build(deps): bump the production-minor-patch group across 1 directory with 10 updates by dependabot[bot] · Pull Request #51 · IvanBBaev/syncrona

dependabot · 2026-09-15T00:16:56Z

Bumps the production-minor-patch group with 9 updates in the / directory:

Package	From	To
@babel/core	`8.0.1`	`8.0.5`
axios	`1.18.1`	`1.20.0`
inquirer	`14.0.2`	`14.2.2`
yargs	`18.0.0`	`18.1.0`
@modelcontextprotocol/sdk	`1.29.0`	`1.30.0`
zod	`4.4.3`	`4.6.2`
sass	`1.101.0`	`1.104.0`
memfs	`4.57.8`	`4.75.0`
webpack	`5.108.3`	`5.110.3`

Updates @babel/core from 8.0.1 to 8.0.5

Release notes

Sourced from @babel/core's releases.

v8.0.5 (2026-09-10)

Thanks @drubetti, @jibin7jose, @joelle-a-dev, @journey-ad, @Kjubikstronk, @MatteoGabriele, and @zhangli091011 for your first PRs!

👓 Spec Compliance

babel-parser

#18218 fix(parser): do not form html entity for invalid codepoint (@JLHwung)

🐛 Bug Fix

babel-parser

#18215 fix(parser): remove non-decimal prefix from bigint (@JLHwung)

#18063 Disallow new import prop access (@JLHwung)

babel-plugin-transform-destructuring

#18214 fix: only collapse the empty-object check when it targets the declared binding (@Kjubikstronk)

babel-plugin-transform-typescript

#18190 fix(ts): improve variable handling in namespace (@JLHwung)

#18207 [ts] Allow merging enum into a namespace (@nicolo-ribaudo)

babel-node

#18217 Fix import path for babel-node.js (@drubetti)

babel-plugin-bugfix-safari-rest-destructuring-rhs-array

#18213 fix(bugfix): bound check before array access (@JLHwung)

babel-traverse

#18183 fix(remove): unwrap single sequence expression (@JLHwung)

#18153 Handle null in getAll{Prev,Next}Siblings (@JLHwung)

babel-plugin-transform-block-scoping

#18194 fix: improve for loop closure environment check (@JLHwung)

#18193 fix: assign closure body after handling return (@JLHwung)

#18088 Fix initialization of nested for loop head declarations (@journey-ad)

babel-generator

#18202 fix(generator): keep parens for ?. chain in tag (@JLHwung)

babel-register

#18137 fix(babel-register): preserve app-managed graceful shutdown (@jibin7jose)

Other

#18140 chore: fix @babel/eslint-plugin peer deps (@JLHwung)

babel-cli, babel-helper-transform-fixture-test-runner, babel-register

#18131 fix(register): do not inherit parent execArgv (@JLHwung)

babel-standalone

#18095 Add types for @babel/standalone (@liuxingbaoyu)

📝 Documentation

#18187 Add AI policy (@nicolo-ribaudo)

🏠 Internal

babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env

#18145 refactor: replace semver with verkit (@sxzz)

babel-node

#18177 Update node flags list (@nicolo-ribaudo)

babel-types

#18103 Simplify AST validators (@fisker)

... (truncated)

Changelog

Sourced from @babel/core's changelog.

v8.0.5 (2026-09-10)

👓 Spec Compliance

babel-parser

#18218 fix(parser): do not form html entity for invalid codepoint (@JLHwung)

🐛 Bug Fix

babel-parser

#18215 fix(parser): remove non-decimal prefix from bigint (@JLHwung)

#18063 Disallow new import prop access (@JLHwung)

babel-plugin-transform-destructuring

#18214 fix: only collapse the empty-object check when it targets the declared binding (@Kjubikstronk)

babel-plugin-transform-typescript

#18190 fix(ts): improve variable handling in namespace (@JLHwung)

#18207 [ts] Allow merging enum into a namespace (@nicolo-ribaudo)

babel-node

#18217 Fix import path for babel-node.js (@drubetti)

babel-plugin-bugfix-safari-rest-destructuring-rhs-array

#18213 fix(bugfix): bound check before array access (@JLHwung)

babel-traverse

#18183 fix(remove): unwrap single sequence expression (@JLHwung)

#18153 Handle null in getAll{Prev,Next}Siblings (@JLHwung)

babel-plugin-transform-block-scoping

#18194 fix: improve for loop closure environment check (@JLHwung)

#18193 fix: assign closure body after handling return (@JLHwung)

