Skip to content

Bump the npm group across 3 directories with 3 updates - #312

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-6743447aec
Nov 1, 2026
Merged

Bump the npm group across 3 directories with 3 updates#312
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-6743447aec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 3 updates in the / directory: @modelcontextprotocol/core, @modelcontextprotocol/server and hono.
Bumps the npm group with 3 updates in the /example directory: @modelcontextprotocol/core, @modelcontextprotocol/server and hono.
Bumps the npm group with 3 updates in the /package directory: @modelcontextprotocol/core, @modelcontextprotocol/server and hono.

Updates @modelcontextprotocol/core from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/core's releases.

@​modelcontextprotocol/core@​2.4.0

Minor Changes

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Commits
  • 951fe56 Version Packages (#2959)
  • 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
  • 28124db fix(docs): use relative POSIX package entry globs (#3016)
  • f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
  • a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
  • 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
  • ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
  • 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
  • a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
  • c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.4.0

Patch Changes

  • Updated dependencies [46d9c99]:
    • @​modelcontextprotocol/core@​2.4.0

@​modelcontextprotocol/server@​2.4.0

Minor Changes

  • #3057 c05225a Thanks @​steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

  • #3083 ef38c67 Thanks @​claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

  • #2960 43c45f4 Thanks @​claude! - A server whose tool puts x-mcp-header on a number-typed parameter keeps checking that tool's Mcp-Param-* headers on tools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered 400 with JSON-RPC error -32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send no Mcp-Param-* headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.

  • #3081 5820f79 Thanks @​claude! - A tool outputSchema whose root is a $ref to a type: "object" entry of its own $defs or definitions (what zod writes for z.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema and structuredContent are no longer wrapped in { result: ... }, so a 2025-era client that read structuredContent.result for such a tool now reads structuredContent. On every era the advertised schema gains type: "object" at its root.

  • #3057 c05225a Thanks @​steipete! - Connecting a Server or McpServer to a PerRequestHTTPServerTransport classified at a modern revision that supportedProtocolVersions lists and the SDK implements now binds that revision, instead of answering -32022.

  • #3005 b381559 Thanks @​chaeyn! - Reflect resource and resource template update({ title }) changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.

  • #3002 895007f Thanks @​Hugo-DDT! - createMcpHandler now sends Allow: POST on every 405 it answers to a non-POST request, with legacy: 'stateless' (the default) and with legacy: 'reject'.

  • #2762 b022522 Thanks @​pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

  • Updated dependencies [46d9c99]:

    • @​modelcontextprotocol/core@​2.4.0
Commits
  • 951fe56 Version Packages (#2959)
  • 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
  • 28124db fix(docs): use relative POSIX package entry globs (#3016)
  • f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
  • a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
  • 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
  • ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
  • 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
  • a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
  • c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
  • Additional commits viewable in compare view

Updates hono from 4.13.13 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

Full Changelog: honojs/hono@v4.13.13...v4.13.14

Commits
  • bac5c4a 4.13.14
  • eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
  • 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
  • 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
  • e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
  • 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
  • e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
  • d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
  • ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
  • 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/core from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/core's releases.

@​modelcontextprotocol/core@​2.4.0

Minor Changes

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Commits
  • 951fe56 Version Packages (#2959)
  • 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
  • 28124db fix(docs): use relative POSIX package entry globs (#3016)
  • f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
  • a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
  • 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
  • ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
  • 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
  • a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
  • c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.4.0

Patch Changes

  • Updated dependencies [46d9c99]:
    • @​modelcontextprotocol/core@​2.4.0

@​modelcontextprotocol/server@​2.4.0

Minor Changes

  • #3057 c05225a Thanks @​steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

  • #3083 ef38c67 Thanks @​claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

  • #2960 43c45f4 Thanks @​claude! - A server whose tool puts x-mcp-header on a number-typed parameter keeps checking that tool's Mcp-Param-* headers on tools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered 400 with JSON-RPC error -32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send no Mcp-Param-* headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.

  • #3081 5820f79 Thanks @​claude! - A tool outputSchema whose root is a $ref to a type: "object" entry of its own $defs or definitions (what zod writes for z.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema and structuredContent are no longer wrapped in { result: ... }, so a 2025-era client that read structuredContent.result for such a tool now reads structuredContent. On every era the advertised schema gains type: "object" at its root.

  • #3057 c05225a Thanks @​steipete! - Connecting a Server or McpServer to a PerRequestHTTPServerTransport classified at a modern revision that supportedProtocolVersions lists and the SDK implements now binds that revision, instead of answering -32022.

  • #3005 b381559 Thanks @​chaeyn! - Reflect resource and resource template update({ title }) changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.

  • #3002 895007f Thanks @​Hugo-DDT! - createMcpHandler now sends Allow: POST on every 405 it answers to a non-POST request, with legacy: 'stateless' (the default) and with legacy: 'reject'.

  • #2762 b022522 Thanks @​pcarleton! - x-mcp-header on a number-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with type number are not permitted"; clients MUST exclude such tools from tools/list). Previously number was accepted only to satisfy an older conformance fixture that has since been corrected. integer, string and boolean are unaffected.

  • Updated dependencies [46d9c99]:

    • @​modelcontextprotocol/core@​2.4.0
Commits
  • 951fe56 Version Packages (#2959)
  • 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
  • 28124db fix(docs): use relative POSIX package entry globs (#3016)
  • f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
  • a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
  • 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
  • ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
  • 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
  • a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
  • c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
  • Additional commits viewable in compare view

Updates hono from 4.13.13 to 4.13.14

Release notes

Sourced from hono's releases.

v4.13.14

What's Changed

Full Changelog: honojs/hono@v4.13.13...v4.13.14

Commits
  • bac5c4a 4.13.14
  • eb78eca fix(utils/url): preserve encoded duplicate query order (#5495)
  • 06a45bc feat(bearer-auth): allow MessageFunction to return a Response (#5269)
  • 5ca49b0 fix(css): Fix multiline CSS handling in style replacement (#5405)
  • e9c0107 fix(hono-base): disallow getPath when strict is false (#5563)
  • 08807ce fix(trie-router): keep first value for duplicate path params (#5422) (#5423)
  • e77c7c8 fix(helper/route): match regex params in basePath() the same way as the route...
  • d54720d fix(serve-static): respect q-values in Accept-Encoding for precompressed file...
  • ae401f0 fix(css): keep the descendant combinator before a pseudo-class when minifying...
  • 2013fed fix(css): keep "//" inside an unquoted url() when minifying (#5450)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/core from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/core's releases.

@​modelcontextprotocol/core@​2.4.0

Minor Changes

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Commits
  • 951fe56 Version Packages (#2959)
  • 895007f fix(server): set Allow: POST on stateless legacy 405 responses (#3002)
  • 28124db fix(docs): use relative POSIX package entry globs (#3016)
  • f7289b3 docs: say that a spec handler's params drop members the spec does not define ...
  • a633756 feat(client): add an opt-in for sending scope on token refresh (#3085)
  • 10c26b0 chore(node): accept @​hono/node-server 1.x or 2.x (#3084)
  • ef38c67 chore(deps): build the bundled ajv with fast-uri 3.1.8 (#3083)
  • 5820f79 fix(server): treat an outputSchema root $ref to an object definition as an ob...
  • a513cfe docs: close the v1 to v2 quick path with the 2026-07-28 serving decision (#3086)
  • c822443 docs(server): mark SkillsExtension.attach as experimental (#3080)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.3.1 to 2.4.0

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.4.0

Patch Changes

  • Updated dependencies [46d9c99]:
    • @​modelcontextprotocol/core@​2.4.0

@​modelcontextprotocol/server@​2.4.0

Minor Changes

  • #3057 c05225a Thanks @​steipete! - ServerEvent takes optional params, which the subscriptions/listen router delivers with its own subscription ID, so a gateway can forward change notifications with their _meta and extension params.

  • #3047 46d9c99 Thanks @​KKonstantinov, @​tobi-oye, @​mattzcarey! - Add the Skills extension (SEP-2640), reachable through new ext/skills subpaths; package root exports are unchanged.

