chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.30.0 in the mcp-sdk group - #5745
chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.30.0 in the mcp-sdk group#5745dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the mcp-sdk group with 1 update: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: mcp-sdk ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: do not merge — 3/10 merge safety for this PR
The stated bump (@modelcontextprotocol/sdk 1.29.0 → 1.30.0) is already on main. This PR does not change pnpm-workspace.yaml (catalog remains ^1.30.0) and does not change the resolved catalog version (still 1.30.0). GitHub’s file list is lockfile-only.
Close this PR (or @dependabot recreate only if a real catalog/lock drift remains). Merging it would land ~959 lines of pnpm peer-snapshot rekeying plus an undeclared happy-dom patch alignment, on a branch already 11 commits behind main.
What this diff actually does
| Surface | Before (merge-base) | This PR |
|---|---|---|
| Catalog pin | ^1.30.0 → 1.30.0 |
unchanged |
Dashboard / ts-framework/* |
1.30.0 |
still 1.30.0, snapshot key now includes optional @cfworker/json-schema |
shadcn@4.13.0 (transitive) |
1.29.0 |
still 1.29.0 |
happy-dom (vitest graphs) |
mixed 20.11.1 + 20.11.2 |
all 20.11.2 |
The catalog bump landed in #5690 (b482d2478), not here. Dependabot’s title/body are stale.
No npm specifiers, no application code, no changeset. Authoritative pnpm is 11.19.0 with autoInstallPeers: false; Dependabot’s lockfile rewrite is peer-key churn (msw attached to vitest snapshots, peer argument reorder), not a real SDK upgrade.
If 1.29.0 → 1.30.0 were still pending: 8/10 for that bump
Minor, API-additive. No code migration required. Relevant 1.30.0 behavior vs this repo:
- 10 MB stdio
ReadBufferdefault (typescript-sdk#2239) — overflow errors and closes the transport. Hosted MCP is Go. TS stdio isnew StdioServerTransport()in function templates and examples. RaisemaxBufferSizeonly if a single JSON-RPC line can exceed 10 MB. - Content-Type parsed media type (typescript-sdk#2444) — correctness fix. Consent UI uses
StreamableHTTPClientTransport; Go handlers already sendapplication/json/application/json; charset=utf-8, which parse asapplication/json. - Zod issue formatting — error text only. Functions wrap MCP via
InMemoryTransportand already depend on zod 4; 1.30.0 adds peerzod: ^3.25 \|\| ^4.0, which this repo satisfies. - SSE keep-alive on Streamable HTTP server transport — bugfix. Not the production Go path; only the pizzaz example uses
StreamableHTTPServerTransport. @hono/node-serverrange widened past GHSA-frvp-7c67-39w9 — lock still resolves1.19.15.- Supply chain: npm publisher is now GitHub Actions OIDC. Expected for this package; not a blocker.
examples/* stay on ^1.20.1 / ^1.24.2 (outside the workspace catalog). That is pre-existing, not this PR.
Rating
- Merging this PR: 3/10 — stale, misleading, lockfile noise, incidental
happy-domchange. Close it. - The 1.30.0 SDK itself: 8/10 — already on
main; no migration. Residual risk is stdio 10 MB in templates/examples only.
Sent by Cursor Automation: Review Dependabot PRs
| @@ -601,7 +601,7 @@ importers: | |||
| version: link:../functions | |||
| '@modelcontextprotocol/sdk': | |||
| specifier: 'catalog:' | |||
| version: 1.30.0(zod@4.4.3) | |||
| version: 1.30.0(@cfworker/json-schema@4.1.1)(zod@4.4.3) | |||
There was a problem hiding this comment.
This is not a 1.29.0 → 1.30.0 bump. ts-framework/create-function (and functions at the next importer) already resolved 1.30.0(zod@4.4.3) on the merge-base / current main. The only change is attaching the optional @cfworker/json-schema peer to the snapshot key.
Catalog pin in pnpm-workspace.yaml is already ^1.30.0 (from #5690). First-party packages do not need this lockfile rewrite to be on 1.30.0.
| dependencies: | ||
| '@babel/core': 7.29.7 | ||
| '@babel/parser': 7.29.7 | ||
| '@babel/plugin-transform-typescript': 7.29.7(@babel/core@7.29.7) | ||
| '@babel/preset-typescript': 7.29.7(@babel/core@7.29.7) | ||
| '@dotenvx/dotenvx': 1.75.1 | ||
| '@modelcontextprotocol/sdk': 1.29.0 | ||
| '@modelcontextprotocol/sdk': 1.29.0(@cfworker/json-schema@4.1.1) |
There was a problem hiding this comment.
shadcn@4.13.0 still depends on @modelcontextprotocol/sdk@1.29.0. This PR only changes the snapshot key (1.29.0 → 1.29.0(@cfworker/json-schema@4.1.1)). The mcp-sdk Dependabot group cannot lift a transitive pin inside shadcn.
If the goal is a single SDK version in the tree, that is a pnpm.overrides / shadcn upgrade — not this PR.
| @@ -14598,12 +14673,42 @@ snapshots: | |||
| why-is-node-running: 2.3.0 | |||
| optionalDependencies: | |||
| '@types/node': 22.20.0 | |||
| happy-dom: 20.11.1 | |||
| happy-dom: 20.11.2 | |||
There was a problem hiding this comment.
Undeclared extra bump: this vitest graph moves happy-dom 20.11.1 → 20.11.2 (and starts recording the optional msw peer on vitest snapshots). That is lockfile regeneration side-effect, not part of the mcp-sdk group.
Do not merge incidental test-runtime patches inside a Dependabot SDK PR. If 20.11.1 should be dropped, do it in a dedicated lockfile/vitest change.
|
@dependabot ignore @modelcontextprotocol/sdk 1.29.0 |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
1 participant
Bumps the mcp-sdk group with 1 update: @modelcontextprotocol/sdk.
Updates
@modelcontextprotocol/sdkfrom 1.29.0 to 1.30.0Release notes
Sourced from @modelcontextprotocol/sdk's releases.
Commits
2d889f2chore: bump version to 1.30.0 (#2563)e3f3daaFix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...bb5a718fix(deps): widen@hono/node-serverpast GHSA-frvp-7c67-39w9 (#2549)1dad263fix: send SSE keep-alive comment frames from Streamable HTTP server transport...69749aaValidate Content-Type by parsed media type instead of substring match (v1.x) ...369513dfix: support Zod 3.25 method literals (#2368)e7ee57cv1 stdio buffer limit (#2239)c36e1efAdd end-to-end test suite (#2167)bf1e022chore(ci): switch publish to OIDC trusted publishing (#1839)9edbab7fix(server): prioritize zod issues and format them (#1503)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@modelcontextprotocol/sdksince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions