chore: bump the npm-production group with 11 updates

[dependabot]

Bumps the npm-production group with 11 updates:

Package	From	To
@ark-ui/react	5.37.2	5.39.1
@radix-ui/react-collapsible	1.1.17	1.1.20
@radix-ui/react-dialog	1.1.20	1.1.23
@radix-ui/react-dropdown-menu	2.1.21	2.1.24
@radix-ui/react-visually-hidden	1.2.8	1.2.11
@tanstack/react-table	8.21.3	9.2.4
@tanstack/react-virtual	3.14.6	3.14.10
@zag-js/react	1.42.0	1.43.3
@zag-js/steps	1.42.0	1.43.3
@tmcp/transport-stdio	0.4.3	0.5.0
tmcp	1.19.4	1.20.0

Updates @ark-ui/react from 5.37.2 to 5.39.1

Release notes

Sourced from @​ark-ui/react's releases.

@​ark-ui/react@​5.39.1

@​ark-ui/react

[5.39.1] - 2026-08-28

Fixed

• Fix NavigationMenu.Content throwing document is not defined during SSR.

[5.39.0] - 2026-08-21

Added

• Toc [New]: Add a table of contents component that tracks which headings are in view as the reader scrolls. Pass the headings to Toc.Root as items, where each entry needs the heading element's id as value and its level as depth. Set scrollEl when the content scrolls inside a container rather than the page, so tracking observes that element instead of the viewport.

  <Toc.Root items={items} scrollEl={() => contentRef.current}>
    <Toc.Content />
    <Toc.Nav>
      <Toc.Title />
      <Toc.List>
        <Toc.Indicator />
        <Toc.Item item={item}>
          <Toc.Link />
        </Toc.Item>
      </Toc.List>
    </Toc.Nav>
  </Toc.Root>

  More than one heading can be active at once, so Toc.Item carries data-first and data-last to mark the ends of the range, and Toc.Indicator spans it. Use useToc with Toc.RootProvider to reach activeItems and scrollTo from outside the tree. The API may still change while the component is in preview.
• Hotkeys [New]: Add a hotkeys entrypoint with hooks for registering and inspecting keyboard shortcuts, built on @zag-js/hotkeys. useHotkey registers one command. useHotkeys registers several. mod+K resolves per platform, and sequences like G > H go through the same hook. Command ids are optional and generated when omitted.

  useHotkey({ hotkey: 'mod+K', action: openSearch })
  useHotkeys({
    commands: [
      { hotkey: 'mod+S', action: save, label: 'Save', category: 'File' },
      { hotkey: 'G > H', action: goHome, label: 'Home' },
    ],
  })

  useHotkeyRegistrations returns those commands with their metadata (label, description, category, keywords), so a command palette or shortcut dialog can render from the same registration that binds the key. Pass a store from createHotkeyStore to scope a set of commands. Without one, hooks share a default store.

... (truncated)

Changelog

Sourced from @​ark-ui/react's changelog.

[5.39.1] - 2026-08-28

Fixed

• Fix NavigationMenu.Content throwing document is not defined during SSR.

[5.39.0] - 2026-08-21

Added

• Toc [New]: Add a table of contents component that tracks which headings are in view as the reader scrolls. Pass the headings to Toc.Root as items, where each entry needs the heading element's id as value and its level as depth. Set scrollEl when the content scrolls inside a container rather than the page, so tracking observes that element instead of the viewport.