    • @modelcontextprotocol/server/ext/skills: SkillsExtension (attach(server) serves skills/list, skills/get, resources/directory/read and a skill://{+path} resource template), SkillsExtension.load(files) returning a SkillCatalog with entries and reload(), the SkillFiles storage adapter with memorySkillFiles, SkillSource for generated catalogs, skillEntry, and SkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail under strict. A file whose bytes are valid UTF-8 is served as text, whatever its MIME type; any other file as a base64 blob.
    • @modelcontextprotocol/server/ext/skills/node: loadSkills(folder) and nodeSkillFiles(folder).
    • @modelcontextprotocol/client/ext/skills: SkillsClient with list() (throws on an invalid entry; skipInvalid: true keeps the valid ones and returns the rest in invalid), get(), read(skill, path?) (size, digest and SKILL.md frontmatter verified, SkillVerificationError on a mismatch; a copy from the response cache that fails a check is fetched once more with cacheMode: 'refresh' first) and readDirectory().
    • @modelcontextprotocol/core/ext/skills: schemas, types and constants, including SKILL_LIMITS. The result schemas follow the stable spec, so ttlMs and cacheScope are required.

    SkillsExtension.attach is @experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.

    Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (ttlMs, cacheScope), and SkillsClient requires them and returns them from list(), get() and readDirectory().

Patch Changes

  • #3083 ef38c67 Thanks @​claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a $id or $ref whose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a $ref into #/$defs/... or #/definitions/... are not affected.

  • #2960 43c45f4 Thanks @​claude! - A server whose tool puts x-mcp-header on a number-typed parameter keeps checking that tool's Mcp-Param-* headers on tools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered 400 with JSON-RPC error -32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send no Mcp-Param-* headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.

  • #3081 5820f79 Thanks @​claude! - A tool outputSchema whose root is a $ref to a type: "object" entry of its own $defs or definitions (what zod writes for z.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema and structuredContent are no longer wrapped in { result: ... }, so a 2025-era client that read structuredContent.result for such a tool now reads structuredContent. On every era the advertised schema gains type: "object" at its root.

  • #3057 c05225a Thanks @​steipete! - Connecting a Server or McpServer to a PerRequestHTTPServerTransport classified at a modern revision that supportedProtocolVersions lists and the SDK implements now binds that revision, instead of answering -32022.

  • #3005 b38155...

    Description has been truncated

@dependabot
Bump the npm group across 3 directories with 3 updates
c969f6e 
Bumps the npm group with 3 updates in the / directory: [@modelcontextprotocol/core](https://github.com/modelcontextprotocol/typescript-sdk), [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) and [hono](https://github.com/honojs/hono).
Bumps the npm group with 3 updates in the /example directory: [@modelcontextprotocol/core](https://github.com/modelcontextprotocol/typescript-sdk), [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) and [hono](https://github.com/honojs/hono).
Bumps the npm group with 3 updates in the /package directory: [@modelcontextprotocol/core](https://github.com/modelcontextprotocol/typescript-sdk), [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) and [hono](https://github.com/honojs/hono).


Updates `@modelcontextprotocol/core` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/core@2.3.1...@modelcontextprotocol/core@2.4.0)

Updates `@modelcontextprotocol/server` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.3.1...@modelcontextprotocol/server@2.4.0)

Updates `hono` from 4.13.13 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.13...v4.13.14)

Updates `@modelcontextprotocol/core` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/core@2.3.1...@modelcontextprotocol/core@2.4.0)

Updates `@modelcontextprotocol/server` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.3.1...@modelcontextprotocol/server@2.4.0)

Updates `hono` from 4.13.13 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.13...v4.13.14)

Updates `@modelcontextprotocol/core` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/core@2.3.1...@modelcontextprotocol/core@2.4.0)

Updates `@modelcontextprotocol/server` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.3.1...@modelcontextprotocol/server@2.4.0)

Updates `hono` from 4.13.13 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.13...v4.13.14)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/core"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@modelcontextprotocol/core"
  dependency-version: 2.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@modelcontextprotocol/core"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot assigned poad Nov 1, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) November 1, 2026 18:11
@github-actions

github-actions Bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/@modelcontextprotocol/server 2.4.0 UnknownUnknown
npm/hono 4.13.14 UnknownUnknown
npm/@modelcontextprotocol/core 2.4.0 UnknownUnknown
npm/@modelcontextprotocol/server 2.4.0 UnknownUnknown
npm/hono 4.13.14 UnknownUnknown

Scanned Files

  • example/package.json
  • package/package.json

@github-actions
github-actions Bot merged commit c0a7f34 into main Nov 1, 2026
4 checks passed
@github-actions
github-actions Bot deleted the dependabot/npm_and_yarn/npm-6743447aec branch November 1, 2026 18:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

@poad poad

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@poad