Repository navigation
fix(deps): update dependency @modelcontextprotocol/core to v2.4.0 - #106
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
commit: |
✅ Deploy Preview for ntl-mcp ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for netlify-mcp ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for mcp ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.2.0→2.4.0Release Notes
modelcontextprotocol/typescript-sdk (@modelcontextprotocol/core)
v2.4.0Compare Source
Minor Changes
#3057
c05225aThanks @steipete! -ServerEventtakes optionalparams, which thesubscriptions/listenrouter delivers with its own subscription ID, so a gateway can forward change notifications with their_metaand extension params.#3047
46d9c99Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through newext/skillssubpaths; package root exports are unchanged.@modelcontextprotocol/server/ext/skills:SkillsExtension(attach(server)servesskills/list,skills/get,resources/directory/readand askill://{+path}resource template),SkillsExtension.load(files)returning aSkillCatalogwithentriesandreload(), theSkillFilesstorage adapter withmemorySkillFiles,SkillSourcefor generated catalogs,skillEntry, andSkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail understrict. A file whose bytes are valid UTF-8 is served astext, whatever its MIME type; any other file as a base64blob.@modelcontextprotocol/server/ext/skills/node:loadSkills(folder)andnodeSkillFiles(folder).@modelcontextprotocol/client/ext/skills:SkillsClientwithlist()(throws on an invalid entry;skipInvalid: truekeeps the valid ones and returns the rest ininvalid),get(),read(skill, path?)(size, digest andSKILL.mdfrontmatter verified,SkillVerificationErroron a mismatch; a copy from the response cache that fails a check is fetched once more withcacheMode: 'refresh'first) andreadDirectory().@modelcontextprotocol/core/ext/skills: schemas, types and constants, includingSKILL_LIMITS. The result schemas follow the stable spec, sottlMsandcacheScopeare required.SkillsExtension.attachis@experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (
ttlMs,cacheScope), andSkillsClientrequires them and returns them fromlist(),get()andreadDirectory().Patch Changes
#3083
ef38c67Thanks @claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a$idor$refwhose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a$refinto#/$defs/...or#/definitions/...are not affected.#2960
43c45f4Thanks @claude! - A server whose tool putsx-mcp-headeron anumber-typed parameter keeps checking that tool'sMcp-Param-*headers ontools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered400with JSON-RPC error-32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send noMcp-Param-*headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.#3081
5820f79Thanks @claude! - A tooloutputSchemawhose root is a$refto atype: "object"entry of its own$defsordefinitions(what zod writes forz.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema andstructuredContentare no longer wrapped in{ result: ... }, so a 2025-era client that readstructuredContent.resultfor such a tool now readsstructuredContent. On every era the advertised schema gainstype: "object"at its root.#3057
c05225aThanks @steipete! - Connecting aServerorMcpServerto aPerRequestHTTPServerTransportclassified at a modern revision thatsupportedProtocolVersionslists and the SDK implements now binds that revision, instead of answering-32022.#3005
b381559Thanks @chaeyn! - Reflect resource and resource templateupdate({ title })changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.#3002
895007fThanks @Hugo-DDT! -createMcpHandlernow sendsAllow: POSTon every405it answers to a non-POST request, withlegacy: 'stateless'(the default) and withlegacy: 'reject'.#2762
b022522Thanks @pcarleton! -x-mcp-headeron anumber-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with typenumberare not permitted"; clients MUST exclude such tools fromtools/list). Previouslynumberwas accepted only to satisfy an older conformance fixture that has since been corrected.integer,stringandbooleanare unaffected.Updated dependencies [
46d9c99]:v2.3.1Compare Source
Patch Changes
v2.3.0Compare Source
Minor Changes
#2929
