Bump the npm group across 3 directories with 6 updates by dependabot[bot] · Pull Request #253 · modelcontextprotocol/quickstart-resources

dependabot · 2026-10-14T23:35:20Z

Bumps the npm group with 4 updates in the /mcp-client-typescript directory: @anthropic-ai/sdk, @modelcontextprotocol/client, dotenv and @types/node.
Bumps the npm group with 4 updates in the /tests/helpers directory: @modelcontextprotocol/client, @types/node, @modelcontextprotocol/server and zod.
Bumps the npm group with 3 updates in the /weather-server-typescript directory: @types/node, @modelcontextprotocol/server and zod.

Updates @anthropic-ai/sdk from 0.131.0 to 0.133.0

Release notes

Sourced from @anthropic-ai/sdk's releases.

sdk-v0.133.0

Features

api: add types for the Chat and Cowork unified analytics metrics

api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

internal: remove the next branch rule from CLAUDE.md

sdk-v0.132.1

Bug Fixes

client: throw before sending a request with an empty path parameter

Chores

ci: check that pull requests update the changelog

ci: publish every package from the publish workflow

docs: note that listing Claude Console spend limits is in early access

Documentation

split CLAUDE.md into shared, TypeScript, and repository rules

sdk: v0.132.0

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)

api: add disabled to thinking types in model capabilities (2b75b49)

api: add display_name to RBAC roles and deprecate name (7735ac3)

api: add include_default parameter to list workspaces (c4019df)

api: add lifecycle stage fields and filter to /v1/models (fe8a762)

api: add line to model objects (018aed4)

api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)

api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

api: send the beta header by default when listing spend limits (8f58ca4)

client: throw when a JSONL stream is iterated twice (a34266c)

tools: keep a local edit made after a memory upload whose response was lost (#893) (2b75b49)

... (truncated)

Changelog

Sourced from @anthropic-ai/sdk's changelog.

0.133.0 (2026-10-09)

Features

api: add types for the Chat and Cowork unified analytics metrics

api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

internal: remove the next branch rule from CLAUDE.md

0.132.1 (2026-10-08)

Bug Fixes

client: throw before sending a request with an empty path parameter

Chores

ci: check that pull requests update the changelog

ci: publish every package from the publish workflow

docs: note that listing Claude Console spend limits is in early access

Documentation

split CLAUDE.md into shared, TypeScript, and repository rules

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)

api: add disabled to thinking types in model capabilities (2b75b49)

api: add display_name to RBAC roles and deprecate name (7735ac3)

api: add include_default parameter to list workspaces (c4019df)

api: add lifecycle stage fields and filter to /v1/models (fe8a762)

api: add line to model objects (018aed4)

api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)

api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

api: send the beta header by default when listing spend limits (8f58ca4)

client: throw when a JSONL stream is iterated twice (a34266c)

... (truncated)

Commits

2979ed5 release: . 0.133.0
8486d9b Merge pull request #908 from anthropics/synced/published
e0995e4 feat(api): add workflows, multiagent configuration and thread status filterin...
31eb3be codegen metadata
5127b32 codegen metadata
f702a46 codegen metadata
d64e976 codegen metadata
9f75465 codegen metadata
6ec2ea1 chore(internal): remove the next branch rule from CLAUDE.md
373c33d codegen metadata
Additional commits viewable in compare view

Updates @modelcontextprotocol/client from 2.2.0 to 2.3.1

Release notes

Sourced from @modelcontextprotocol/client's releases.

@modelcontextprotocol/client@2.3.1

Patch Changes

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/client@2.3.0

Minor Changes

#2901 433eb41 Thanks @claude! - The HTTP client transports and the OAuth client helpers now follow a redirect only when it stays within the origin of the request (same scheme, host and port, or http to https on the same host with default ports) and keeps the method (a 307 or 308, or any redirect of a GET). Any other redirect is not followed. A transport then fails the request with an error that names the target; the session is kept and later messages still send. OAuth metadata discovery moves on to the next well-known URL, and any other OAuth request fails with an error that gives the status. Same-origin redirects that keep the method keep working on Node, up to five in a row, and no code changes are needed there. If your endpoint redirects to another origin, configure the transport with the URL it redirects to. A requestInit.redirect of 'error' or 'manual' is passed to fetch as it is for the requests a transport sends to the server (POST, GET and DELETE of the Streamable HTTP transport, POST of the SSE transport); for its OAuth requests, and for any other value, requestInit.redirect is not consulted by default. Browsers do not expose the target of a redirect to a page, so there a redirected request fails instead of being followed. Setting redirectPolicy: 'follow' on a transport leaves its redirects to the fetch implementation, as before this change.

Patch Changes

#2599 5238fba Thanks @freya0926! - A server can now serve, and a client can now call, tasks/get and tasks/cancel of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when ctx.era === 'legacy'.

#2846 63c0fca Thanks @Sthreal! - Receiving a large message as a single SSE event over Streamable HTTP, such as a tool result of tens of megabytes, is now fast: a 50 MB result that took about 13 seconds arrives in under a second. The client now requires eventsource-parser 3.0.8 or later. SSEClientTransport reads through the eventsource package and gets the same speed-up once that also resolves eventsource-parser 3.0.8 or later.

#2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

#2903 e765b3b Thanks @claude! - With versionNegotiation in 'auto' or pin mode, a server/discover probe answered with a 2xx that carries no usable reply (a body that is not JSON under application/json, a bare 204, a missing or unaccepted content type) still rejects connect() with EraNegotiationFailed; an empty SSE stream or a 202 surfaces as the probe timeout instead. The message now says the server answered with an unusable reply (...) instead of reading like a network failure. To connect to a 2025 server behind a front that answers the probe this way, pass connect(transport, { prior: { kind: 'legacy' } }) or use mode: 'legacy'.

#2905 c0cd01a Thanks @claude! - SSEClientTransport now retries the SSE connection once after onUnauthorized() resolves, as documented. If the retry is also answered with 401, start() rejects with SdkHttpError (ClientHttpAuthentication) instead of calling onUnauthorized() again. A 401 on a later reconnect of a stream that had opened still gets one refresh.

Updated dependencies [633dd3e]:

@modelcontextprotocol/core@2.3.0

Commits

fcef852 Version Packages (#2953)
e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
3ab61c6 docs: update the README banners (#2940)
8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
33fecfb test(e2e): cover tools/call without arguments (#2933)
818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
a202a36 Version Packages (#2896)
2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
Additional commits viewable in compare view

Updates dotenv from 18.0.5 to 18.0.7

Changelog

Sourced from dotenv's changelog.

18.0.7 (2026-10-09)

Changed

Treat undefined settings like quiet: true as null rather than falsey (#1070)

CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

Use smarter parseBoolean not Boolean() to fix override (#1069)

Commits

2953207 18.0.7
9944723 make more readable for undefined -> null
d455db0 Merge branch 'master' of github.com:motdotla/dotenv
e411e02 changelog
6237c35 Merge pull request #1070 from Utkarsh-Singhal-26/fix/ignore-undefined-config-...
9af8c28 Merge pull request #1071 from himanshu748/fix-cli-env-quiet
c7161c6 fix(cli): honor quiet settings loaded from .env
3990466 fix: ignore undefined options so they don't mask DOTENV_* env settings
5d7cc39 18.0.6
750ba03 changelog
Additional commits viewable in compare view

Updates @types/node from 24.19.0 to 24.19.2

Commits

See full diff in compare view

Updates @modelcontextprotocol/client from 2.2.0 to 2.3.1

Release notes

Sourced from @modelcontextprotocol/client's releases.

@modelcontextprotocol/client@2.3.1

Patch Changes

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/client@2.3.0

Minor Changes

#2901 433eb41 Thanks @claude! - The HTTP client transports and the OAuth client helpers now follow a redirect only when it stays within the origin of the request (same scheme, host and port, or http to https on the same host with default ports) and keeps the method (a 307 or 308, or any redirect of a GET). Any other redirect is not followed. A transport then fails the request with an error that names the target; the session is kept and later messages still send. OAuth metadata discovery moves on to the next well-known URL, and any other OAuth request fails with an error that gives the status. Same-origin redirects that keep the method keep working on Node, up to five in a row, and no code changes are needed there. If your endpoint redirects to another origin, configure the transport with the URL it redirects to. A requestInit.redirect of 'error' or 'manual' is passed to fetch as it is for the requests a transport sends to the server (POST, GET and DELETE of the Streamable HTTP transport, POST of the SSE transport); for its OAuth requests, and for any other value, requestInit.redirect is not consulted by default. Browsers do not expose the target of a redirect to a page, so there a redirected request fails instead of being followed. Setting redirectPolicy: 'follow' on a transport leaves its redirects to the fetch implementation, as before this change.

