chore(deps): bump the mcp-minor-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #1198 · silverstein/minutes

dependabot · 2026-10-21T16:44:48Z

Bumps the mcp-minor-patch group with 9 updates in the /crates/mcp directory:

Package	From	To
@modelcontextprotocol/ext-apps	`2.0.0`	`2.0.3`
@modelcontextprotocol/sdk	`1.32.0`	`1.32.1`
zod	`4.6.5`	`4.6.7`
@types/node	`26.6.1`	`26.6.5`
tsx	`4.23.13`	`4.23.15`
vite	`7.3.6`	`7.3.7`
vite-plugin-singlefile	`2.3.3`	`2.3.4`
vitest	`5.0.1`	`5.0.5`
@rollup/rollup-linux-x64-gnu	`4.63.3`	`4.64.10`

Updates @modelcontextprotocol/ext-apps from 2.0.0 to 2.0.3

Release notes

Sourced from @modelcontextprotocol/ext-apps's releases.

v2.0.3

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example packages, so that a fresh install of each published package resolves a dependency tree that passes vulnerability and supply-chain scans.

Security

@modelcontextprotocol/server-basic-solid now depends on solid-js 1.9.15 instead of the exact 1.9.10, which pulled in seroval 1.3 (open advisories, fixed in 1.5.3). The root overrides that pinned seroval are removed, and the lockfile is refreshed with npm audit fix (patch and minor updates only, npm audit reports 0 vulnerabilities). by @ochafik in #793

@modelcontextprotocol/server-pdf now depends on the exact @cantoo/pdf-lib 2.6.5 instead of ^2.6.5. The range resolved to 2.11.x, which the repository never tests and which added dependencies with open-ended ranges (culori, node-html-better-parser) that supply-chain scanners flag. by @ochafik in #792

2.0.2 already pinned pdfjs-dist to 5.4.530 for server-pdf (#789).

Full Changelog: modelcontextprotocol/ext-apps@v2.0.2...v2.0.3

v2.0.2

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fix is in the @modelcontextprotocol/server-pdf example package.

Security

@modelcontextprotocol/server-pdf now depends on the exact pdfjs-dist 5.4.530 instead of ^5.0.0. The range let a fresh install resolve pdfjs-dist 5.6.83 or later (currently 5.7.284), which is affected by GHSA-hq66-cqwq-w95j (arbitrary JavaScript execution when opening a crafted PDF). 5.4.530 is outside the affected range and is the version the repository already tests against. Node support is unchanged. by @ochafik in #789

Full Changelog: modelcontextprotocol/ext-apps@v2.0.1...v2.0.2

v2.0.1

What's Changed

Patch release. No changes to the @modelcontextprotocol/ext-apps library itself; the fixes are in the example servers, which are published as their own packages (including @modelcontextprotocol/server-pdf).

Bug fixes

Example servers no longer crash at startup on Node older than 20.11. They computed their dist directory from import.meta.filename / import.meta.dirname, which only exist from Node 20.11, so on Node 18 and 20.0 to 20.10 the module threw TypeError: Cannot read properties of undefined (reading 'endsWith') at load, before the server could answer initialize. All 21 affected servers and the quickstart now derive the path from import.meta.url with fileURLToPath. No behaviour change on Node 20.11+. Affected the published @modelcontextprotocol/server-pdf 1.7.5 and 2.0.0. by @ochafik in #787

engines.node: ">=20" is now declared on the 21 published example packages, matching the root package and the README.

CI

The build now also runs the pdf-server MCPB bundle on Node 20.0.0, so this regression fails the build. #787

The dependency isolation check adds the ES2022.Error lib to its consumer projects. @modelcontextprotocol/client 2.1.0's typings reference ErrorOptions, so a project compiling with skipLibCheck: false and a lib older than ES2022 needs the same. #788

Packaging

repository.url uses the canonical git+https://github.com/modelcontextprotocol/ext-apps.git form in all manifests, which removes the "repository.url" was normalized warning from every publish job. by @ochafik in #773

Full Changelog: modelcontextprotocol/ext-apps@v2.0.0...v2.0.1

Commits

82221c0 Bump version to 2.0.3 (#794)
f20a1ff Update dependencies to clear npm audit findings (#793)
c9e00bd Pin @cantoo/pdf-lib to 2.6.5 in pdf-server (#792)
fe9a9f1 Bump version to 2.0.2
7bc2c5c Pin pdfjs-dist to 5.4.530 in pdf-server
a523ab3 Fix dependency isolation check against @modelcontextprotocol/client 2.1
b0ddf50 Bump version to 2.0.1
8e1b3bd Fix example servers crashing at startup on Node older than 20.11
6d9bdc7 Merge pull request #773 from modelcontextprotocol/repo-url-fix
2be172d Use the canonical git+https form for repository.url
See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.32.0 to 1.32.1

