From 5b956a9520d2e8f1ae45b17db4f1faa2e1580259 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Tue, 28 Jul 2026 09:10:21 -0400 Subject: [PATCH 1/2] fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x closes #49, which called this a major bump needing a breaking-change assessment. that was true against @modelcontextprotocol/sdk 1.29.0, which declared @hono/node-server ^1.19.9. sdk 1.30.0, published 2026-07-27, widened the range to ^1.19.9 || ^2.0.5, so no pnpm.overrides pin is needed. forcing 2.x onto the old sdk would have meant overriding a dependency own declared range, which is the failure claude-workstation#554 documents. @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 @hono/node-server 1.19.14 -> 2.0.12 the one manifest line is deliberate, not the claude-workstation#555 churn. #555 is about all 48 package.json files being reformatted and em dashes unescaped inside published description fields; that was reverted. this run touched one manifest and one line. it is load-bearing: @wave-av/mcp-server is published, and consumers resolve against its declared range rather than our lockfile, so ^1.0.0 would let them pull sdk 1.29.x and the vulnerable node-server straight back in. pnpm install --frozen-lockfile clean, pnpm -r build clean, 143 tests / 52 files / 48 packages green, type-check clean. packages/mcp-server/src/server.ts imports only StdioServerTransport and never builds an HTTP transport, so node-server sits off the exercised path. the identical bump was verified end to end on wave-av/mcp-server#68 by driving the built binary over stdio: initialize plus tools/list returning all 18 tools, matching baseline. CI cannot run. --- .../packages/mcp-server/package.json | 2 +- sdk-typescript/pnpm-lock.yaml | 284 ++++++++++-------- 2 files changed, 153 insertions(+), 133 deletions(-) diff --git a/sdk-typescript/packages/mcp-server/package.json b/sdk-typescript/packages/mcp-server/package.json index 915474d..a15daa8 100644 --- a/sdk-typescript/packages/mcp-server/package.json +++ b/sdk-typescript/packages/mcp-server/package.json @@ -63,7 +63,7 @@ "registry": "https://registry.npmjs.org/" }, "dependencies": { - "@modelcontextprotocol/sdk": "^1.0.0", + "@modelcontextprotocol/sdk": "^1.30.0", "zod": "^3.23.0" }, "devDependencies": { diff --git a/sdk-typescript/pnpm-lock.yaml b/sdk-typescript/pnpm-lock.yaml index 5e35b6a..3a87b8d 100644 --- a/sdk-typescript/pnpm-lock.yaml +++ b/sdk-typescript/pnpm-lock.yaml @@ -22,7 +22,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.0 version: 5.9.3 @@ -41,7 +41,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -63,7 +63,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -85,7 +85,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -107,7 +107,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -129,7 +129,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -151,7 +151,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -173,7 +173,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -195,7 +195,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -217,7 +217,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -239,7 +239,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -261,7 +261,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -286,7 +286,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -308,7 +308,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -330,7 +330,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -352,7 +352,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -374,7 +374,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -396,7 +396,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -418,7 +418,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -440,7 +440,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -462,7 +462,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -484,7 +484,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -515,7 +515,7 @@ importers: version: 8.1.9 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.0 version: 5.9.3 @@ -534,7 +534,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -548,8 +548,8 @@ importers: packages/mcp-server: dependencies: '@modelcontextprotocol/sdk': - specifier: ^1.0.0 - version: 1.29.0(zod@3.25.76) + specifier: ^1.30.0 + version: 1.30.0(zod@3.25.76) zod: specifier: ^3.23.0 version: 3.25.76 @@ -559,7 +559,7 @@ importers: version: 22.19.19 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.0 version: 5.9.3 @@ -575,7 +575,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -597,7 +597,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -619,7 +619,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -641,7 +641,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -663,7 +663,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -685,7 +685,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -707,7 +707,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -729,7 +729,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -751,7 +751,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -773,7 +773,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -795,7 +795,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -943,7 +943,7 @@ importers: devDependencies: tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -962,7 +962,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -984,7 +984,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1006,7 +1006,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1028,7 +1028,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1050,7 +1050,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1072,7 +1072,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1094,7 +1094,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1116,7 +1116,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1138,7 +1138,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1160,7 +1160,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1182,7 +1182,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1204,7 +1204,7 @@ importers: version: 25.9.1 tsup: specifier: ^8.0.0 - version: 8.5.1(postcss@8.5.15)(typescript@5.9.3) + version: 8.5.1(postcss@8.5.24)(typescript@5.9.3) typescript: specifier: ^5.9.3 version: 5.9.3 @@ -1382,9 +1382,9 @@ packages: cpu: [x64] os: [win32] - '@hono/node-server@1.19.14': - resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} - engines: {node: '>=18.14.1'} + '@hono/node-server@2.0.12': + resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==} + engines: {node: '>=20'} peerDependencies: hono: ^4 @@ -1401,8 +1401,8 @@ packages: '@jridgewell/trace-mapping@0.3.31': resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==} - '@modelcontextprotocol/sdk@1.29.0': - resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==} + '@modelcontextprotocol/sdk@1.30.0': + resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -1411,11 +1411,12 @@ packages: '@cfworker/json-schema': optional: true - '@napi-rs/wasm-runtime@1.1.4': - resolution: {integrity: sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==} + '@napi-rs/wasm-runtime@1.2.0': + resolution: {integrity: sha512-kDoONqMa+VnZ4vvvu/ZUurpJ4gkZU57e7g69qpNgWhYcZFPUHZM2CEMKm+cG6ufDVALbjMvfmMjFVqaK7uEMnA==} + engines: {node: ^20.19.0 || ^22.13.0 || >=23.5.0} peerDependencies: - '@emnapi/core': ^1.7.1 - '@emnapi/runtime': ^1.7.1 + '@emnapi/core': ^2.0.0-alpha.3 + '@emnapi/runtime': ^2.0.0-alpha.3 '@noble/ed25519@3.1.0': resolution: {integrity: sha512-pfcObRY3CtvwfaG9Mt5XqZdKmAQppl37tHUeuBhDUbiwJBCVY4/A4lbMvb1xKhMDx96AqAqZpMWuBX1HulhX4g==} @@ -1650,8 +1651,8 @@ packages: '@standard-schema/spec@1.1.0': resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==} - '@tybys/wasm-util@0.10.2': - resolution: {integrity: sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==} + '@tybys/wasm-util@0.10.3': + resolution: {integrity: sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==} '@types/chai@5.2.3': resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==} @@ -1989,74 +1990,74 @@ packages: json-schema-typed@8.0.2: resolution: {integrity: sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==} - lightningcss-android-arm64@1.32.0: - resolution: {integrity: sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==} + lightningcss-android-arm64@1.33.0: + resolution: {integrity: sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [android] - lightningcss-darwin-arm64@1.32.0: - resolution: {integrity: sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==} + lightningcss-darwin-arm64@1.33.0: + resolution: {integrity: sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [darwin] - lightningcss-darwin-x64@1.32.0: - resolution: {integrity: sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==} + lightningcss-darwin-x64@1.33.0: + resolution: {integrity: sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [darwin] - lightningcss-freebsd-x64@1.32.0: - resolution: {integrity: sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==} + lightningcss-freebsd-x64@1.33.0: + resolution: {integrity: sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [freebsd] - lightningcss-linux-arm-gnueabihf@1.32.0: - resolution: {integrity: sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==} + lightningcss-linux-arm-gnueabihf@1.33.0: + resolution: {integrity: sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==} engines: {node: '>= 12.0.0'} cpu: [arm] os: [linux] - lightningcss-linux-arm64-gnu@1.32.0: - resolution: {integrity: sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==} + lightningcss-linux-arm64-gnu@1.33.0: + resolution: {integrity: sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - lightningcss-linux-arm64-musl@1.32.0: - resolution: {integrity: sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==} + lightningcss-linux-arm64-musl@1.33.0: + resolution: {integrity: sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - lightningcss-linux-x64-gnu@1.32.0: - resolution: {integrity: sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==} + lightningcss-linux-x64-gnu@1.33.0: + resolution: {integrity: sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - lightningcss-linux-x64-musl@1.32.0: - resolution: {integrity: sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==} + lightningcss-linux-x64-musl@1.33.0: + resolution: {integrity: sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - lightningcss-win32-arm64-msvc@1.32.0: - resolution: {integrity: sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==} + lightningcss-win32-arm64-msvc@1.33.0: + resolution: {integrity: sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [win32] - lightningcss-win32-x64-msvc@1.32.0: - resolution: {integrity: sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==} + lightningcss-win32-x64-msvc@1.33.0: + resolution: {integrity: sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [win32] - lightningcss@1.32.0: - resolution: {integrity: sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==} + lightningcss@1.33.0: + resolution: {integrity: sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==} engines: {node: '>= 12.0.0'} lilconfig@3.1.3: @@ -2102,8 +2103,8 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -2154,6 +2155,10 @@ packages: resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} + picomatch@4.0.5: + resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==} + engines: {node: '>=12'} + pirates@4.0.7: resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==} engines: {node: '>= 6'} @@ -2183,8 +2188,8 @@ packages: yaml: optional: true - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.24: + resolution: {integrity: sha512-8RyVklq0owXUTa4xlpzu4l9AaVKIdQvAcOHZWaMh98HgySsUtxRVf/chRe3dsSLqb6i40BzGRzEUddRaI+9TSw==} engines: {node: ^10 || ^12 || >=14} proxy-addr@2.0.7: @@ -2314,6 +2319,10 @@ packages: resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==} engines: {node: '>=12.0.0'} + tinyglobby@0.2.17: + resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==} + engines: {node: '>=12.0.0'} + tinyrainbow@3.1.0: resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==} engines: {node: '>=14.0.0'} @@ -2578,7 +2587,7 @@ snapshots: '@esbuild/win32-x64@0.27.7': optional: true - '@hono/node-server@1.19.14(hono@4.12.23)': + '@hono/node-server@2.0.12(hono@4.12.23)': dependencies: hono: 4.12.23 @@ -2596,9 +2605,9 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.5 - '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)': + '@modelcontextprotocol/sdk@1.30.0(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.23) + '@hono/node-server': 2.0.12(hono@4.12.23) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -2618,11 +2627,11 @@ snapshots: transitivePeerDependencies: - supports-color - '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)': + '@napi-rs/wasm-runtime@1.2.0(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)': dependencies: '@emnapi/core': 1.10.0 '@emnapi/runtime': 1.10.0 - '@tybys/wasm-util': 0.10.2 + '@tybys/wasm-util': 0.10.3 optional: true '@noble/ed25519@3.1.0': {} @@ -2673,7 +2682,7 @@ snapshots: dependencies: '@emnapi/core': 1.10.0 '@emnapi/runtime': 1.10.0 - '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0) + '@napi-rs/wasm-runtime': 1.2.0(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0) optional: true '@rolldown/binding-win32-arm64-msvc@1.0.2': @@ -2761,7 +2770,7 @@ snapshots: '@standard-schema/spec@1.1.0': {} - '@tybys/wasm-util@0.10.2': + '@tybys/wasm-util@0.10.3': dependencies: tslib: 2.8.1 optional: true @@ -3041,6 +3050,10 @@ snapshots: optionalDependencies: picomatch: 4.0.4 + fdir@6.5.0(picomatch@4.0.5): + optionalDependencies: + picomatch: 4.0.5 + finalhandler@2.1.1: dependencies: debug: 4.4.3 @@ -3125,54 +3138,54 @@ snapshots: json-schema-typed@8.0.2: {} - lightningcss-android-arm64@1.32.0: + lightningcss-android-arm64@1.33.0: optional: true - lightningcss-darwin-arm64@1.32.0: + lightningcss-darwin-arm64@1.33.0: optional: true - lightningcss-darwin-x64@1.32.0: + lightningcss-darwin-x64@1.33.0: optional: true - lightningcss-freebsd-x64@1.32.0: + lightningcss-freebsd-x64@1.33.0: optional: true - lightningcss-linux-arm-gnueabihf@1.32.0: + lightningcss-linux-arm-gnueabihf@1.33.0: optional: true - lightningcss-linux-arm64-gnu@1.32.0: + lightningcss-linux-arm64-gnu@1.33.0: optional: true - lightningcss-linux-arm64-musl@1.32.0: + lightningcss-linux-arm64-musl@1.33.0: optional: true - lightningcss-linux-x64-gnu@1.32.0: + lightningcss-linux-x64-gnu@1.33.0: optional: true - lightningcss-linux-x64-musl@1.32.0: + lightningcss-linux-x64-musl@1.33.0: optional: true - lightningcss-win32-arm64-msvc@1.32.0: + lightningcss-win32-arm64-msvc@1.33.0: optional: true - lightningcss-win32-x64-msvc@1.32.0: + lightningcss-win32-x64-msvc@1.33.0: optional: true - lightningcss@1.32.0: + lightningcss@1.33.0: dependencies: detect-libc: 2.1.2 optionalDependencies: - lightningcss-android-arm64: 1.32.0 - lightningcss-darwin-arm64: 1.32.0 - lightningcss-darwin-x64: 1.32.0 - lightningcss-freebsd-x64: 1.32.0 - lightningcss-linux-arm-gnueabihf: 1.32.0 - lightningcss-linux-arm64-gnu: 1.32.0 - lightningcss-linux-arm64-musl: 1.32.0 - lightningcss-linux-x64-gnu: 1.32.0 - lightningcss-linux-x64-musl: 1.32.0 - lightningcss-win32-arm64-msvc: 1.32.0 - lightningcss-win32-x64-msvc: 1.32.0 + lightningcss-android-arm64: 1.33.0 + lightningcss-darwin-arm64: 1.33.0 + lightningcss-darwin-x64: 1.33.0 + lightningcss-freebsd-x64: 1.33.0 + lightningcss-linux-arm-gnueabihf: 1.33.0 + lightningcss-linux-arm64-gnu: 1.33.0 + lightningcss-linux-arm64-musl: 1.33.0 + lightningcss-linux-x64-gnu: 1.33.0 + lightningcss-linux-x64-musl: 1.33.0 + lightningcss-win32-arm64-msvc: 1.33.0 + lightningcss-win32-x64-msvc: 1.33.0 lilconfig@3.1.3: {} @@ -3211,7 +3224,7 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.12: {} + nanoid@3.3.16: {} negotiator@1.0.0: {} @@ -3243,6 +3256,8 @@ snapshots: picomatch@4.0.4: {} + picomatch@4.0.5: {} + pirates@4.0.7: {} pkce-challenge@5.0.1: {} @@ -3253,15 +3268,15 @@ snapshots: mlly: 1.8.2 pathe: 2.0.3 - postcss-load-config@6.0.1(postcss@8.5.15): + postcss-load-config@6.0.1(postcss@8.5.24): dependencies: lilconfig: 3.1.3 optionalDependencies: - postcss: 8.5.15 + postcss: 8.5.24 - postcss@8.5.15: + postcss@8.5.24: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -3455,6 +3470,11 @@ snapshots: fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 + tinyglobby@0.2.17: + dependencies: + fdir: 6.5.0(picomatch@4.0.5) + picomatch: 4.0.5 + tinyrainbow@3.1.0: {} toidentifier@1.0.1: {} @@ -3466,7 +3486,7 @@ snapshots: tslib@2.8.1: optional: true - tsup@8.5.1(postcss@8.5.15)(typescript@5.9.3): + tsup@8.5.1(postcss@8.5.24)(typescript@5.9.3): dependencies: bundle-require: 5.1.0(esbuild@0.27.7) cac: 6.7.14 @@ -3477,7 +3497,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(postcss@8.5.15) + postcss-load-config: 6.0.1(postcss@8.5.24) resolve-from: 5.0.0 rollup: 4.60.4 source-map: 0.7.6 @@ -3486,7 +3506,7 @@ snapshots: tinyglobby: 0.2.16 tree-kill: 1.2.2 optionalDependencies: - postcss: 8.5.15 + postcss: 8.5.24 typescript: 5.9.3 transitivePeerDependencies: - jiti @@ -3514,11 +3534,11 @@ snapshots: vite@8.0.14(@types/node@25.9.1)(esbuild@0.27.7): dependencies: - lightningcss: 1.32.0 - picomatch: 4.0.4 - postcss: 8.5.15 + lightningcss: 1.33.0 + picomatch: 4.0.5 + postcss: 8.5.24 rolldown: 1.0.2 - tinyglobby: 0.2.16 + tinyglobby: 0.2.17 optionalDependencies: '@types/node': 25.9.1 esbuild: 0.27.7 From 12aff7abd1e9338d23460a4d3202691e3c858e3d Mon Sep 17 00:00:00 2001 From: yakimoto Date: Tue, 28 Jul 2026 13:13:35 +0000 Subject: [PATCH 2/2] docs(changelog): record sdk 1.30.0 advisory fix under Unreleased Co-authored-by: Codesmith --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 283c9f3..cec0868 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,13 @@ All notable changes to this project are documented here. The format is based on ## [Unreleased] +### Security + +- **Bumped `@modelcontextprotocol/sdk` to `^1.30.0`** in `sdk-typescript/packages/mcp-server`. + SDK 1.30.0 widens its `@hono/node-server` range to `^1.19.9 || ^2.0.5`, moving the transitive + dependency from 1.19.14 to 2.0.12 and clearing the moderate advisory affecting versions + below 2.0.5. No override or pin needed; the SDK update is the whole fix. (#49) + ### Fixed - **Codegen crashed on any OpenAPI 3.1 nullable union** (`codegen/parse_spec.py`).