  <Toc.Root items={items} scrollEl={() => contentRef.current}>
    <Toc.Content />
    <Toc.Nav>
      <Toc.Title />
      <Toc.List>
        <Toc.Indicator />
        <Toc.Item item={item}>
          <Toc.Link />
        </Toc.Item>
      </Toc.List>
    </Toc.Nav>
  </Toc.Root>

  More than one heading can be active at once, so Toc.Item carries data-first and data-last to mark the ends of the range, and Toc.Indicator spans it. Use useToc with Toc.RootProvider to reach activeItems and scrollTo from outside the tree. The API may still change while the component is in preview.
• Hotkeys [New]: Add a hotkeys entrypoint with hooks for registering and inspecting keyboard shortcuts, built on @zag-js/hotkeys. useHotkey registers one command. useHotkeys registers several. mod+K resolves per platform, and sequences like G > H go through the same hook. Command ids are optional and generated when omitted.

  useHotkey({ hotkey: 'mod+K', action: openSearch })
  useHotkeys({
    commands: [
      { hotkey: 'mod+S', action: save, label: 'Save', category: 'File' },
      { hotkey: 'G > H', action: goHome, label: 'Home' },
    ],
  })

  useHotkeyRegistrations returns those commands with their metadata (label, description, category, keywords), so a command palette or shortcut dialog can render from the same registration that binds the key. Pass a store from createHotkeyStore to scope a set of commands. Without one, hooks share a default store.

  const store = createHotkeyStore()
  useHotkeys({ commands, store })
  const registered = useHotkeyRegistrations({ store })

... (truncated)

Commits

• f105a60 chore: release packages (#3989)
• 190f713 chore(deps): update all non-major dependencies (#3990)
• 0e64037 fix(navigation-menu): skip viewport lookup during SSR
• e75b062 chore: release packages (#3981)
• 213ecac feat: expose DOM attribute utilities (#3987)
• 4f410b6 refactor(hotkeys): take object params and drop the provider
• 1a2e8f8 fix(hotkeys): give each example's commands a unique id
• 7dd9369 feat(hotkeys): add hotkeys primitive for react, solid, vue and svelte (#3985)
• 514dc2c feat: toc component implementation (#3850)
• aa9f43a fix(react): unwrap react.lazy asChild children across the RSC boundary (#3980)
• Additional commits viewable in compare view

Updates @radix-ui/react-collapsible from 1.1.17 to 1.1.20

Changelog

Sourced from @​radix-ui/react-collapsible's changelog.

1.1.20

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

1.1.19

• Updated dependencies: @radix-ui/react-primitive@2.1.9

1.1.18

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-id@1.1.3, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3

Commits

• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.20 to 1.1.23

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.23

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

1.1.22

• Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-portal@1.1.16

1.1.21

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-focus-guards@1.1.5, @radix-ui/react-focus-scope@1.1.14, @radix-ui/react-id@1.1.3, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3

Commits

• See full diff in compare view

Updates @radix-ui/react-dropdown-menu from 2.1.21 to 2.1.24

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.24

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-menu@2.1.24, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6

2.1.23

• Updated dependencies: @radix-ui/react-menu@2.1.23, @radix-ui/react-primitive@2.1.9

2.1.22

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-id@1.1.3, @radix-ui/react-menu@2.1.22, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5

Commits

• See full diff in compare view

Updates @radix-ui/react-visually-hidden from 1.2.8 to 1.2.11

Changelog

Sourced from @​radix-ui/react-visually-hidden's changelog.

1.2.11

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-primitive@2.1.10

1.2.10

• Updated dependencies: @radix-ui/react-primitive@2.1.9

1.2.9

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/react-primitive@2.1.8

Commits

• See full diff in compare view

Updates @tanstack/react-table from 8.21.3 to 9.2.4

Release notes

Sourced from @​tanstack/react-table's releases.

@​tanstack/react-table@​9.2.4

Patch Changes

• Updated dependencies [f72e516]:
  • @​tanstack/table-core@​9.2.4

@​tanstack/react-table@​9.2.3

Patch Changes

• Updated dependencies [468f267, 3b94648]:
  • @​tanstack/table-core@​9.2.3

@​tanstack/react-table-devtools@​9.1.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/table-devtools@​9.1.2

@​tanstack/react-table@​9.1.2

Patch Changes

• Updated dependencies [ff43666]:
  • @​tanstack/table-core@​9.1.2

@​tanstack/react-table-devtools@​9.1.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/table-devtools@​9.1.1

@​tanstack/react-table@​9.1.1

Patch Changes

• Updated dependencies [269e0d8]:
  • @​tanstack/table-core@​9.1.1

@​tanstack/react-table-devtools@​9.1.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/table-devtools@​9.1.0

@​tanstack/react-table@​9.1.0

Patch Changes

• Updated dependencies [09598d2]:
  • @​tanstack/table-core@​9.1.0

@​tanstack/react-table-devtools@​9.0.1

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-table's changelog.

9.2.4

Patch Changes

• Updated dependencies [f72e516]:
  • @​tanstack/table-core@​9.2.4

9.2.3

Patch Changes

• Updated dependencies [468f267, 3b94648]:
  • @​tanstack/table-core@​9.2.3

9.1.2

Patch Changes

• Updated dependencies [ff43666]:
  • @​tanstack/table-core@​9.1.2

9.1.1

Patch Changes

• Updated dependencies [269e0d8]:
  • @​tanstack/table-core@​9.1.1

9.1.0

Patch Changes

• Updated dependencies [09598d2]:
  • @​tanstack/table-core@​9.1.0

9.0.1

Patch Changes

• #6521 10accb2 - Column defs built with legacyCreateColumnHelper now accept the built-in filterFn, sortFn, and aggregationFn names, matching the registries useLegacyTable registers at runtime.

• Updated dependencies []:

  • @​tanstack/table-core@​9.0.1

9.0.0

Major Changes

• #6512 2327f80 - TanStack Table v9 stable release. See the "Migrating to V9" guide for your framework (e.g. React) for upgrade instructions.

... (truncated)

Commits

• d01c01b ci: Version Packages (#6580)
• f72e516 fix: Add realtime (w/ fake data) trading table example (#6561)
• 3bfc1bf ci: Version Packages (#6575)
• ac4f134 docs: add react compiler guide
• faa261b feat: support latest TanStack Devtools and refresh package versions (#6553)
• ff7653d ci: Version Packages (#6533)
• ff43666 refactor(table-core): centralize no-op state update guarding in setStateSlice...
• 058a520 ci: Version Packages (#6531)
• 3af6abc ci: Version Packages (#6527)
• 896e998 ci: Version Packages (#6525)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tanstack/react-table since your current version.

Updates @tanstack/react-virtual from 3.14.6 to 3.14.10

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.10

Patch Changes

• Updated dependencies [a0a411e, d2cf98b]:
  • @​tanstack/virtual-core@​3.17.8

@​tanstack/react-virtual@​3.14.9

Patch Changes

• Updated dependencies [a5417b4]:
  • @​tanstack/virtual-core@​3.17.7

@​tanstack/react-virtual@​3.14.8

Patch Changes

• #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

• Updated dependencies [7ae32b5]:

  • @​tanstack/virtual-core@​3.17.6

@​tanstack/react-virtual@​3.14.7

Patch Changes

• Updated dependencies [1e3b908, 7dcfc07]:
  • @​tanstack/virtual-core@​3.17.5

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.10

Patch Changes

• Updated dependencies [a0a411e, d2cf98b]:
  • @​tanstack/virtual-core@​3.17.8

3.14.9

Patch Changes

• Updated dependencies [a5417b4]:
  • @​tanstack/virtual-core@​3.17.7

3.14.8

Patch Changes

• #1237 aa536e7 - Fix a gap at the top of the list after an end-anchored prepend in directDomUpdates mode. The prepend grows the total size and bumps scrollOffset to the new bottom in the same pass, but the size container's height was written after _willUpdate synced the scroll position — so the browser clamped the scrollTop write to the stale (shorter) scrollHeight, leaving whitespace at the top until the next scroll. The container is now grown before the scroll sync. Only affected directDomUpdates mode (React-rendered sizers receive their height during render).

• Updated dependencies [7ae32b5]:

  • @​tanstack/virtual-core@​3.17.6

3.14.7

Patch Changes

• Updated dependencies [1e3b908, 7dcfc07]:
  • @​tanstack/virtual-core@​3.17.5

Commits

• e9874f0 ci: Version Packages (#1247)
• b4a76ca fix(marko-virtual): consolidate Marko e2e into one in-package app, fix test (...
• deca524 ci: Version Packages (#1240)
• 32b2f2b ci: Version Packages (#1238)
• aa536e7 fix(react-virtual): grow size container before scroll sync on end-anchored pr...
• 87f689a ci: Version Packages (#1231)
• ba5c47a feat(angular-virtual): add chat example and require Angular 20 (#1228)
• See full diff in compare view

Updates @zag-js/react from 1.42.0 to 1.43.3

Changelog

Sourced from @​zag-js/react's changelog.

1.43.3 - 2026-08-20

Fixed

• Fixed issue where the Partial type exported from @zag-js/types shadowed the built-in Partial, changing what Partial<T> meant in every file that imported it and breaking @vue/compiler-sfc on interface X extends Partial<Y>.

  Optional properties are now written explicitly as ?: T | undefined, so types like IntlTranslations and ElementIds are plain interfaces. Passing a single translation key still works.

1.43.2 - 2026-08-20

Added

• File Upload: Add data-invalid to the label props so you can style the label when the file upload is invalid.

• Hotkeys

  • Add target option to scope a command to a DOM subtree. Pass an element or a function returning one, and the command only fires for events inside it. Targeted commands win over global ones on the same hotkey, and the same hotkey on different targets is no longer a conflict.

    store.register({
      id: "grid.down",
      hotkey: "ArrowDown",
      action: moveDown,
      options: { target: () => gridEl },
    })

  • Add normalizeHotkey, which resolves equivalent hotkeys (mod+k, Meta+K) to one canonical string.

  • Add Linux detection. formatHotkey now shows Meta as Super on Linux instead of Win.

  • Export the Platform type.

• Presence: Add onEnterComplete, called when the enter animation finishes. Without an enter animation, it fires on the next frame after mount. It doesn't fire on the initial render.

Fixed

• Hotkeys
  • Fix isPressed returning false for bare modifiers like "shift" or "mod".
  • Fix commands registered with enabled: false never firing, even after enable() or setEnabled(id, true).
  • Fix subscribe not reporting pressedKeys until at least one command was registered.
  • Fix commands with capture: false never firing if the store was already listening.
  • Fix HotkeyRecorder.stop() clearing the previous value when nothing new was recorded.
  • Fix HotkeyRecorder.cancel() keeping a partial recording instead of restoring the previous value.
  • Fix addScope, removeScope and toggleScope not resetting in-progress sequences like setScope does.
  • Fix formatHotkey("meta+K") showing Win instead of Super on Linux. Android still shows Win.

... (truncated)

Commits

• 46f88c0 Version Packages (#3295)
• e4a78eb chore(deps): upgrade changesets to v3
• 49ef963 fix(types): drop Partial export that shadowed the built-in
• 960b4c4 Version Packages (#3293)
• d0a6841 docs: next changelog
• 3212588 chore: set pending changesets to patch
• c0dd1e9 feat(presence): add onEnterComplete callback
• 12e6de9 style(website): use slim rounded scrollbar for docs sidebar
• 49b7f67 docs(website): tighten hotkeys prose
• 83beab2 feat(website): add announcement banner to homepage hero
• Additional commits viewable in compare view

Updates @zag-js/steps from 1.42.0 to 1.43.3

Changelog

Sourced from @​zag-js/steps's changelog.

1.43.3 - 2026-08-20

Fixed

• Fixed issue where the Partial type exported from @zag-js/types shadowed the built-in Partial, changing what Partial<T> meant in every file that imported it and breaking @vue/compiler-sfc on interface X extends Partial<Y>.

  Optional properties are now written explicitly as ?: T | undefined, so types like IntlTranslations and ElementIds are plain interfaces. Passing a single translation key still works.

1.43.2 - 2026-08-20

Added

• File Upload: Add data-invalid to the label props so you can style the label when the file upload is invalid.

• Hotkeys

  • Add target option to scope a command to a DOM subtree. Pass an element or a function returning one, and the command only fires for events inside it. Targeted commands win over global ones on the same hotkey, and the same hotkey on different targets is no longer a conflict.

    store.register({
      id: "grid.down",
      hotkey: "ArrowDown",
      action: moveDown,
      options: { target: () => gridEl },
    })

  • Add normalizeHotkey, which resolves equivalent hotkeys (mod+k, Meta+K) to one canonical string.

  • Add Linux detection. formatHotkey now shows Meta as Super on Linux instead of Win.

  • Export the Platform type.

• Presence: Add onEnterComplete, called when the enter animation finishes. Without an enter animation, it fires on the next frame after mount. It doesn't fire on the initial render.

Fixed

• Hotkeys
  • Fix isPressed returning false for bare modifiers like "shift" or "mod".
  • Fix commands registered with enabled: false never firing, even after enable() or setEnabled(id, true).
  • Fix subscribe not reporting pressedKeys until at least one command was registered.
  • Fix commands with capture: false never firing if the store was already listening.
  • Fix HotkeyRecorder.stop() clearing the previous value when nothing new was recorded.
  • Fix HotkeyRecorder.cancel() keeping a partial recording instead of restoring the previous value.
  • Fix addScope, removeScope and toggleScope not resetting in-progress sequences like setScope does.
  • Fix formatHotkey("meta+K") showing Win instead of Super on Linux. Android still shows Win.

... (truncated)

Commits

• 46f88c0 Version Packages (#3295)
• e4a78eb chore(deps): upgrade changesets to v3
• 49ef963 fix(types): drop Partial export that shadowed the built-in
• 960b4c4 Version Packages (#3293)
• d0a6841 docs: next changelog
• 3212588 chore: set pending changesets to patch
• c0dd1e9 feat(presence): add onEnterComplete callback
• 12e6de9 style(website): use slim rounded scrollbar for docs sidebar
• 49b7f67 docs(website): tighten hotkeys prose
• 83beab2 feat(website): add announcement banner to homepage hero
• Additional commits viewable in compare view

Updates @tmcp/transport-stdio from 0.4.3 to 0.5.0

Release notes

Sourced from @​tmcp/transport-stdio's releases.

@​tmcp/transport-stdio@​0.5.0

Minor Changes

• a6b9606: feat: add the core per-request subscription model

  Implement subscriptions/listen for MCP 2026-07-28, including capability-based filter acknowledgment, subscription-ID metadata, independent concurrent streams, change filtering, cancellation, and graceful completion. Subscription managers are transport-owned, with an in-memory default and a distributed pub/sub-compatible create/send/close contract in @tmcp/session-manager. HTTP assigns every listen stream an opaque internal origin instead of trusting Mcp-Session-Id; stdio and in-memory transports own equivalent local routing. Existing session-negotiated resource subscriptions and broadcasts remain unchanged. HTTP transports accept all origins by default with a warning on the first implicit cross-origin request. Configure an explicit allowlist to restrict access, or true to intentionally allow every origin without a warning. This request policy remains independent from CORS response configuration. The legacy SSE transport remains deprecated and receives only lifecycle compatibility changes.

Patch Changes

• 2117694: fix: forward standalone server notifications before initialization

  Register the stdio send listener when the transport is created so per-request protocol logs and progress can be written before a legacy initialize request. This also forwards standalone notifications emitted outside a request before initialization; legacy broadcast and session-state listeners still start after initialization.

• Updated dependencies [a6b9606]

• Updated dependencies [149b730]

  • @​tmcp/session-manager@​0.3.0

Changelog

Sourced from @​tmcp/transport-stdio's changelog.

0.5.0

Minor Changes

• a6b9606: feat: add the core per-request subscription model

  Implement subscriptions/listen for MCP 2026-07-28, including capability-based filter acknowledgment, subscription-ID metadata, independent concurrent streams, change filtering, cancellation, and graceful completion. Subscription managers are transport-owned, with an in-memory default and a distributed pub/sub-compatible create/send/close contract in @tmcp/session-manager. HTTP assigns every listen stream an opaque internal origin instead of trusting Mcp-Session-Id; stdio and in-memory transports own equivalent local routing. Existing session-negotiated resource subscriptions and broadcasts remain unchanged. HTTP transports accept all origins by default with a warning on the first implicit cross-origin request. Configure an explicit allowlist to restrict access, or true to intentionally allow every origin without a warning. This request policy remains independent from CORS response configuration. The legacy SSE transport remains deprecated and receives only lifecycle compatibility changes.

Patch Changes

• 2117694: fix: forward standalone server notifications before initialization

  Register the stdio send listener when the transport is created so per-request protocol logs and progress can be written before a legacy initialize request. This also forwards standalone notifications emitted outside a request before initialization; legacy broadcast and session-state listeners still start after initialization.

• Updated dependencies [a6b9606]

• Updated dependencies [149b730]

  • @​tmcp/session-manager@​0.3.0

0.5.0-next.0

Minor Changes

• a6b9606: feat: add the core per-request subscription model

  Implement subscriptions/listen for MCP 2026-07-28, including capability-based filter acknowledgment, subscription-ID metadata, independent concurrent streams, change filtering, cancellation, and graceful completion. Subscription managers are transport-owned, with an in-memory default and a distributed pub/sub-compatible create/send/close contract in @tmcp/session-manager. HTTP assigns every listen stream an opaque internal origin instead of trusting Mcp-Session-Id; stdio and in-memory transports own equivalent local routing. Existing session-negotiated resource subscriptions and broadcasts remain unchanged. HTTP transports accept all origins by default with a warning on the first implicit cross-origin request. Configure an explicit allowlist to restrict access, or true to intentionally allow every origin without a warning. This request policy remains independent from CORS response configuration. The legacy SSE transport remains deprecated and receives only lifecycle compatibility changes.

Patch Changes

• 2117694: fix: forward standalone server notifications before initialization

  Register the stdio send listener when the transport is created so per-request protocol logs and progress can be written before a legacy initialize request. This also forwards standalone notifications emitted outside a request before initialization; legacy broadcast and session-state listeners still start after initialization.

• Updated dependencies [a6b9606]

• Updated dependencies [149b730]

  • @​tmcp/session-manager@​0.3.0-next.0

Commits

• 8d2c079 Version Packages
• 526b52f Version Packages (next)
• 00a71b6 fix: address worth review comments
• 149b730 feat: add subscription managers
• a6b9606 feat: new subscription model
• 2117694 fix: new logging version
• See full diff in compare view

Updates tmcp from 1.19.4 to 1.20.0

Release notes

Sourced from tmcp's releases.

tmcp@1.20.0

Minor Changes

• a6b9606: feat: add the core per-request subscription model

  Implement subscriptions/listen for MCP 2026-07-28, including capability-based filter acknowledgment, subscription-ID metadata, independent concurrent streams, change filtering, cancellation, and graceful completion. Subscription managers are transport-owned, with an in-memory default and a distributed pub/sub-compatible create/send/close contract in @tmcp/session-manager. HTTP assigns every listen stream an opaque internal origin instead of trusting Mcp-Session-Id; stdio and in-memory transports own equivalent local routing. Existing session-negotiated resource subscriptions and broadcasts remain unchanged. HTTP transports accept all origins by default with a warning on the first implicit cross-origin request. Configure an explicit allowlist to restrict access, or true to intentionally allow every origin without a warning. This request policy remains independent from CORS response configuration. The legacy SSE transport remains deprecated and receives only lifecycle compatibility changes.

• f81f7ca: feat: MRTR for the per-request (stateless) 2026-07-28 protocol

  server.elicitation() and server.message() now work on per-request (stateless) requests. Since there is no server→client JSON-RPC channel, an input call without a matching response ends the request with a successful InputRequiredResult (resultType: 'input_required', keyed inputRequests, optional opaque requestState); the client fulfills the requests and retries the original request with inputResponses (and the echoed requestState) in the params. Only tools/call, prompts/get and resources/read participate. Session-negotiated requests are unaffected by MRTR and keep the awaitable path.

