Build(deps): Bump @modelcontextprotocol/sdk from 1.27.1 to 1.28.0 in the mcp group#4
Closed
dependabot[bot] wants to merge 31 commits into
Closed
Build(deps): Bump @modelcontextprotocol/sdk from 1.27.1 to 1.28.0 in the mcp group#4dependabot[bot] wants to merge 31 commits into
dependabot[bot] wants to merge 31 commits into
Conversation
CI: gitleaks, license compliance, npm audit, lint, build, test CD: OIDC trusted publishing with provenance, version guard, GitHub Release
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [eslint](https://github.com/eslint/eslint) from 9.39.4 to 10.0.3. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v10.0.3) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) from 9.39.4 to 10.0.1. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…etup-node-6 Build(deps): Bump actions/setup-node from 4 to 6
…heckout-6 Build(deps): Bump actions/checkout from 4 to 6
gitleaks-action requires commit history to scan PR diffs. Shallow clone (fetch-depth: 1) causes fatal SHA resolution errors.
Build(deps-dev): Bump eslint from 9.39.4 to 10.0.3
…0.0.1 Build(deps-dev): Bump @eslint/js from 9.39.4 to 10.0.1
Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) from 29.7.0 to 30.3.0. - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-version: 30.3.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Build(deps-dev): Bump jest from 29.7.0 to 30.3.0
Related packages (eslint/jest/actions) now bump in a single PR instead of separate PRs that conflict on package-lock.json.
Dogfooding feedback from iMcp (Apple Notes MCP server): - Add safety annotations (readOnly/destructive/idempotent/openWorld) to tool pattern - Add prompt example (src/prompts/hello.ts) with schema and handler - Add ok()/err() response helpers (src/helpers.ts) - Add environment variable config pattern (src/config.ts) - Switch from server.tool() to server.registerTool() for annotation support - Update AGENTS.md with prompt guide, multi-module scaling, annotation reference - Update README/README.ko.md with new patterns - Update setup checklist with new items - Add tests for helpers and prompts (8 total)
- Add permissions: contents: read to CI workflow - Add .npmignore to prevent publishing tests, config, and docs to npm registry
gitleaks-action@v2 requires paid license for orgs. Use gitleaks CLI directly (MIT, free) for same functionality.
gitleaks git subcommand has no --source flag. Use gitleaks detect --source instead.
- Add tool name collision warning (must be globally unique across servers) - Add Resources primitive example in code and docs - Add HTTP (StreamableHTTPServerTransport) guide for remote deployments - Add NODE_AUTH_TOKEN and EBADPLATFORM comments in CD workflow - Add shell command injection warning in SECURITY.md
- HTTP Transport: full session-aware example with isInitializeRequest guard, session map, GET/DELETE handlers - Tool naming: add intra-server collision warning in AGENTS.md - CD: improve os EBADPLATFORM guidance - NPM setup: create docs/NPM_PUBLISH_SETUP.md with OIDC + classic token guide, environment vs repo secret gotcha - helpers.ts: ok() accepts unknown, auto-stringifies objects - index.ts: add config-passing pattern comment for multi-module - README: note pretest auto-builds in Scripts table
…#10) Bumps the lint group with 1 update: [globals](https://github.com/sindresorhus/globals). Updates `globals` from 16.5.0 to 17.4.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v16.5.0...v17.4.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.4.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: lint ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: heznpc <heznpc@gmail.com>
Bumps the test group with 1 update: [@jest/globals](https://github.com/jestjs/jest/tree/HEAD/packages/jest-globals). Updates `@jest/globals` from 29.7.0 to 30.3.0 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest-globals) --- updated-dependencies: - dependency-name: "@jest/globals" dependency-version: 30.3.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: test ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: heznpc <heznpc@gmail.com>
Bumps the mcp group with 1 update: [zod](https://github.com/colinhacks/zod). Updates `zod` from 3.25.76 to 4.3.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.76...v4.3.6) --- updated-dependencies: - dependency-name: zod dependency-version: 4.3.6 dependency-type: direct:production update-type: version-update:semver-major dependency-group: mcp ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: heznpc <heznpc@gmail.com>
- add prettier + eslint-config-prettier with format/format:check scripts - replace hardcoded server version with dynamic package.json read - bump @modelcontextprotocol/sdk to ^1.27.1 - update tsconfig module resolution to NodeNext - add version:sync script for future automation
Bumps the mcp group with 1 update: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Updates `@modelcontextprotocol/sdk` from 1.27.1 to 1.28.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: mcp ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the mcp group with 1 update: @modelcontextprotocol/sdk.
Updates
@modelcontextprotocol/sdkfrom 1.27.1 to 1.28.0Release notes
Sourced from
@modelcontextprotocol/sdk's releases.Commits
a056569chore: bump version to 1.28.0 (#1746)897bc25fix(server/auth): RFC 8252 loopback port relaxation (#1738)398dc70fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller c...93640d3fix: reject plain JSON Schema objects passed as inputSchema (#1596)4cbcec0[v1.x backport] Default to client_secret_basic when server omits token_endpoi...c9b58d1feat: use scopes_supported from resource metadata by default (fixes #580) (#757)351e124docs: add links to hosted V1 and V2 API reference docsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions