Repository navigation
chore: bump @modelcontextprotocol/sdk from 1.30.1 to 1.32.1 - #79
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.30.1 to 1.32.1. - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.30.1...1.32.1) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Claude finished @dependabot[bot]'s task in 1m 20s —— View job Dependency review:
|
| Release | Change | Affects this repo? |
|---|---|---|
| 1.31.0 | Stored OAuth tokens/client info gain an issuer field; expectedIssuer now expected on ClientCredentialsProvider / PrivateKeyJwtProvider / StaticPrivateKeyJwtProvider |
No — no OAuth provider anywhere; auth is a KOSLI_API_TOKEN bearer header built in src/client/kosli-client.ts |
| 1.32.0 | HTTP client transports follow redirects only within the same origin unless redirectPolicy: 'follow' |
No — src/index.ts:8 connects a StdioServerTransport; tests use InMemoryTransport. Neither StreamableHTTPClientTransport nor SSEClientTransport is imported |
| 1.32.0 | New maxToolInputElements on McpServer |
No — opt-in, and new McpServer({name, version}) (src/server.ts:33) doesn't set it. See follow-up below |
| 1.32.0 | New expectedResource on requireBearerAuth |
No — this is an MCP server over stdio, no bearer-auth middleware |
| 1.32.0 | In-memory task store scopes tasks to the creating session | No — tasks API unused |
| 1.32.0 | tools/call / prompts/get now accepted when arguments is omitted (#2045) |
Marginal — see below |
| 1.32.1 | Docs only | No |
The one behaviour change worth a thought
#2045 makes the SDK accept a tools/call that omits arguments entirely, rather than rejecting it at the protocol layer. All three tools in src/server.ts have at least one non-optional input (query for search_actions, actionId for both execute tools), so a no-arguments call still fails zod validation — it just fails one layer later, as a tool error instead of a protocol error. No behavioural difference that matters here, but it's the only change that reaches code this repo exercises. test/server.test.ts drives the real tools over InMemoryTransport, so CI covers it.
Lockfile hygiene
The diff is exactly 3 lines — version, resolved, integrity. The SDK's own dependency and peer-dependency ranges are unchanged, so no transitive package moved (zod stays at 4.3.6). Nothing to audit beyond the SDK itself.
Follow-ups (not blockers, not for this PR)
zodis imported but not declared.src/server.ts:2doesimport { z } from "zod", yetzodappears nowhere inpackage.json— it resolves only because the SDK declares it as a required peer (^3.25 || ^4.0) that npm auto-installs. That range spans two majors, so a future SDK bump or a lockfile regeneration could silently hand this repo a different zod major with a different API. Declaring it directly pins the contract this code actually depends on. Fix this →maxToolInputElementsis a free hardening win.execute_read_action/execute_write_actionacceptparams: z.record(z.string(), z.unknown())— an unbounded object that goes straight into a querystring or JSON body. Capping element count at theMcpServerlevel bounds that without touching the catalog-driven design.
What I could not verify
npm ci isn't permitted in this sandbox, so I did not build or run the test suite against 1.32.1 locally — the analysis above is from the lockfile, the release notes, and the source. ci.yml covers build + test + the .mcpb smoke test on the Node matrix; merge on its result, not on this review. (To let me verify locally in future runs, add Bash(npm ci), Bash(npm run build) and Bash(npm test) to the review job's --allowedTools.)
· branch
Bumps @modelcontextprotocol/sdk from 1.30.1 to 1.32.1.
Release notes
Sourced from @modelcontextprotocol/sdk's releases.
Commits
ff07b00chore: bump version to 1.32.1 (#2954)8a74d50[v1.x] docs: point the README at v2 and say what v1.x supports (#2942)a8cf503[v1.x] docs: state the principles in CLAUDE.md (#2939)32549b0chore: bump version to 1.32.0 (#2935)588d51d[v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)5a0724d[v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)0ca0b62[v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...fd26801[v1.x] feat(server): add maxToolInputElements option to limit the number of e...727075b[v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...0ff6377[v1.x] examples: close idle sessions and cap the session map (#2914)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)