  • Replay acknowledgment gate: on a stateless retry the handler re-executes FROM THE TOP, so side effects before an input call run once per attempt. A stateless request that reaches elicitation()/message() fails with a structured error unless the tool/prompt/resource/template definition sets the new replayable: true flag, which asserts that code before the handler's input points is idempotent or deferred. This gate is a tmcp safety measure, not a spec requirement.
  • Keys: input requests/responses are keyed maps. Default keys are per-execution ordinals ("1", "2", … reset each attempt) so straight-line handlers work unchanged; handlers with conditional control flow can pass a stable key via the new additive options argument: elicitation(message, schema, { key }) / message(request, { key }). Responses are validated per key; unrelated extra entries are ignored per spec.
  • requestState: tmcp carries validated answers forward so clients only need to answer the latest inputRequests; handlers can also persist their own data with server.setRequestState(state) and read it back via server.ctx.requestState. Both are serialized through the new pluggable requestStateCodec server option. ⚠️ The default codec is plain JSON.stringify/JSON.parse with NO integrity protection — round-tripped state is attacker-controlled; plug a signed/encrypted codec if you need to trust it. Encoded state is size-bounded in both directions.
  • isInputRequired(error): new exported helper. The stateless input flow works by throwing an internal signal that must reach the dispatch boundary; broad catch blocks in handlers must rethrow it (a swallowed signal is detected and fails the request with a descriptive error).
  • inputResponses/requestState params on non-MRTR methods are rejected with -32602; input-required results never carry cache fields (ttlMs/cacheScope).
  • Roots are never emitted as input requests (deprecated in 2026-07-28); the low-level request() stays blocked on stateless requests.
  • Elicitation decline and cancel responses now bypass content-schema validation because those valid responses carry no content.
  • Stateless input calls outside tools/call, prompts/get, and resources/read now fail immediately instead of falling through to an unavailable server-to-client channel. Stateless roots requests are rejected for the same reason, and MRTR-only retry fields are rejected on session-negotiated requests.
  • Carried elicitation answers retain their original wire values, so schemas that coerce or transform input are applied exactly once per handler attempt. Form elicitation also requires the client’s elicitation.form capability (an empty elicitation capability remains backward-compatible form support), and outgoing form schemas are checked against MCP’s flat primitive-field restrictions.
  • URL elicitation also participates in stateless retries through elicitation(message, url, { key? }); its keyed inputRequest uses { mode: 'url', message, url } and accepts an action-only response without applying form validation. Client-supplied form content is removed from URL responses before handlers or retry state can observe it.
  • Failed input-request preparation no longer leaves a stale pending request or reserved key, so handlers can catch an invalid URL/schema error and either return a fallback or retry the key safely.
  • Invalid elicitation and sampling answers are removed before their validation errors reach the handler, allowing recovery code to ask again with the same key instead of re-consuming the bad answer or triggering a duplicate-key error.

• 79e445e: feat: implement strict MCP 2026-07-28 HTTP requests

  Classify sessionless requests before accessing session state, require and validate the protocol, method, name, and annotated tool parameter headers, and return protocol errors with their required HTTP status before opening SSE. Successful requests remain request-scoped SSE streams, now with proxy buffering disabled and cooperative cancellation exposed through server.ctx.signal. Initialization-based session behavior remains available on the same transport.

  Add McpServer.hasMethod(), McpServer.validateToolCall(), the tmcp/method-policy entry point, and getPerRequestProtocolVersions() so transports can reuse core registration, method policy, schema, and version behavior without executing handlers. The in-memory transport now uses the same exported per-request version list.

• a449bc9: feat: support 2026-07-28 protocol version

  Add support for the per-request (stateless) MCP protocol version 2026-07-28 (Phases 0–2), plus a few deliberate fixes:

  • Per-request protocol handling is enabled by default for version 2026-07-28 (pinned to upstream spec tag 2026-07-28, commit 5f5440bb26a62e2cf3440b92da5a667efa03b267) and advertised via the new server/discover method. Requests carrying _meta protocol metadata with any other version receive -32022 UNSUPPORTED_PROTOCOL_VERSION. Legacy initialize negotiation is unchanged and LATEST_PROTOCOL_VERSION stays 2025-06-18.
  • New cache server option ({ ttlMs?, cacheScope?, methods? }, defaults { ttlMs: 0, cacheScope: 'private' }) controlling the ttlMs/cacheScope fields required on cacheable per-request results.
  • Per-request results are decorated at the wire boundary (resultType, _meta['io.modelcontextprotocol/serverInfo'], cache fields); handler return types are unchanged.
  • New exported error constants HEADER_MISMATCH (-32020), MISSING_REQUIRED_CLIENT_CAPABILITY (-32021) and UNSUPPORTED_PROTOCOL_VERSION (-32022), and McpError is now exported from the package root.
  • Bug fix: McpError now carries its real code (and optional data) onto JSON-RPC error responses. Previously every thrown McpError collapsed to -32603 on the wire.
  • Bug fix (legacy-visible, deliberate): unknown prompt (prompts/get) and unknown resource (resources/read) names now return -32602 (Invalid params) instead of the incorrect -32601 (Method not found), for both session-negotiated and per-request profiles.
  • Bug fix: the advertised supported protocol version list no longer includes 2024-10-07 — it appeared in one of two disagreeing internal lists and was never actually negotiable. validation/version.js is now the single source of truth.
  • Client/server capability schemas now accept extensions maps and the modern elicitation { form?, url? } sub-shapes (legacy bare {} still means form support). URL elicitation is available through server.elicitation(message, url, options?) and sends the published { mode: 'url', message, url } request shape; form and URL capabilities are checked independently, malformed transport-provided capability values fail cleanly, and form validation supports the complete published primitive/single-select/multi-select schema subset. Extra JSON Schema keywords emitted by adapters are removed from outgoing elicitation requests instead of rejecting the request or sending unsupported fields. Tool inputSchema/outputSchema wire schemas accept any JSON Schema 2020-12 keywords, and structuredContent may be any JSON value — both at runtime and at the type level (the CallToolResult generic no longer constrains structuredContent to objects; a widening, so existing tools are unaffected).
  • Stateless logging is advertised through server/discover and follows the request's explicit io.modelcontextprotocol/logLevel. Requests that omit it receive no log notifications and never inherit a server default, transport session level, or earlier request level; session-negotiated logging behavior is unchanged.
  • Result wire schemas were loosened (v.object → v.looseObject), so unknown top-level fields returned by handlers are now passed through to the client instead of being silently stripped. This is intentional: it is needed to preserve resultType extension values and forward-compatible result fields.

Patch Changes

• f48b2eb: feat: add discover event emitted when a client calls server/discover
• 1a9b90e: fix: tool result type

... (truncated)

Changelog

Sourced from tmcp's changelog.

1.20.0

Minor Changes

• a6b9606: feat: add the core per-request subscription model

  Implement subscriptions/listen for MCP 2026-07-28, including capability-based filter acknowledgment, subscription-ID metadata, independent concurrent streams, change filtering, cancellation, and graceful completion. Subscription managers are transport-owned, with an in-memory default and a distributed pub/sub-compatible create/send/close contract in @tmcp/session-manager. HTTP assigns every listen stream an opaque internal origin instead of trusting Mcp-Session-Id; stdio and in-memory transports own equivalent local routing. Existing session-negotiated resource subscriptions and broadcasts remain unchanged. HTTP transports accept all origins by default with a warning on the first implicit cross-origin request. Configure an explicit...

  Description has been truncated

[netlify]

❌ Deploy Preview for drivenets-design-system failed.

Name	Link
🔨 Latest commit	2d36d7b
🔍 Latest deploy log	https://app.netlify.com/projects/drivenets-design-system/deploys/6a9ce8d5394a4c00083fce66