[dependabot]

Bumps the npm-minor-patch group with 5 updates:

Package	From	To
@modelcontextprotocol/sdk	1.32.1	1.32.2
@opencode-ai/sdk	1.3.13	1.19.5
ignore	7.0.13	7.0.14
rollup	4.65.0	4.66.0
typescript-eslint	8.72.0	8.72.1

Updates @modelcontextprotocol/sdk from 1.32.1 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @​kishormorol in modelcontextprotocol/typescript-sdk#2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in modelcontextprotocol/typescript-sdk#2958
• chore: bump version to 1.32.2 by @​claude[bot] in modelcontextprotocol/typescript-sdk#3089

New Contributors

• @​kishormorol made their first contribution in modelcontextprotocol/typescript-sdk#2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

Commits

• 3b73021 chore: bump version to 1.32.2 (#3089)
• fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
• 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
• See full diff in compare view

Updates @opencode-ai/sdk from 1.3.13 to 1.19.5

Commits

• See full diff in compare view

Updates ignore from 7.0.13 to 7.0.14

Commits

• edbaa52 bump version 7.0.14
• 92c4cb7 test: compare checkIgnore() with git check-ignore -v line for line
• c0f0de9 fix: report the last rule to match, as git check-ignore -v does
• e5151b3 fix: let checkIgnore("dir/") read "//" as "/" does
• 6e6ce57 docs: say exactly what .checkIgnore() shares with git check-ignore -v
• 3c36daa fix: let "/" match every path, as "" does
• 8a910fc test: move [[:cntrl:]] into the fixtures, and drop a test git already covers
• ed46624 test: compare the three skipped fixtures with git too
• d990dc5 test: check #175's trailing run against git, through re-inclusion
• 8b3466b docs, test: finish #175 -- say what git does with a run of asterisks
• Additional commits viewable in compare view

Updates rollup from 4.65.0 to 4.66.0

Release notes

Sourced from rollup's releases.

v4.66.0

4.66.0

2026-10-28

Features

• Support null sources in plugin-generated sourcemaps (#6600)
• Support plugin-generated "index" sourcemaps (#6601)

Bug Fixes

• Preserve rendering errors when the rendereError hook fails (#6602)

Pull Requests

• #6600: Treat null sources in plugin sourcemaps as unmapped (@​wleeaf, @​lukastaegert)
• #6601: Flatten index sourcemaps returned by plugins (@​wleeaf, @​lukastaegert)
• #6602: Preserve rendering errors when renderError fails (@​shuaiyafei)

v4.65.1

4.65.1

2026-10-26

Bug Fixes

• Ensure tree-shaking also respect Symbol.dispose for async disposal (#6556)

Pull Requests

• #6556: Fix tree-shaking of disposable resources (@​TrickyPi, @​lukastaegert)
• #6595: Update dtolnay/rust-toolchain digest to b725eda (@​renovate[bot])
• #6596: Update minor/patch updates (@​renovate[bot])
• #6598: Lock file maintenance (@​renovate[bot], @​lukastaegert)

Changelog

Sourced from rollup's changelog.

4.66.0

2026-10-28

Features

• Support null sources in plugin-generated sourcemaps (#6600)
• Support plugin-generated "index" sourcemaps (#6601)

Bug Fixes

• Preserve rendering errors when the rendereError hook fails (#6602)

Pull Requests

• #6600: Treat null sources in plugin sourcemaps as unmapped (@​wleeaf, @​lukastaegert)
• #6601: Flatten index sourcemaps returned by plugins (@​wleeaf, @​lukastaegert)
• #6602: Preserve rendering errors when renderError fails (@​shuaiyafei)

4.65.1

2026-10-26

Bug Fixes

• Ensure tree-shaking also respect Symbol.dispose for async disposal (#6556)

Pull Requests

• #6556: Fix tree-shaking of disposable resources (@​TrickyPi, @​lukastaegert)
• #6595: Update dtolnay/rust-toolchain digest to b725eda (@​renovate[bot])
• #6596: Update minor/patch updates (@​renovate[bot])
• #6598: Lock file maintenance (@​renovate[bot], @​lukastaegert)

Commits

• 4de8104 4.66.0
• 9414afb Flatten index sourcemaps returned by plugins (#6601)
• ad4ded9 Preserve rendering errors when renderError fails (#6602)
• 6a498da Treat null sources in plugin sourcemaps as unmapped (#6600)
• 5c9f728 Resolve audit
• 7879c65 4.65.1
• 5ac3170 Fix tree-shaking of disposable resources (#6556)
• 7726f83 Lock file maintenance (#6598)
• 55fdf3b Update dtolnay/rust-toolchain digest to b725eda (#6595)
• 2d7e206 Update minor/patch updates (#6596)
• See full diff in compare view

Updates typescript-eslint from 8.72.0 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Helweg]

Automated PR review

Reviewed head b205b3909de6f6c40046c6303ad373c20a8d70af against base e3f4899145d2422351c431e31f4ac34b2dbe196a.

Finding

P2 — Keep the runtime SDK compatible with the pinned OpenCode plugin declarations (package.json:107). Updating @opencode-ai/sdk to 1.19.5 while retaining @opencode-ai/plugin@1.3.13 splits the SDK versions: the lockfile now nests SDK 1.3.13 under the build-only plugin, but published declarations resolve the runtime SDK 1.19.5. A TypeScript consumer using the pinned OpenCode host types can no longer assign the exported plugin.server to import("@opencode-ai/plugin").Plugin. Existing packed-consumer CI reports TS2322, including incompatible client.postSessionIdPermissionsPermissionId(...) return types, on both Node 22 and Node 24. Retain SDK 1.3.13 for this group update, or migrate the plugin/declaration contract together and preserve the existing packed-consumer assignability check.

Scope and verification

• Inspected both complete changed files at the exact revisions, including the full lockfile delta, runtime/dev scope, overrides, engine/peer requirements, Rollup platform-package alignment, and OpenCode declaration/build/consumer paths. Consulted primary upstream release/change evidence and published SDK declarations. No additional actionable findings identified.
• Observed CI: both main test jobs fail at Smoke-test packed CLI and TypeScript consumer identities; subsequent typecheck, lint, coverage and evaluation steps are skipped. All six path-semantics jobs pass. Build TypeScript and Rust build/tests pass in both main jobs.
• Static review and observed CI only; candidate code/tests were not executed. Later checks and runtime compatibility remain unverified; this is not an approval.