall in #​2135
• fix(oauth): keep the server's path in the fallback authorization-server URL (#​2110) by @​cliffhall in #​2136
• fix(web): take the enlarge button out of the tab order by @​cliffhall in #​2139
• chore: bump version to 2.4.0 by @​cliffhall in #​2142
• chore: merge v2/main for the v2.4.0 milestone release by @​cliffhall in #​2145

Full Changelog: modelcontextprotocol/inspector@2.3.0...2.4.0

Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.4.0

v2.3.0

Compare Source

What's Changed

• fix: bind loopback by address and pin the sandbox port for containers by @​cliffhall in #​2009
• chore: sync v2/main to 2.2.0 + guidance to bump on v2/main before the milestone merge by @​cliffhall in #​2011
• fix: gate the connect-time logging/setLevel on the negotiated era (#​1990) by @​cliffhall in #​2017
• fix: add eol=lf policy to .gitattributes so Windows checkouts stay clean by @​olaservo in #​1994
• chore(deps): Bump the npm_and_yarn group across 4 directories with 6 updates by @​dependabot[bot] in #​2004
• fix: render nullable and union argument fields correctly in the web form and the TUI by @​cliffhall in #​2014
• build(deps): bump the github-actions group across 1 directory with 5 updates by @​dependabot[bot] in #​1976
• fix: gate submission on unsendable field text, and on required tool arguments by @​cliffhall in #​2024
• feat: per-server custom OAuth authorization-request parameters by @​cliffhall in #​2022
• feat: surface and decode the OAuth id_token in Connection Info by @​cliffhall in #​2023
• fix: salvage a list result's valid entries when one is malformed (#​1909) by @​cliffhall in #​2016
• test(web): pin the JSON editor's reported escaping reproductions (#​1853, #​1856, #​1885) by @​cliffhall in #​2025
• fix(web): stop a schema default from reverting the edit in progress by @​cliffhall in #​2027
• chore(scripts): derive dep-lockstep candidates from what enters each tsc program by @​cliffhall in #​2029
• fix: settle ink input handlers after frame waits so TUI coverage runs stop flaking on Windows by @​olaservo in #​1996
• fix: stop emitting a process-wide SIGINT in run-method.test so the CLI suite passes on Windows by @​olaservo in #​1995
• fix(web): read modern tasks support from the extension map by @​cliffhall in #​2032
• fix(web): accept CRLF-delimited SSE frames on the servers events stream by @​cliffhall in #​2036
• chore(lint): enable @​typescript-eslint/no-floating-promises in all five ESLint scopes by @​cliffhall in #​2039
• feat(auth): Auth URL and Token URL overrides in Server Settings by @​cliffhall in #​2037
• fix(web): name an empty tool result instead of "No results yet" (#​1860) by @​cliffhall in #​2034
• fix(web): correct the Custom Headers OAuth hint, name key/value rows for a11y (#​2040) by @​cliffhall in #​2038
• fix: resolve node bins via package.json instead of spawning npx .cmd shims so verify/smoke scripts run on Windows by @​olaservo in #​1997
• fix(web): expand resource templates per RFC 6570 by @​cliffhall in #​2035
• fix(web): key tool selection by row identity so duplicate tool names are individually inspectable by @​cliffhall in #​2041
• chore: ignore the web client's tsup build output in ESLint by @​cliffhall in #​2044
• fix: register SSE abort cleanup before the priming write by @​cliffhall in #​2045
• fix: surface list-fetch failures in paginated mode (#​1998) by @​cliffhall in #​2047
• fix: handle background command rejections in App (#​2049) by @​cliffhall in #​2050
• chore: bump version to 2.3.0 by @​cliffhall in #​2052
• chore(deps): sync the security fixes that landed on main by @​cliffhall in #​2059
• chore(deps): bump nanoid to 3.3.18 to clear the high-severity advisory by @​cliffhall in #​2061
• chore: merge v2/main for the v2.3.0 milestone release by @​cliffhall in #​2054

Full Changelog: modelcontextprotocol/inspector@2.2.0...2.3.0

Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.3.0

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.30.1

Compare Source

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.11

Compare Source

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in #​10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in #​10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in #​10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in #​10974 (fe5a1)

    View changes on GitHub

codecov/codecov-action (codecov/codecov-action)

v7.1.1

Compare Source

v7.1.0

Compare Source

github/codeql-action (github/codeql-action)

v4.38.2

Compare Source

• Update default CodeQL bundle version to 2.27.1. #​4160

v4.38.1

[Compare Source](https://redirect.github.com/github/codeql-action/compare/

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.72%. Comparing base (f89420e) to head (f364380).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #129   +/-   ##
=======================================
  Coverage   95.72%   95.72%           
=======================================
  Files          26       26           
  Lines         281      281           
  Branches       38       38           
=======================================
  Hits          269      269           
  Misses         12       12           

Flag	Coverage Δ
integration	84.69% <ø> (ø)
unit	42.34% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.