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

[v1.x] docs: state the principles in CLAUDE.md by @claude[bot] in modelcontextprotocol/typescript-sdk#2939

[v1.x] docs: point the README at v2 and say what v1.x supports by @claude[bot] in modelcontextprotocol/typescript-sdk#2942

chore: bump version to 1.32.1 by @claude[bot] in modelcontextprotocol/typescript-sdk#2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

Commits

ff07b00 chore: bump version to 1.32.1 (#2954)
8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

b500a2e 4.6.7
9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
Additional commits viewable in compare view

Updates @types/node from 26.6.1 to 26.6.5

Commits

See full diff in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

exclude bare builtins from namespace inheritance (38e1588)

expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)

make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

npm package (@latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

npm package (@latest dist-tag)

Commits

ca66105 test: fix drive-less file URLs in ESM resolver fixtures
2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
38e1588 fix: exclude bare builtins from namespace inheritance
562c434 fix: make namespaced register() overloads portable for declaration emit
edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
70e7828 test: upgrade tinyspy for disposable API
9ed2022 ci: avoid duplicate release notifications
872e77f refactor: use disposables for cleanup
6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
See full diff in compare view

Updates vite from 7.3.6 to 7.3.7

Release notes

Sourced from vite's releases.

v7.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.7 (2026-10-06)

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (a0a3339)

html: filename passed to transformIndexHtml should not include queries (#23653) (8d479f9)

server: store ids to safeModulePaths rather than URLs (#23656) (f0d76c7)

Commits

284f6b5 release: v7.3.7
f0d76c7 fix(server): store ids to safeModulePaths rather than URLs (#23656)
a0a3339 fix(deps): update launch-editor to v2.14.2 (#23654)
8d479f9 fix(html): filename passed to transformIndexHtml should not include queries (...
See full diff in compare view

Updates vite-plugin-singlefile from 2.3.3 to 2.3.4

Changelog

Sourced from vite-plugin-singlefile's changelog.

Change Log

Date Version Notes

2021-01-09 0.1.0 First post!

2021-01-14 0.2.0 Fix for newest Vite beta, including CSS support

2021-01-14 0.3.0 Borked npm update

2021-01-14 0.4.0 Work around regex accidental replacement variables issue.

2021-01-21 0.5.0 Add TypeScript declaration file (originally 0.1.1 with the wrong base, forgot to push 0.2-0.4)

2021-03-21 0.6.1 Minor tweak to allow node 12.x support

2021-12-12 0.6.2 Update deps. Fix relative asset paths (thanks @prog-rajkamal!). Improved docs.

2021-12-31 0.6.3 Update deps. Fix parent relative asset paths (#17).

2022-03-01 0.7.0 Update deps. Warn for assets not inlined rather than adding comments (#21, thanks @taybart!)

2022-03-02 0.7.1 Downgrade chalk, fixes #22

2022-04-03 0.7.2 Update deps. Remove unneeded code (#24).

2022-04-19 0.8.0 Option to remove unnecessary Vite loader (#26). Switch to ESM, update/remove deps (#25).

BREAKING CHANGE NOTE: requires that your package.json use type:module.

2022-04-23 0.9.0 Auto-config by default (#27).

Remove manualChunks (incompatible with inlineDynamicImports=true in vite 2.9.5

2022-06-14 0.10.0-beta Dual ESM/CJS exports (#30 and others)

Switched from transformIndexHtml to generateBundle to fix issue with UnoCSS (#32)

BREAKING: Removes inlined chunks before they are written to the file system.

Add new optional inlinePattern glob pattern to limit inlining (implements #31)

Removed Chalk -- it's pretty, but not worth the ESM-only hassle

More permissive script tag parsing (solves #37)

Added some basic tests (Jest)

Added eslint, removed unnecessary escapes for "." in regex patterns

2022-06-16 0.10.0-beta.2 Add support for .mjs and .cjs file extensions (#38)

2022-07-01 0.10.0 Fix where some bundles are undefined (#41)

Remove filename comment from injected scripts (#39)

Remove unneeded Vite Preload marker (#34)

Make jest a dev dependency only (#40)

2022-07-23 0.11.0 Widen version range for Vite peer dependency to support Vite 3.0 (#46, #47, thanks @valtism!)

