deps(image): Bump the npm-minor-patch group across 1 directory with 4 updates

[dependabot]

Bumps the npm-minor-patch group with 4 updates in the /deploy/mcp directory: jose, @types/node, @modelcontextprotocol/sdk and zod.

Updates jose from 6.2.10 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

Commits

• 505a55b chore(release): 6.2.12
• 7bc9a33 perf: encode single-signature JWS input once
• 78637bd perf: normalize General JWE shared headers once
• bf5138b perf: deduplicate pending jwks key imports
• b23a6f3 perf: use native encoding for larger ASCII strings
• fd3ae3f perf: normalize jwks selection metadata once
• 6925d43 perf: avoid copying AES-GCM output
• be62530 docs: clarify and shorten public API guidance
• 1b41312 build: preserve README when generation fails
• 0b51829 build: check tree-shaking for every public binding
• Additional commits viewable in compare view

Updates @types/node from 26.3.0 to 26.6.4

Commits

• See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.0

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in modelcontextprotocol/typescript-sdk#2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in modelcontextprotocol/typescript-sdk#2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in modelcontextprotocol/typescript-sdk#2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in modelcontextprotocol/typescript-sdk#2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in modelcontextprotocol/typescript-sdk#2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in modelcontextprotocol/typescript-sdk#2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2931
• chore: bump version to 1.32.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2935

New Contributors

• @​raashish1601 made their first contribution in modelcontextprotocol/typescript-sdk#2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in modelcontextprotocol/typescript-sdk#2888
• chore: bump version to 1.31.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2890

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in modelcontextprotocol/typescript-sdk#2717
• fix(auth): preserve resource URI without trailing slash (#1968) by @​MukundaKatta in modelcontextprotocol/typescript-sdk#1972
• chore: bump version to 1.30.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2848

New Contributors

• @​MukundaKatta made their first contribution in modelcontextprotocol/typescript-sdk#1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits

• 32549b0 chore: bump version to 1.32.0 (#2935)
• 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
• 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
• 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
• fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
• 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
• 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
• c2ce003 docs: point SECURITY.md at GitHub Security Advisories (v1.x) (#2910)
• 30bfe51 [v1.x] fix(client): follow redirects only within the endpoint's origin (#2902)
• 4b0051f chore: bump version to 1.31.0 (#2890)
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view