Patch Changes

#2599 5238fba Thanks @freya0926! - A server can now serve, and a client can now call, tasks/get and tasks/cancel of the Tasks extension (SEP-2663) on a 2026-07-28 connection, when the handler is registered and the request is sent with an explicit schema. Every other method that a protocol revision removed is still refused. If one server factory serves both eras and such a handler is meant for 2025-era clients only, register it only when ctx.era === 'legacy'.

#2846 63c0fca Thanks @Sthreal! - Receiving a large message as a single SSE event over Streamable HTTP, such as a tool result of tens of megabytes, is now fast: a 50 MB result that took about 13 seconds arrives in under a second. The client now requires eventsource-parser 3.0.8 or later. SSEClientTransport reads through the eventsource package and gets the same speed-up once that also resolves eventsource-parser 3.0.8 or later.

#2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

#2903 e765b3b Thanks @claude! - With versionNegotiation in 'auto' or pin mode, a server/discover probe answered with a 2xx that carries no usable reply (a body that is not JSON under application/json, a bare 204, a missing or unaccepted content type) still rejects connect() with EraNegotiationFailed; an empty SSE stream or a 202 surfaces as the probe timeout instead. The message now says the server answered with an unusable reply (...) instead of reading like a network failure. To connect to a 2025 server behind a front that answers the probe this way, pass connect(transport, { prior: { kind: 'legacy' } }) or use mode: 'legacy'.

#2905 c0cd01a Thanks @claude! - SSEClientTransport now retries the SSE connection once after onUnauthorized() resolves, as documented. If the retry is also answered with 401, start() rejects with SdkHttpError (ClientHttpAuthentication) instead of calling onUnauthorized() again. A 401 on a later reconnect of a stream that had opened still gets one refresh.

Updated dependencies [633dd3e]:

@modelcontextprotocol/core@2.3.0

Commits

fcef852 Version Packages (#2953)
e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
3ab61c6 docs: update the README banners (#2940)
8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
33fecfb test(e2e): cover tools/call without arguments (#2933)
818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
a202a36 Version Packages (#2896)
2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
Additional commits viewable in compare view

Updates @types/node from 24.19.0 to 24.19.2

Commits

See full diff in compare view

Updates @modelcontextprotocol/server from 2.2.0 to 2.3.1

Release notes

Sourced from @modelcontextprotocol/server's releases.

@modelcontextprotocol/server-legacy@2.3.1

Patch Changes

#2952 5a18673 Thanks @claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/server@2.3.1

Patch Changes

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/server-legacy@2.3.0

Patch Changes

#2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

Updated dependencies [633dd3e]:

@modelcontextprotocol/core@2.3.0

@modelcontextprotocol/server@2.3.0

Minor Changes

#2929 40f8f4e Thanks @claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

#2926 6d8dbc6 Thanks @claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

#2918 84804c2 Thanks @claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

What keeps working without a change:

createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.

A handler that builds a new server and a new stateless transport for each request.

One server and one transport per session (a transport with a sessionIdGenerator).

Connecting a server again after close().

Client.

What fails now, how it shows, and what to change:

One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.

One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.

createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).

One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

#2907 e55f9ac Thanks @claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits

fcef852 Version Packages (#2953)
e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
3ab61c6 docs: update the README banners (#2940)
8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
33fecfb test(e2e): cover tools/call without arguments (#2933)
818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
a202a36 Version Packages (#2896)
2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
Additional commits viewable in compare view

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates @types/node from 24.19.0 to 24.19.2

Commits

See full diff in compare view

Updates @modelcontextprotocol/server from 2.2.0 to 2.3.1

Release notes

Sourced from @modelcontextprotocol/server's releases.

@modelcontextprotocol/server-legacy@2.3.1

Patch Changes

#2952 5a18673 Thanks @claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/server@2.3.1

Patch Changes

Updated dependencies []:

@modelcontextprotocol/core@2.3.1

@modelcontextprotocol/server-legacy@2.3.0

Patch Changes

#2908 633dd3e Thanks @claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

Updated dependencies [633dd3e]:

@modelcontextprotocol/core@2.3.0

@modelcontextprotocol/server@2.3.0

Minor Changes

#2929 40f8f4e Thanks @claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

#2926 6d8dbc6 Thanks @claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

#2918 84804c2 Thanks @claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

What keeps working without a change:

createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.

A handler that builds a new server and a new stateless transport for each request.

One server and one transport per session (a transport with a sessionIdGenerator).

Connecting a server again after close().

Client.

What fails now, how it shows, and what to change:

One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.

One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.

createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).

One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

#2907 e55f9ac Thanks @claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits

fcef852 Version Packages (#2953)
e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
3ab61c6 docs: update the README banners (#2940)
8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
33fecfb test(e2e): cover tools/call without arguments (#2933)

Bumps the npm group with 4 updates in the /mcp-client-typescript directory: [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript), [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk), [dotenv](https://github.com/motdotla/dotenv) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Bumps the npm group with 4 updates in the /tests/helpers directory: [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) and [zod](https://github.com/colinhacks/zod). Bumps the npm group with 3 updates in the /weather-server-typescript directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) and [zod](https://github.com/colinhacks/zod). Updates `@anthropic-ai/sdk` from 0.131.0 to 0.133.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.131.0...sdk-v0.133.0) Updates `@modelcontextprotocol/client` from 2.2.0 to 2.3.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.2.0...@modelcontextprotocol/client@2.3.1) Updates `dotenv` from 18.0.5 to 18.0.7 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v18.0.5...v18.0.7) Updates `@types/node` from 24.19.0 to 24.19.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@modelcontextprotocol/client` from 2.2.0 to 2.3.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.2.0...@modelcontextprotocol/client@2.3.1) Updates `@types/node` from 24.19.0 to 24.19.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@modelcontextprotocol/server` from 2.2.0 to 2.3.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.2.0...@modelcontextprotocol/server@2.3.1) Updates `zod` from 4.6.5 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.6) Updates `@types/node` from 24.19.0 to 24.19.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@modelcontextprotocol/server` from 2.2.0 to 2.3.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.2.0...@modelcontextprotocol/server@2.3.1) Updates `zod` from 4.6.5 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.6) --- updated-dependencies: - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.133.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@modelcontextprotocol/client" dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: dotenv dependency-version: 18.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/node" dependency-version: 24.19.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@modelcontextprotocol/client" dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@types/node" dependency-version: 24.19.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@modelcontextprotocol/server" dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/node" dependency-version: 24.19.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@modelcontextprotocol/server" dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026

a-akimov approved these changes Oct 15, 2026

View reviewed changes

a-akimov merged commit 38e14ca into main Oct 15, 2026
3 checks passed

a-akimov deleted the dependabot/npm_and_yarn/mcp-client-typescript/npm-f999df7b57 branch October 15, 2026 19:47

Navigation Menu

Repository navigation

Bump the npm group across 3 directories with 6 updates - #253

Bump the npm group across 3 directories with 6 updates#253
a-akimov merged 1 commit into
mainfrom
dependabot/npm_and_yarn/mcp-client-typescript/npm-f999df7b57

dependabot Bot commented on behalf of github Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026

sdk-v0.133.0

Features

Chores

sdk-v0.132.1

Bug Fixes

Chores

Documentation

sdk: v0.132.0

0.132.0 (2026-10-07)

Features

Bug Fixes

0.133.0 (2026-10-09)

Features

Chores

0.132.1 (2026-10-08)

Bug Fixes

Chores

Documentation

0.132.0 (2026-10-07)

Features

Bug Fixes

@​modelcontextprotocol/client@​2.3.1

Patch Changes

@​modelcontextprotocol/client@​2.3.0

Minor Changes

Patch Changes

18.0.7 (2026-10-09)

Changed

18.0.6 (2026-10-06)

Changed

@​modelcontextprotocol/client@​2.3.1

Patch Changes

@​modelcontextprotocol/client@​2.3.0

Minor Changes

Patch Changes

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

@​modelcontextprotocol/server@​2.3.1

Patch Changes

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

@​modelcontextprotocol/server@​2.3.0

Minor Changes

v4.6.6

Commits:

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

@​modelcontextprotocol/server@​2.3.1

Patch Changes

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

@​modelcontextprotocol/server@​2.3.0

Minor Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`@modelcontextprotocol/client@2`.3.1

`@modelcontextprotocol/client@2`.3.0

`@modelcontextprotocol/client@2`.3.1

`@modelcontextprotocol/client@2`.3.0

`@modelcontextprotocol/server-legacy@2`.3.1

`@modelcontextprotocol/server@2`.3.1

`@modelcontextprotocol/server-legacy@2`.3.0

`@modelcontextprotocol/server@2`.3.0

`@modelcontextprotocol/server-legacy@2`.3.1

`@modelcontextprotocol/server@2`.3.1

`@modelcontextprotocol/server-legacy@2`.3.0

`@modelcontextprotocol/server@2`.3.0