2022-08-06 0.11.1 Check for null code due to worker URLs (#49, thanks @daniel-kun!)

2022-09-21 0.12.0 Set config base to undefined in recommended options (#56)

Remove optional type attribute from style tags (#53, thanks @kidonng!)

Remove all VITE_PRELOAD markers (#55)

Point package.json to types file (#54, thanks @kidonng!)

Update various dependencies

Add README note about SVG (#52)

2022-09-21 0.12.1 Rebase... doh!

2022-10-01 0.12.2 Resolve preload script issue (#58)

2022-10-15 0.12.3 Update various dependencies (including Rollup 3.x), ran tests, no other changes

2022-11-07 0.13.0 Add deleteInlinedFiles option (#62, thanks @jaerod95!). Update dependencies.

2022-11-10 0.13.1 Add node v14 support for non-Vue projects (#64, thanks @aloisklink! See also #60, #61)

Add CI testing via GitHub action (#65, thanks @aloisklink!)

2022-12-10 0.13.2 Confirmed compatibility with Rollup v3 and Vite v4, loosened package.json versions required

2023-02-11 0.13.3 Bump build dependencies, update README

2023-04-01 0.13.5 Allow reporting of compressed bundle size (#70, #71, thanks @mojoaxel!)

Fix where polfill not removed when minify disabled (#72)

... (truncated)

Commits

See full diff in compare view

Updates vitest from 5.0.1 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

... (truncated)

Commits

7a825db chore: release v5.0.5 (#11609)
6621a72 fix: abort all running tests on cancel (#11606)
e9c3d72 fix: release mocks of finished test files (#11607)
8dd67c2 fix(browser): run global setup once with instances (#11596)
6c5a447 fix: run hook cleanups when a later hook fails (#11605)
9697b38 fix: keep the import frame in native loader errors (#11599)
6498b66 fix(browser): wait 30s for the browser to close (#11601)
f161e6d fix(browser): drop late connections of closed sessions (#11600)
fe86a64 fix: skip builtin loading in async leak detector (#11598)
6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.63.3 to 4.64.10

Release notes

Sourced from @rollup/rollup-linux-x64-gnu's releases.

v4.64.10

4.64.10

2026-10-18

Bug Fixes

Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)

Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

#6583: Track manual chunk dependencies when merging small chunks (@ybai08, @lukastaegert)

#6584: Use decoded values for JSX string attributes (@luantaraschi)

v4.64.9

4.64.9

2026-10-17

Bug Fixes

Ensure export live-bindings are properly maintained for aliased exports (#6576)

Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

#6576: Fix live bindings for aliased reassigned exports (@oxura, @lukastaegert)

#6582: Retain typed array constructors that iterate their argument (@joshuablac, @lukastaegert)

v4.64.8

4.64.8

2026-10-17

Bug Fixes

Ensure chunk hashes change when sourcemap comments change (#6509)

Resolve some relative import resolution edge cases (#6522)

Pull Requests

#6509: fix: include sourcemap comments in chunk hashes (@snoopuppy582, @wangxpych, @lukastaegert)

#6522: fix(browser): match node's join and relative for "." and ".." segments (@luantaraschi, @lukastaegert)

#6577: Update dtolnay/rust-toolchain digest to 686976e (@renovate[bot])

#6578: Update minor/patch updates (@renovate[bot])

#6579: Update swc monorepo (major) (@renovate[bot], @lukastaegert)

#6580: Lock file maintenance (@renovate[bot], @lukastaegert)

#6581: Update dependency eslint-plugin-unicorn to v78 (@renovate[bot])

... (truncated)

Changelog

Sourced from @rollup/rollup-linux-x64-gnu's changelog.

4.64.10

2026-10-18

Bug Fixes

Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)

Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

#6583: Track manual chunk dependencies when merging small chunks (@ybai08, @lukastaegert)

#6584: Use decoded values for JSX string attributes (@luantaraschi)

4.64.9

2026-10-17

Bug Fixes

Ensure export live-bindings are properly maintained for aliased exports (#6576)

Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

#6576: Fix live bindings for aliased reassigned exports (@oxura, @lukastaegert)

#6582: Retain typed array constructors that iterate their argument (@joshuablac, @lukastaegert)

4.64.8

2026-10-17

Bug Fixes

Ensure chunk hashes change when sourcemap comments change (#6509)

Resolve some relative import resolution edge cases (#6522)

Pull Requests

#6509: fix: include sourcemap comments in chunk hashes (@snoopuppy582, @wangxpych, @lukastaegert)

#6522: fix(browser): match node's join and relative for "." and ".." segments (@luantaraschi, @lukastaegert)

#6577: Update dtolnay/rust-toolchain digest to 686976e (@renovate[bot])

#6578: Update minor/patch updates (@renovate[bot])

#6579: Update swc monorepo (major) (@renovate[bot], @lukastaegert)

#6580: Lock file maintenance (@renovate[bot], @lukastaegert)

#6581: Update dependency eslint-plugin-unicorn to v78 (@renovate[bot])

4.64.7

2026-10-15

... (truncated)

Commits

4ddbff5 4.64.10
a45f569 Track manual chunk dependencies when merging small chunks (#6583)
fe94ba9 Use decoded values for JSX string attributes (#6584)
6278729 4.64.9
3b41241 Retain typed array constructors that iterate their argument (#6582)
092d139 Fix live bindings for aliased reassigned exports (#6576)
b7dd776 4.64.8
77a6b2b fix: include sourcemap comments in chunk hashes (#6509)
55f46a5 fix(browser): match node's join and relative for "." and ".." segments (#6522)
fabcaff Update swc monorepo (major) (#6579)
Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
vite	[>= 8.a, < 9]

… updates Bumps the mcp-minor-patch group with 9 updates in the /crates/mcp directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) | `2.0.0` | `2.0.3` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.32.0` | `1.32.1` | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.1` | `26.6.5` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.6` | `7.3.7` | | [vite-plugin-singlefile](https://github.com/richardtallent/vite-plugin-singlefile) | `2.3.3` | `2.3.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.5` | | [@rollup/rollup-linux-x64-gnu](https://github.com/rollup/rollup) | `4.63.3` | `4.64.10` | Updates `@modelcontextprotocol/ext-apps` from 2.0.0 to 2.0.3 - [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases) - [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md) - [Commits](modelcontextprotocol/ext-apps@v2.0.0...v2.0.3) Updates `@modelcontextprotocol/sdk` from 1.32.0 to 1.32.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.32.0...1.32.1) Updates `zod` from 4.6.5 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.7) Updates `@types/node` from 26.6.1 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `vite` from 7.3.6 to 7.3.7 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.7/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.7/packages/vite) Updates `vite-plugin-singlefile` from 2.3.3 to 2.3.4 - [Release notes](https://github.com/richardtallent/vite-plugin-singlefile/releases) - [Changelog](https://github.com/richardtallent/vite-plugin-singlefile/blob/main/CHANGELOG.md) - [Commits](https://github.com/richardtallent/vite-plugin-singlefile/commits) Updates `vitest` from 5.0.1 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) Updates `@rollup/rollup-linux-x64-gnu` from 4.63.3 to 4.64.10 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.63.3...v4.64.10) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/ext-apps" dependency-version: 2.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: "@rollup/rollup-linux-x64-gnu" dependency-version: 4.64.10 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: mcp-minor-patch - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: vite dependency-version: 7.3.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: vite-plugin-singlefile dependency-version: 2.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mcp-minor-patch - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mcp-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 21, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-efba894c3e branch 2 times, most recently from 3cab439 to 4ef2e4b Compare October 22, 2026 04:09

dependabot Bot force-pushed the dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-efba894c3e branch from 4ef2e4b to deb8ffd Compare October 22, 2026 04:17

silverstein merged commit e04c0b7 into main Oct 25, 2026
29 checks passed

silverstein deleted the dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-efba894c3e branch October 25, 2026 14:17

This was referenced Oct 25, 2026

chore(deps): bump @vitest/mocker and vitest in /crates/mcp #1202

Closed

chore(deps): bump vite from 7.3.6 to 7.3.7 in /crates/mcp #1183

Closed

Navigation Menu

Repository navigation

chore(deps): bump the mcp-minor-patch group across 1 directory with 9 updates - #1198

chore(deps): bump the mcp-minor-patch group across 1 directory with 9 updates#1198
silverstein merged 1 commit into
mainfrom
dependabot/npm_and_yarn/crates/mcp/mcp-minor-patch-efba894c3e