40f8f4eThanks @claude! -requireBearerAuthandverifyBearerTokentake a new optionalexpectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value inAuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered401 invalid_tokenwith the usualWWW-Authenticatechallenge. When it is not set, nothing changes. To use it, passexpectedResourceand haveverifyAccessTokenfillAuthInfo.resource, for example from theaudclaim. The option is declared on a new exported type,VerifyBearerTokenOptions, which extendsBearerAuthOptions;BearerAuthOptionsitself is unchanged. The ExpressrequireBearerAuthpasses the option through. With Express,@modelcontextprotocol/expresshas to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports anexpectedResourcewritten in a call to the 2.0.1requireBearerAuthas an error.#2926
6d8dbc6Thanks @claude! -McpServernow accepts amaxToolInputElementsoption that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a singletools/callargumentspayload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with anisError: truetool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept;maxRequestBodySizeremains the primary limit on request size. The value must be a number of at least 1, orInfinityfor no limit; any other value is rejected at construction. The options type is exported asMcpServerOptions.#2918
84804c2Thanks @claude! - AServerorMcpServernow serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.What keeps working without a change:
createMcpHandler(buildServer)andserveStdio(buildServer), wherebuildServerreturns a new server on every call.sessionIdGenerator).close().Client.What fails now, how it shows, and what to change:
const server = new McpServer(...)outside the handler,await server.connect(transport)inside it): the second HTTP request the process receives fails, and so does every later one.connect()rejects with anSdkErrorof codeALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: movenew McpServer(...)and its registrations into the handler.sessionIdGenerator: undefined): the second HTTP request fails.WebStandardStreamableHTTPServerTransport.handleRequest()rejects withStateless transport cannot be reused across requests. Create a new transport per request., andNodeStreamableHTTPServerTransport.handleRequest()answers500. Change: build the server and the transport inside the handler and connect them there.createMcpHandler(() => server)with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered500with the JSON-RPC error-32603(Internal server error); the reason is reported only through theonerroroption. Change: pass a function that builds the server, as increateMcpHandler(buildServer).initializerequest of the second session fails withALREADY_CONNECTED. Change: build a server per session.What the caller sees when
connect()orhandleRequest()rejects depends on the host. Express 5, Fastify and Hono answer500. A plainnode:httplistener without its own error handling gets an unhandled rejection, which ends the process.The README examples of
@modelcontextprotocol/express,@modelcontextprotocol/fastify,@modelcontextprotocol/honoand@modelcontextprotocol/node, and the handler examples in the JSDoc ofWebStandardStreamableHTTPServerTransportandNodeStreamableHTTPServerTransport, now build a server and a transport per request.#2907
e55f9acThanks @claude! -allowedOriginsandvalidateOriginHeaderaccept lowercase entries of the form<scheme>://*, such asmoz-extension://*orchrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install.http://*andhttps://*are not honoured, and the defaults are unchanged.Patch Changes
#2599
5238fbaThanks @freya0926! - A server can now serve, and a client can now call,tasks/getandtasks/cancelof the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only whenctx.era === 'legacy'.#2107
2fc49eaThanks @pragnyanramtha! -prompts/getwithoutargumentsno longer fails with "Invalid arguments" when every argument of the prompt is optional. A missingargumentsis now validated as{}, as it already is fortools/call, so a top-level.optional()or.default(...)onargsSchemano longer seesundefined.#2889
4d94e7bThanks @claude! -registerToolno longer converts tool schemas up front, so a server built per request stops converting every tool on every request. The warning about an invalidx-mcp-headerdeclaration now appears each time tools are listed, not when the tool is registered.#2908
633dd3eThanks @claude! - Thelicensefield of the package manifests is nowApache-2.0; theLICENSEfile shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.#2841
2237555Thanks @sharziki! -McpServer.registerPrompt()now types the callback correctly when noargsSchemais given: its one parameter is the server context. Before, readingctx.mcpReqthere was a type error although it worked at runtime. Prompts registered with anargsSchemaare unchanged.Updated dependencies [
633dd3e]:Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.