fix(deps): 🔒 upgrade MCP SDK to 1.30.0 and retain category annotations - #873
Open
binggg wants to merge 10 commits into
Open
fix(deps): 🔒 upgrade MCP SDK to 1.30.0 and retain category annotations#873binggg wants to merge 10 commits into
binggg wants to merge 10 commits into
Conversation
WIP: bump security overrides and direct deps (adm-zip/ws); lockfiles pending. Co-authored-by: Cursor <cursoragent@cursor.com>
…2d003) Co-authored-by: Cursor <cursoragent@cursor.com>
Pin root and mcp vitest to 3.2.7 to clear GHSA-5xrq-8626-4rwp, remove unused test:ui, and adapt mcp pool config for Vitest 3. Co-authored-by: Cursor <cursoragent@cursor.com>
…decef602) Add npm overrides for axios/body-parser/lodash.unset/uuid in both example manifests; leave lodash.set deferred (no patched modular release). Co-authored-by: Cursor <cursoragent@cursor.com>
Alias the unmaintained decompress Zip Slip transitive dep from @cloudbase/toolbox to the maintained @xhmikosr/decompress@11.1.3 fork. Co-authored-by: Cursor <cursoragent@cursor.com>
Pin @modelcontextprotocol/sdk to 1.30.0 (>=1.26.0) with zod 3.25.76 for the peer range. Keep annotations.category on the wire and mirror it into _meta.category so official SDK Client parsers still expose category after ToolAnnotations strip. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Stub applyCategoryAnnotationMeta in unit mocks and treat input-schema failures as CallToolResult.isError instead of client throws. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep zod 3.25.76 for MCP SDK peer range; retain category/_meta dual-write notes. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@modelcontextprotocol/sdkto 1.30.0 (>=1.26.0) withzod3.25.76 to clear the Dependabot high-severity advisory.annotations.categoryon the wire and dual-write_meta.categoryso official SDK Client parsers still expose category afterToolAnnotationsstrip.mainincluding fix(ci): 🛡️ rsync --checksum for Push Skills Repo #874.Context
Test plan
Publish MCP Package/npm run test)annotations-categoryunit/regression tests pass (wireannotations.category+ Client_meta.category)tools/liststill returns tools with category metadatamcp/.agents/changes included