dependabot Bot commented on behalf of github Oct 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Date	Version	Notes
2021-01-09	0.1.0	First post!
2021-01-14	0.2.0	Fix for newest Vite beta, including CSS support
2021-01-14	0.3.0	Borked npm update
2021-01-14	0.4.0	Work around regex accidental replacement variables issue.
2021-01-21	0.5.0	Add TypeScript declaration file (originally 0.1.1 with the wrong base, forgot to push 0.2-0.4)
2021-03-21	0.6.1	Minor tweak to allow node 12.x support
2021-12-12	0.6.2	Update deps. Fix relative asset paths (thanks `@prog-rajkamal`!). Improved docs.
2021-12-31	0.6.3	Update deps. Fix parent relative asset paths (#17).
2022-03-01	0.7.0	Update deps. Warn for assets not inlined rather than adding comments (#21, thanks `@taybart`!)
2022-03-02	0.7.1	Downgrade chalk, fixes #22
2022-04-03	0.7.2	Update deps. Remove unneeded code (#24).
2022-04-19	0.8.0	Option to remove unnecessary Vite loader (#26). Switch to ESM, update/remove deps (#25).
		BREAKING CHANGE NOTE: requires that your `package.json` use `type:module`.
2022-04-23	0.9.0	Auto-config by default (#27).
		Remove `manualChunks` (incompatible with `inlineDynamicImports=true` in vite 2.9.5
2022-06-14	0.10.0-beta	Dual ESM/CJS exports (#30 and others)
		Switched from `transformIndexHtml` to `generateBundle` to fix issue with UnoCSS (#32)
		BREAKING: Removes inlined chunks before they are written to the file system.
		Add new optional `inlinePattern` glob pattern to limit inlining (implements #31)
		Removed Chalk -- it's pretty, but not worth the ESM-only hassle
		More permissive script tag parsing (solves #37)
		Added some basic tests (Jest)
		Added eslint, removed unnecessary escapes for "." in regex patterns
2022-06-16	0.10.0-beta.2	Add support for .mjs and .cjs file extensions (#38)
2022-07-01	0.10.0	Fix where some bundles are undefined (#41)
		Remove filename comment from injected scripts (#39)
		Remove unneeded Vite Preload marker (#34)
		Make jest a dev dependency only (#40)
2022-07-23	0.11.0	Widen version range for Vite peer dependency to support Vite 3.0 (#46, #47, thanks `@valtism`!)
2022-08-06	0.11.1	Check for null code due to worker URLs (#49, thanks `@daniel-kun`!)
2022-09-21	0.12.0	Set config `base` to `undefined` in recommended options (#56)
		Remove optional `type` attribute from style tags (#53, thanks `@kidonng`!)
		Remove all `VITE_PRELOAD` markers (#55)
		Point package.json to types file (#54, thanks `@kidonng`!)
		Update various dependencies
		Add README note about SVG (#52)
2022-09-21	0.12.1	Rebase... doh!
2022-10-01	0.12.2	Resolve preload script issue (#58)
2022-10-15	0.12.3	Update various dependencies (including Rollup 3.x), ran tests, no other changes
2022-11-07	0.13.0	Add deleteInlinedFiles option (#62, thanks `@jaerod95`!). Update dependencies.
2022-11-10	0.13.1	Add node v14 support for non-Vue projects (#64, thanks `@aloisklink`! See also #60, #61)
		Add CI testing via GitHub action (#65, thanks `@aloisklink`!)
2022-12-10	0.13.2	Confirmed compatibility with Rollup v3 and Vite v4, loosened package.json versions required
2023-02-11	0.13.3	Bump build dependencies, update README
2023-04-01	0.13.5	Allow reporting of compressed bundle size (#70, #71, thanks `@mojoaxel`!)
		Fix where polfill not removed when minify disabled (#72)

Conversation

dependabot Bot commented on behalf of github Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.0.3

What's Changed

Security

v2.0.2

What's Changed

Security

v2.0.1

What's Changed

Bug fixes

CI

Packaging

1.32.1

What's Changed

v4.6.7

Commits:

v4.6.6

Commits:

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

v7.3.7

7.3.7 (2026-10-06)

Bug Fixes

Change Log

v5.0.5

🐞 Bug Fixes

View changes on GitHub

v5.0.4

🚀 Features

🐞 Bug Fixes

v4.64.10

4.64.10

Bug Fixes

Pull Requests

v4.64.9

4.64.9

Bug Fixes

Pull Requests

v4.64.8

4.64.8

Bug Fixes

Pull Requests

4.64.10

Bug Fixes

Pull Requests

4.64.9

Bug Fixes

Pull Requests

4.64.8

Bug Fixes

Pull Requests

4.64.7

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 21, 2026 •

edited

Loading