chore(deps): bump @ai-sdk/mcp from 1.0.52 to 2.0.3

[dependabot]

Bumps @ai-sdk/mcp from 1.0.52 to 2.0.3.

Release notes

Sourced from @​ai-sdk/mcp's releases.

@​ai-sdk/mcp@​2.0.3

Patch Changes

• 68a739a: feat(mcp): allow MCP client to use server completions
• Updated dependencies [6a436e3]
  • @​ai-sdk/provider-utils@​5.0.1

@​ai-sdk/mcp@​2.0.2

Patch Changes

• ba6d510: chore: fix deprecated use of zod .passthrough()

@​ai-sdk/mcp@​1.0.55

Patch Changes

• 3d0bd52: feat(mcp): allow MCP client to use server completions
• Updated dependencies [b30e43a]
  • @​ai-sdk/provider-utils@​4.0.33

Changelog

Sourced from @​ai-sdk/mcp's changelog.

2.0.3

Patch Changes

• 68a739a: feat(mcp): allow MCP client to use server completions
• Updated dependencies [6a436e3]
  • @​ai-sdk/provider-utils@​5.0.1

2.0.2

Patch Changes

• ba6d510: chore: fix deprecated use of zod .passthrough()

2.0.1

Patch Changes

• 241a8c5: Add Streamable HTTP session hooks, cached initialize metadata, and detach-on-close support for reattaching to MCP sessions.

2.0.0

Major Changes

• 23fa161: fix(mcp): setting redirect: error for MCP transport
• ef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers using require() must switch to ESM import syntax.
• 8359612: Start v7 pre-release

Patch Changes

• b79094c: Add resource_link content type to CallToolResultSchema and PromptMessageSchema per MCP spec. Fixes hard rejection when MCP servers return resource_link content parts with zod ≥ 4.4.x.

• 78e0023: fix(mcp): await addClientAuthentication in token exchange and refresh

• b567a6c: dependency updates

• e33ad0b: fix(mcp): add optional hook to validate authorization servers

• e3ea484: fix(mcp): bypass outputSchema validation when tool returns isError

• 93afb28: feat(mcp): expose server instructions to be accessible through client

• a00d1d3: feat(mcp): allow custom fetch for HTTP and SSE transports

• a98bf66: feat(mcp): surface 'serverInfo' exposed from the MCP server

• 2a150f8: fix(mcp): lock first sse endpoint received via event

• 2655da8: fix(mcp): use negotiated protocol version in transport request headers

• 9f0e36c: trigger release for all packages after provenance setup

• f7bc0b4: feat(mcp): expose statusCode, url, and responseBody on MCPClientError for HTTP transport failures

  MCPClientError now carries structured HTTP context when it originates from the streamable HTTP transport. This lets downstream consumers (e.g. agent frameworks that need to decide whether to fall back from streamable HTTP to legacy SSE transport per the MCP spec) branch on the actual response status without parsing the error message string.

  Fields are optional — they remain undefined for stdio transport errors and for

... (truncated)

Commits

• 62fc7d6 Version Packages (#16443)
• 68a739a feat(mcp): allow MCP client to use server completions (#16420)
• 53dfdc3 Version Packages (#16425)
• ba6d510 chore: fix deprecated use of zod .passthrough() (#16422)
• 0f72e78 Version Packages (#16418)
• 241a8c5 Add MCP HTTP session hooks (#16399)
• 5d105f2 docs: update onFinish to onEnd (#16398)
• 77c6abb v7 release (#16357)
• 207d63a Version Packages (beta) (#16309)
• 96e2478 Version Packages (beta) (#16143)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[krishagel]

🤖 pr-fix routine — stuck: lockfile out of sync + protected workflow file

Root cause 1 (Test, Lint, and Type Check, Validate CDK Infrastructure): both fail at the same step:

error: lockfile had changes, but lockfile is frozen
note: try re-running without --frozen-lockfile and commit the updated lockfile

Dependabot bumped @ai-sdk/mcp from 1.0.52 → 2.0.3 in package.json (note: this is a major version bump — v2.0.0 removed CommonJS exports, ESM-only now), but bun.lockb was not regenerated to match.

Why the routine can't fix it: npm registry access (registry.npmjs.org) is blocked in this cloud routine's egress policy (confirmed: curl to the registry returns 403), so bun install cannot resolve packages and regenerate the lockfile here.

How to fix (~30 seconds, from a machine with registry access):

git fetch origin dependabot/npm_and_yarn/dev/ai-sdk/mcp-2.0.3
git checkout dependabot/npm_and_yarn/dev/ai-sdk/mcp-2.0.3
bun install
git add bun.lockb
git commit -m "chore: update bun.lockb for @ai-sdk/mcp 2.0.3"
git push

Given the major version bump, it's also worth a quick check that nothing in the codebase imports @ai-sdk/mcp via require() (CommonJS), since that would now break.

Root cause 2 (claude-review): fails independently with:

Action failed with error: Workflow initiated by non-human actor: dependabot (type: Bot). Add bot to allowed_bots list or use '*' to allow all bots.

Fixing this requires editing .github/workflows/** (the claude-review workflow's allowed_bots config), which is a protected path this autonomous routine cannot modify.

Note: this is the same lockfile-sync pattern already identified on the other open Dependabot PRs in this repo (#1080, #1079, #1078, #1077, #1076, #1075, #1074, #1073, #1071, #1070) — running bun install + committing bun.lockb on each branch (plus fixing the claude-review bot-actor policy once) would unblock all of them.

The routine will not pick this PR up again until someone removes the pr-fix-stuck label.

---

Generated by Claude Code

[dependabot]

Superseded by #1218.