Skip to content

Bump @modelcontextprotocol/ext-apps from 1.7.4 to 1.7.5 - #48

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/modelcontextprotocol/ext-apps-1.7.5
Open

Bump @modelcontextprotocol/ext-apps from 1.7.4 to 1.7.5#48
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/modelcontextprotocol/ext-apps-1.7.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps @modelcontextprotocol/ext-apps from 1.7.4 to 1.7.5.

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v1.7.5

What's Changed

SDK

  • Preserve experimental capability settings during initialization. McpUiHostCapabilities.experimental and McpUiAppCapabilities.experimental are now typed Record<string, object> instead of {}, and the generated schema no longer strips their contents, by @​victor-openai in #721

Specification

Examples

  • lazy-auth-server: usable on mobile in #714
  • map-server: fix README and code of conduct links in #657

Docs

  • API Docs link for ext-apps/server in #697
  • Add mcp-use inspector badge to supported clients by @​pietrozullo in #650

Security

npm audit goes from 15 findings (2 critical, 7 high, 4 moderate, 2 low) to 3 in #725:

The 3 remaining are all the same advisory (GHSA-frvp-7c67-39w9, path traversal in @hono/node-server's serve-static on Windows), reached through @modelcontextprotocol/sdk's ^1.19.9 pin. It needs an upstream SDK bump, and is not reachable from this SDK, which imports only getRequestListener and serve from that package.

Full Changelog: modelcontextprotocol/ext-apps@v1.7.4...v1.7.5

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@silverstein

Copy link
Copy Markdown
Member

Thanks Dependabot. Leaving this one open, unlike the two sibling bumps.

This is a patch bump on the MCP Apps wrapper the viewer already depends on, so it is a plausible candidate rather than something to refuse. It does still need host lifecycle verification before merging, because this package governs how the viewer is created, surfaced, and torn down inside the host, and that behaviour is not exercised by the server-side test suite.

It will be picked up in the next host validation pass rather than merged on a green CI run alone.

Bumps [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) from 1.7.4 to 1.7.5.
- [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases)
- [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md)
- [Commits](modelcontextprotocol/ext-apps@v1.7.4...v1.7.5)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/ext-apps"
  dependency-version: 1.7.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/modelcontextprotocol/ext-apps-1.7.5 branch from 3cd98f7 to 04027ed Compare July 30, 2026 00:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant