[dependabot]

Bumps the npm_and_yarn group with 1 update in the /sdk/typescript/integration/fixtures/mastra-1 directory: @modelcontextprotocol/node.

Updates @modelcontextprotocol/node from 2.0.0 to 2.1.2

Release notes

Sourced from @​modelcontextprotocol/node's releases.

@​modelcontextprotocol/node@​2.1.2

Patch Changes

• #3084 10c26b0 Thanks @​claude! - The @hono/node-server dependency range widens from ^1.19.9 to ^1.19.9 || ^2.1.3, so a new install resolves to 2.x and an install that cannot get 2.x keeps 1.x.

• Updated dependencies [ef38c67, c05225a, 43c45f4, 5820f79, c05225a, b381559, 46d9c99, 895007f, b022522]:

  • @​modelcontextprotocol/server@​2.4.0

@​modelcontextprotocol/node@​2.1.1

Patch Changes

• #2897 7f4c12a Thanks @​claude! - hono is now a regular dependency of @modelcontextprotocol/node, so installs with strict peer-dependency checking no longer fail on the hono peer that @hono/node-server requires. No runtime change.

• #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

  What keeps working without a change:

  • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
  • A handler that builds a new server and a new stateless transport for each request.
  • One server and one transport per session (a transport with a sessionIdGenerator).
  • Connecting a server again after close().
  • Client.

  What fails now, how it shows, and what to change:

  • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
  • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
  • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
  • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

  What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

  The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

• #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

• Updated dependencies [40f8f4e, 6d8dbc6, 5238fba, 2fc49ea, 4d94e7b, 84804c2, e55f9ac, 633dd3e, 2237555]:

  • @​modelcontextprotocol/server@​2.3.0

@​modelcontextprotocol/node@​2.1.0

Minor Changes

• #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

  createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The

... (truncated)

Commits

• 951fe56 Version Packages (#2959)
• 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
• 28124db fix(docs): use relative POSIX package entry globs (#3016)
• f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
• a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
• 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
• ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
• 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
• a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
• c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: aea8f341-0c52-4651-8203-3492eb109426

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Thanks @dependabot[bot] for keeping our dependencies current! 🙌

[github-actions]

Automated approval for Dependabot dependency update.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​mastra/​mcp@​2.0.0 ⏵ 2.7.0			+1

View full report

[NiveditJain]

Superseded by #966, closing as part of that consolidation.

This one could not install: @mastra/mcp@2.7.0 peers on @mastra/core >=1.79.0, and it left the mastra-1 fixture on 1.68.0, so npm ci failed ERESOLVE and every integration shard that installs the fixture failed with it.

#966 takes @mastra/mcp 2.7.0 together with the @mastra/core 1.81.0 and @mastra/memory 1.40.0 it needs, which also brings @modelcontextprotocol/node 2.1.2 and @hono/node-server 2.1.6.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml