Skip to content

deps-dev(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates - #94

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-a2afd36816
Open

deps-dev(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates#94
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-a2afd36816

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited by blacksmith-sh Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 7 updates in the / directory:

Package From To
@modelcontextprotocol/ext-apps 1.7.5 2.0.0
@types/node 26.2.0 26.5.1
eslint 10.9.0 10.10.0
globals 17.11.0 17.12.0
typescript-eslint 8.67.0 8.70.0
vite 8.2.2 8.3.0
vitest 4.1.11 5.0.0

Updates @modelcontextprotocol/ext-apps from 1.7.5 to 2.0.0

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v2.0.0

What's Changed

ext-apps 2.0 moves to the MCP TypeScript SDK 2.0 split packages. The MCP Apps wire protocol is unchanged: 2.x Views run in 1.x hosts and 2.x hosts render 1.x Views (covered by a test that runs the published 1.7.5 against this release in both directions). What breaks is dependencies and the TypeScript API; see the migration guide.

Breaking changes

  • Peer dependencies. @modelcontextprotocol/sdk@^1 is replaced by @modelcontextprotocol/client@^2.0.0 (required: App and AppBridge extend its Protocol), @modelcontextprotocol/server@^2.0.0 (optional, only for the ./server helpers), and zod@^4.2.0. Node.js 20+.
  • zod 3 is no longer supported. SDK 2.0 requires zod 4.2+ (the release that added Standard JSON Schema output); the 1.x fallback for zod 3.25 is gone. Raw zod shapes in registerAppTool still work as a deprecated overload; wrap them in z.object({...}) to move off it.
  • Handler context. Custom handlers receive the SDK 2.x BaseContext: extra.signal is now extra.mcpReq.signal, extra.requestId is extra.mcpReq.id.
  • setRequestHandler / setNotificationHandler are keyed by method name. The 2.x form is setRequestHandler("method", { params }, (params, ctx) => …). The 1.x (Schema, handler) form still works as a deprecated overload with a one-time warning (#769) and goes away in 3.0.
  • The double-registration guard now covers the SDK's own handlers. Registering a handler for notifications/progress or notifications/cancelled throws already registered, as ping and the on*-owned methods did in 1.x.
  • ProtocolWithEvents is removed. AppRequest, AppNotification and AppResult remain as deprecated type aliases.
  • Errors. Remote JSON-RPC errors are ProtocolError (numeric code); local failures are SdkError (string code). Host-side wire deltas: a handler-thrown -32002 reaches the View as -32602, invalid params on ui/* methods go from -32603 to -32602, and the MCP error N: message prefix is gone.
  • schema.json follows the 2.0 core schemas: structuredContent is any JSON value, result _meta documents io.modelcontextprotocol/serverInfo, toolInfo.tool.outputSchema is a loose object, and a recursive JSON-value definition is added.

SDK

  • Migrate to SDK v2 with the official Protocol and isolated role peers by @​tonxxd, building on @​khandrew1's #710 and @​felixweinberger's #712, in #720
  • SDK 2.0 fixups: regenerated lockfile, ^2.0.0 peers, restored double-registration guard, deprecated raw-shape registerAppTool overload, migration guide, wire-compat tests, MCPB build in #768
  • Fix: explicit .js extensions on relative imports so published declarations resolve under NodeNext / Node16 (#704) by @​ken-jo in #705
  • Keep the 1.x handler registration forms as deprecated overloads in #769
  • Cross-version interop test against the published ext-apps 1.7.5 in #770

Examples

  • All examples migrated to the split SDK packages (NodeStreamableHTTPServerTransport, z.object schemas, extra.mcpReq.*) in #720
  • server-pdf now advertises JSON Schema 2020-12 on every tool's inputSchema / outputSchema, which fixes #765 for clients with a strict 2020-12 validator

Docs

Security

npm audit reports 10 findings (2 critical, 4 high, 4 moderate), all in example workspaces or build tooling, none reachable from the published package, whose only runtime dependency is @standard-schema/spec:

  • seroval / solid-js (GHSA-mv8w-475r-vwqw): the Solid example's vite plugin, pinned by a root overrides
  • undici 7.28.0: cheerio in wiki-explorer-server
  • nanoid, postcss: vite
  • brace-expansion: nodemon (dev)
  • hono / @hono/node-server (GHSA-frvp-7c67-39w9): @modelcontextprotocol/node in the examples' servers; same advisory as the 1.7.5 residual, still unreachable (only getRequestListener / serve are imported)
  • qs: express 5 in examples; fflate: @types/three (dev)

All have non-major fixes available and will be picked up in a follow-up, kept off this release to keep the version diff clean.