#18088 Fix initialization of nested for loop head declarations (@journey-ad)

babel-generator

#18202 fix(generator): keep parens for ?. chain in tag (@JLHwung)

babel-register

#18137 fix(babel-register): preserve app-managed graceful shutdown (@jibin7jose)

Other

#18140 chore: fix @babel/eslint-plugin peer deps (@JLHwung)

babel-cli, babel-helper-transform-fixture-test-runner, babel-register

#18131 fix(register): do not inherit parent execArgv (@JLHwung)

babel-standalone

#18095 Add types for @babel/standalone (@liuxingbaoyu)

📝 Documentation

#18187 Add AI policy (@nicolo-ribaudo)

🏠 Internal

babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env

#18145 refactor: replace semver with verkit (@sxzz)

babel-node

#18177 Update node flags list (@nicolo-ribaudo)

babel-types

#18103 Simplify AST validators (@fisker)

🏃‍♀️ Performance

babel-parser

... (truncated)

Commits

0d8ed70 v8.0.5
4cea20d Use built-in glob in Node.js (#18097)
1eac448 refactor: replace semver with verkit (#18145)
61bfda5 chore: Update prettier v3.9 (#18147)
6ce28e1 Add whitespace in source-map-visual tests (#18138)
e441e7a fix: Remove isTSX from babel-plugin-syntax-typescript types (#18089)
See full diff in compare view

Updates @babel/types from 8.0.4 to 8.0.5

Release notes

Sourced from @babel/types's releases.

v8.0.5 (2026-09-10)

Thanks @drubetti, @jibin7jose, @joelle-a-dev, @journey-ad, @Kjubikstronk, @MatteoGabriele, and @zhangli091011 for your first PRs!

👓 Spec Compliance

babel-parser

#18218 fix(parser): do not form html entity for invalid codepoint (@JLHwung)

🐛 Bug Fix

babel-parser

#18215 fix(parser): remove non-decimal prefix from bigint (@JLHwung)

#18063 Disallow new import prop access (@JLHwung)

babel-plugin-transform-destructuring

#18214 fix: only collapse the empty-object check when it targets the declared binding (@Kjubikstronk)

babel-plugin-transform-typescript

#18190 fix(ts): improve variable handling in namespace (@JLHwung)

#18207 [ts] Allow merging enum into a namespace (@nicolo-ribaudo)

babel-node

#18217 Fix import path for babel-node.js (@drubetti)

babel-plugin-bugfix-safari-rest-destructuring-rhs-array

#18213 fix(bugfix): bound check before array access (@JLHwung)

babel-traverse

#18183 fix(remove): unwrap single sequence expression (@JLHwung)

#18153 Handle null in getAll{Prev,Next}Siblings (@JLHwung)

babel-plugin-transform-block-scoping

#18194 fix: improve for loop closure environment check (@JLHwung)

#18193 fix: assign closure body after handling return (@JLHwung)

#18088 Fix initialization of nested for loop head declarations (@journey-ad)

babel-generator

#18202 fix(generator): keep parens for ?. chain in tag (@JLHwung)

babel-register

#18137 fix(babel-register): preserve app-managed graceful shutdown (@jibin7jose)

Other

#18140 chore: fix @babel/eslint-plugin peer deps (@JLHwung)

babel-cli, babel-helper-transform-fixture-test-runner, babel-register

#18131 fix(register): do not inherit parent execArgv (@JLHwung)

babel-standalone

#18095 Add types for @babel/standalone (@liuxingbaoyu)

📝 Documentation

#18187 Add AI policy (@nicolo-ribaudo)

🏠 Internal

babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env

#18145 refactor: replace semver with verkit (@sxzz)

babel-node

#18177 Update node flags list (@nicolo-ribaudo)

babel-types

#18103 Simplify AST validators (@fisker)

... (truncated)

Changelog

Sourced from @babel/types's changelog.

v8.0.5 (2026-09-10)

👓 Spec Compliance

babel-parser

#18218 fix(parser): do not form html entity for invalid codepoint (@JLHwung)

🐛 Bug Fix

babel-parser

#18215 fix(parser): remove non-decimal prefix from bigint (@JLHwung)

#18063 Disallow new import prop access (@JLHwung)

babel-plugin-transform-destructuring

#18214 fix: only collapse the empty-object check when it targets the declared binding (@Kjubikstronk)

babel-plugin-transform-typescript

#18190 fix(ts): improve variable handling in namespace (@JLHwung)

#18207 [ts] Allow merging enum into a namespace (@nicolo-ribaudo)

babel-node

#18217 Fix import path for babel-node.js (@drubetti)

babel-plugin-bugfix-safari-rest-destructuring-rhs-array

#18213 fix(bugfix): bound check before array access (@JLHwung)

babel-traverse

#18183 fix(remove): unwrap single sequence expression (@JLHwung)

#18153 Handle null in getAll{Prev,Next}Siblings (@JLHwung)

babel-plugin-transform-block-scoping

#18194 fix: improve for loop closure environment check (@JLHwung)

#18193 fix: assign closure body after handling return (@JLHwung)

#18088 Fix initialization of nested for loop head declarations (@journey-ad)

babel-generator

#18202 fix(generator): keep parens for ?. chain in tag (@JLHwung)

babel-register

#18137 fix(babel-register): preserve app-managed graceful shutdown (@jibin7jose)

Other

#18140 chore: fix @babel/eslint-plugin peer deps (@JLHwung)

babel-cli, babel-helper-transform-fixture-test-runner, babel-register

#18131 fix(register): do not inherit parent execArgv (@JLHwung)

babel-standalone

#18095 Add types for @babel/standalone (@liuxingbaoyu)

📝 Documentation

#18187 Add AI policy (@nicolo-ribaudo)

🏠 Internal

babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env

#18145 refactor: replace semver with verkit (@sxzz)

babel-node

#18177 Update node flags list (@nicolo-ribaudo)

babel-types

#18103 Simplify AST validators (@fisker)

🏃‍♀️ Performance

babel-parser

... (truncated)

Commits

0d8ed70 v8.0.5
1da3cfa Enable no-useless-computed-key rule (#18179)
d8b1262 fix: Define child node types correctly (#18159)
e74e391 Simplify AST validators (#18103)
61bfda5 chore: Update prettier v3.9 (#18147)
See full diff in compare view

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

... (truncated)

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Updates inquirer from 14.0.2 to 14.2.2

Release notes

Sourced from inquirer's releases.

inquirer@14.2.2

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).

confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

@inquirer/core@^12.0.3

@inquirer/prompts@^8.7.2

inquirer@14.2.1

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Published manifests now pin @inquirer/type to an exact version. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

@inquirer/core@^12.0.2

@inquirer/prompts@^8.7.1

@inquirer/type@4.1.1 (pinned exactly)

@inquirer/ansi@^2.0.8

inquirer@14.2.0

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Updated to @inquirer/prompts@^8.7.0 and @inquirer/core@^12.0.1.

Includes the new toggleMask option for password (ctrl+t to reveal), localized yes/no parsing for confirm, and prettified prompt/theme types for better IDE display.

Included

@inquirer/core@^12.0.1

@inquirer/prompts@^8.7.0

@inquirer/type@^4.1.0

@inquirer/ansi@^2.0.7

inquirer@14.1.0

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

... (truncated)

Commits

cbdb34b chore: Publish new release
8340d2d fix(@inquirer/core): clear hook effects before settling prompts
2475e07 test(@inquirer/core): cover hook cleanup error semantics
15cd8d3 fix(confirm): ignore surrounding whitespace in answers
9cb0da6 chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9
1c750bc chore(deps-dev): Bump the build group with 3 updates (#2251)
81f1525 chore(deps-dev): Bump @types/node in the types group (#2252)
7c27f26 chore(deps-dev): Bump oxfmt in the formatting group (#2249)
6119088 chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (#2250)
0d167c0 chore(deps-dev): Bump the linting group with 4 updates (#2248)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for inquirer since your current version.

Updates yargs from 18.0.0 to 18.1.0

Changelog

Sourced from yargs's changelog.

18.1.0 (2026-07-26)

Features

ignore bun when getting bin name (b77831c)

Bug Fixes

lang: 'count' for de locale (#2476) (971e351)

local prototype pollution vulnerability in apply-extends (437f3a4)

locale: add Georgian translation (#2474) (086aeaa)

17.7.3 (2026-06-19)

Bug Fixes

fix: use entry point with file extension for anything that supports exports (#2514) (c7597e3)

16.2.2 (2026-06-19)

Bug Fixes

fix: use entry point with .cjs file extension for yargs export (#2546) (6feb819)

Commits

8878a89 chore(main): release 18.1.0 (#2475)
db916b4 chore: add workflow_dispatch for release-please (#2564)
4153e0f chore: improve build robustness (#2554)
186d2e6 docs: clarify nargs option-like values (#2551)
c615633 docs: fix various typos in source code (#2525)
7c76d0a docs: fix broken links in api.md (#2549)
37e2e5b chore: fix .wrap() docs (#2493)
547e300 chore: update the easy dependencies (#2552)
e086681 chore(deps): update dependency cross-env to v10 (#2480)
88f548c chore: fix typos (#2492)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by shadowspawn, a new releaser for yargs since your current version.

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

fix(server): prioritize zod issues and format them by @mozmo15 in modelcontextprotocol/typescript-sdk#1503

chore(ci): switch publish to OIDC trusted publishing by @felixweinberger in modelcontextprotocol/typescript-sdk#1839

Add end-to-end test suite by @felixweinberger in modelcontextprotocol/typescript-sdk#2167

v1 stdio buffer limit by @KKonstantinov in modelcontextprotocol/typescript-sdk#2239

fix: support Zod 3.25 method literals by @mattzcarey in modelcontextprotocol/typescript-sdk#2368

Validate Content-Type by parsed media type instead of substring match (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2444

fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @mattzcarey in modelcontextprotocol/typescript-sdk#2538

fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 by @arimu1 in modelcontextprotocol/typescript-sdk#2549

Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2547

chore: bump version to 1.30.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

@mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503

@arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

2d889f2 chore: bump version to 1.30.0 (#2563)
e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
bb5a718 fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
369513d fix: support Zod 3.25 method literals (#2368)
e7ee57c v1 stdio buffer limit (#2239)
c36e1ef Add end-to-end test suite (#2167)
bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
9edbab7 fix(server): prioritize zod issues and format them (#1503)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @modelcontextprotocol/sdk since your current version.

Updates zod from 4.4.3 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585

… with 10 updates Bumps the production-minor-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `8.0.1` | `8.0.5` | | [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` | | [inquirer](https://github.com/SBoudrias/Inquirer.js) | `14.0.2` | `14.2.2` | | [yargs](https://github.com/yargs/yargs) | `18.0.0` | `18.1.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.2` | | [sass](https://github.com/sass/dart-sass) | `1.101.0` | `1.104.0` | | [memfs](https://github.com/streamich/memfs) | `4.57.8` | `4.75.0` | | [webpack](https://github.com/webpack/webpack) | `5.108.3` | `5.110.3` | Updates `@babel/core` from 8.0.1 to 8.0.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.5/packages/babel-core) Updates `@babel/types` from 8.0.4 to 8.0.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.5/packages/babel-types) Updates `axios` from 1.18.1 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.20.0) Updates `inquirer` from 14.0.2 to 14.2.2 - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/inquirer@14.0.2...inquirer@14.2.2) Updates `yargs` from 18.0.0 to 18.1.0 - [Release notes](https://github.com/yargs/yargs/releases) - [Changelog](https://github.com/yargs/yargs/blob/main/CHANGELOG.md) - [Commits](yargs/yargs@v18.0.0...v18.1.0) Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0) Updates `zod` from 4.4.3 to 4.6.2 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.6.2) Updates `sass` from 1.101.0 to 1.104.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.101.0...1.104.0) Updates `memfs` from 4.57.8 to 4.75.0 - [Release notes](https://github.com/streamich/memfs/releases) - [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md) - [Commits](streamich/memfs@v4.57.8...v4.75.0) Updates `webpack` from 5.108.3 to 5.110.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.108.3...v5.110.3) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 8.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: "@babel/types" dependency-version: 8.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: inquirer dependency-version: 14.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: yargs dependency-version: 18.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: zod dependency-version: 4.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: sass dependency-version: 1.104.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: memfs dependency-version: 4.75.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: webpack dependency-version: 5.110.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026

Navigation Menu

build(deps): bump the production-minor-patch group across 1 directory with 10 updates - #51

build(deps): bump the production-minor-patch group across 1 directory with 10 updates#51
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-54fdbf287e

dependabot Bot commented on behalf of github Sep 15, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v8.0.5 (2026-09-10)

👓 Spec Compliance

🐛 Bug Fix

📝 Documentation

🏠 Internal

v8.0.5 (2026-09-10)

👓 Spec Compliance

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

v8.0.5 (2026-09-10)

👓 Spec Compliance

🐛 Bug Fix

📝 Documentation

🏠 Internal

v8.0.5 (2026-09-10)

👓 Spec Compliance

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 - July 22, 2026

🔒 Security Fixes

Changelog

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

inquirer@14.2.2

What's new

Included

inquirer@14.2.1

What's new

Included

inquirer@14.2.0

What's new

Included

inquirer@14.1.0

What's new

18.1.0 (2026-07-26)

Features

Bug Fixes

17.7.3 (2026-06-19)

Bug Fixes

16.2.2 (2026-06-19)

Bug Fixes

1.30.0

What's Changed

New Contributors

v4.6.2

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 15, 2026 •

edited

Loading