Full Changelog: modelcontextprotocol/ext-apps@v1.7.5...v2.0.0

Commits
  • 352f6ce CI: build the WSL job on ext4, skip the unused Chromium download, list tsconf...
  • ae4f7e0 Sync the quickstart tsconfig snippets
  • a0dcf16 CI: build the WSL job on ext4, skip the unused Chromium download, list tsconf...
  • ae0fe55 Migration guide fixes and editor-visible deprecation for the 1.x handler form...
  • 853c9f7 Migration guide fixes and editor-visible deprecation for the 1.x handler form
  • 12aa50b Add cross-version interop test against the published ext-apps 1.7.5 (#770)
  • 218aef1 Keep the 1.x handler registration forms as deprecated overloads (#769)
  • 5f6346e Add cross-version interop test against published ext-apps 1.7.5
  • 4eab52e Export the legacy handler types from the root entry
  • 728b0bf Keep the 1.x handler registration forms as deprecated overloads
  • Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.5.1

Commits

Updates eslint from 10.9.0 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
  • 8724829 docs: update compat table links (#21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

  • b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
  • 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
  • 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
  • 3c753f1 chore: update eslint (#21289) (renovate[bot])
  • 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
  • 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
  • 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
  • 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
  • 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

Commits

Updates globals from 17.11.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

  • Update globals (2026-09-01) (#353) 50a2119
  • Add __webpack_layer__ global (#351) 779a11a

sindresorhus/globals@v17.11.0...v17.12.0

Commits

Updates typescript-eslint from 8.67.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

  • eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
  • website: generate per-page social preview cards (#12734)

🩹 Fixes

  • use stable release of pnpm 12 (#12808)
  • update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
  • eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
  • eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
  • project-service: avoid discarded tsserver logs (#12748)
  • typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

  • eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

  • eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
  • eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
  • eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
  • website: respect allowJs playground config (#12744)

❤️ Thank You

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

  • eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 7ee7608 chore(release): publish 8.70.0
  • 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
  • 9a6e546 chore(release): publish 8.69.0
  • 8f4e00a chore(release): publish 8.68.0
  • 55f6d5d chore: enable source maps (#12677)
  • See full diff in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

v8.3.0-beta.0

Features

  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
  • devtools: enable dev server integration (#23333) (68aeb8a)
  • accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
  • add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
  • add top-level tsconfig option (#23310) (93164c3)
  • add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
  • cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
  • config: warn on named imports from JSON modules (#23378) (472385e)
  • css: minify style tag (#23183) (8156684)
  • searched params attached to workers are now preserved (#22280) (517b97f)
  • support subpath imports in dynamic import statements (#23185) (b78e2f1)
  • use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
  • use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
  • worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
  • build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
  • bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
  • deps: update all non-major dependencies (#23445) (fc7c104)
  • html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
  • resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
  • shortcuts extend error (#23447) (4ec58d1)
  • config: close bundles when generation fails (#23256) (6bacc95)
  • css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
  • deps: update all non-major dependencies (#23337) (d550815)
  • deps: update all non-major dependencies (#23404) (238ad81)
  • deps: update rolldown-related dependencies (#23338) (76e8082)
  • deps: update rolldown-related dependencies (#23405) (b882566)
  • dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
  • hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
  • utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
  • utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

... (truncated)

Commits

Updates vitest from 4.1.11 to 5.0.0

Release notes

Sourced from vitest's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits
  • f441c6f chore: release v5.0.0 (#11130)
  • d46a747 fix: treat test.describe as a suite during static collection (#11128)
  • 584cf30 fix: add a warning if inline projec...

    Description has been truncated

    View with [code]smith Autofix with [code]smith
    Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

@dependabot
deps-dev(deps-dev): bump the dev-dependencies group across 1 director…
a284eef 
…y with 7 updates

Bumps the dev-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) | `1.7.5` | `2.0.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.5.1` |
| [eslint](https://github.com/eslint/eslint) | `10.9.0` | `10.10.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.70.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.0` |



Updates `@modelcontextprotocol/ext-apps` from 1.7.5 to 2.0.0
- [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases)
- [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md)
- [Commits](modelcontextprotocol/ext-apps@v1.7.5...v2.0.0)

Updates `@types/node` from 26.2.0 to 26.5.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 10.9.0 to 10.10.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.9.0...v10.10.0)

Updates `globals` from 17.11.0 to 17.12.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.11.0...v17.12.0)

Updates `typescript-eslint` from 8.67.0 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/typescript-eslint)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

Updates `vitest` from 4.1.11 to 5.0.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/ext-apps"
  dependency-version: 2.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 10.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vitest
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@dependabot
dependabot Bot requested a review from asachs01 as a code owner September 14, 2026 14:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: eb01dad6-bad7-40c9-96cd-6f84d66f1abe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@asachs01 asachs01 Awaiting requested review from asachs01 asachs01 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants